Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
1answer
597 views

Strange Change in ssh behavior + LDAP

We have a cluster with a front node that admits normal users and LDAP users. Two days ago the ssh show a strange behavior: The LDAP users can't login in the front node using password but, The LDAP ...
4
votes
3answers
5k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
3
votes
1answer
5k views

What is nsswitch compat mode?

Red Hat recommended me compat mode in /etc/nsswitch.conf as one of the options to enumerate LDAP users, but later said that it's not a much-used method. nsswitch.conf passwd: files compat ...
0
votes
1answer
282 views

What are disadvantages of using nsswitch compat?

In my current LDAP set-up "getent passwd" shows all 600+ users that exist in the LDAP, not enumerating only the 20 LDAP-users that have permission to access this netgroup/server. This can be solved ...
6
votes
1answer
646 views

Need help understanding PAM directives

I have the following directives in my /etc/pam.d/sshd file on a RHEL5 box and I'm a bit confused. These directives are there to make LDAP+RADIUS+OTP work. What I'm trying to do is tell pam not to ...
2
votes
1answer
449 views

How can I limit failed sasl2/pam_mysql login retries?

I have Postfix setup serving multiple virtual domains on a CentOS box - and all works as expected. Client's login are authenticated through sasl2 (saslauthd) and pam_mysql. And when a login attempt ...
1
vote
2answers
319 views

How can I allow users to change their local passwords?

We use an LDAP-server, but we also use local accounts. [jdoe@tst-03 ~]$ passwd Changing password for user jdoe. Changing password for jdoe. (current) UNIX password: Enter login(LDAP) password: This ...
0
votes
1answer
255 views

LDAP queries for local users

Recently, in the company where I work, we have had a general system crash and we are figuring out the causes. Our machines are configured for LDAP authentication plus some local users in some of them. ...
0
votes
1answer
435 views

pam-auth-update without the text UI

Is there a way to run pam-auth-update (or some equivalent command), non-interactively on Ubuntu 12.04. I'm trying to automate this process for a number of machines, and the curses interface is making ...
1
vote
1answer
207 views

vsftpd + vitual users + selinux

I can't make vsftpd to work and it is driving me crazy. The virtual users can connect, but they can't upload files or create folders. I hope someone can help me. I get this error in the ftp client: ...
0
votes
2answers
555 views

PAM LDAP configuration for non-local user authentication

I have a requirement to allow non-local user accounts to be logged in via LDAP authentication. Meaning, the user that is trying to login is allowed access, if the user account exists in LDAP server ...
3
votes
3answers
669 views

Is there a command line two-factor authentication verification code generator?

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...
2
votes
0answers
158 views

Trying to script rsync using pam_exec

I'm trying to write a bash script that will execute rsync when called by pam_exec. I've tried a couple different ways, and I'm not sure what I'm doing wrong. When I try to run the script at login by ...
1
vote
1answer
694 views

530 Login incorrect - vsftpd w/SSL (Not using PAM?)

I cannot log in with any local users on my vsftpd running on CentOS6 32-bit. The server simply reports login incorrect. My log files look like this: [doctorblue@guardian ~]$ sudo tail ...
1
vote
1answer
775 views

pam_tty_audit apparently not working

I just compiled pam_tty_audit module, because my Linux distro doesn't include it with the usual PAM modules. I included to the /etc/common-session the configuration line, as suggested in this ...
5
votes
4answers
678 views

Locking a user's account locally when kerberos is enabled

I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics: If there is no local account, login is blocked. If there is a local account with SSH keys, use ...
0
votes
1answer
1k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
3
votes
1answer
118 views

What does this plugable authentication module (PAM) “code” mean?

I am reading a configuration file for Linux PAM and am wondering what it means: auth [success=2 default=ignore] pam_krb5.so minimum_uid=1000 I understand that "auth" means this rule is ...
0
votes
1answer
1k views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...
0
votes
1answer
414 views

Dell OMSA Authentication Fail on Ubuntu

I am trying to log into an install of Dell OMSA 5 on a Dell PowerEdge 2850 running Ubuntu 8.04 LTS x64. OMSA is 32bit and is trying to load the 64bit pam modules for authentication. Whatever ...
0
votes
1answer
1k views

Account lockout setting in Centos 6

I'm trying to implement an account lockout after 3 fail sign-on attempt. Root is exempted. Here's what I have in my /etc/pam.d/system-auth file so far auth required pam_tally2.so deny=3 ...
5
votes
2answers
1k views

vsftpd - PAM - MySQL and pam_mkhomedir to create directories

I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection. Here is ...
1
vote
0answers
68 views

Set pam_unix password without knowing current password, having authenticated with pam_winbind

Right, so I have winbind authentication set up for login. However, I think there may still be some situations in which it would be useful for the user to be able to set their unix password (in the ...
0
votes
1answer
195 views

Lag between PAM password acceptance and session open on CentOS5

I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
0
votes
1answer
503 views

restarting authconfig changes order of my /etc/nsswitch.conf

Here is my nsswitch.conf: passwd: files ldap sss shadow: files ldap sss group: files sss When I restart authconfig, it removes ldap from passwd, shadow, and group. Here's my ...
0
votes
2answers
41 views

changing /etc/pam.d location

is there a way to change location of /etc/pam.d directory, or is it hardcoded into PAM? can't it be changed with some environment variable for specific client programs? for example: ...
1
vote
1answer
1k views

getent and ldapsearch results are inconsistent concerning the loginShell

I have a test that creates a user in LDAP with /bin/bash and I then modify the ldap attributes to /bin/noshell but the results from getent and ldapsearch are inconsistent for the shell. This user does ...
1
vote
1answer
799 views

Restricting LDAP users from authenticating without a valid shell

What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
0
votes
2answers
210 views

Requiring two-factor ssh authentication only from certain clients

I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses. ...
1
vote
1answer
3k views

Linux PAM pam_succeed_if.so

I've specified an AD security group in PAM to restrict which domain users can login. I've also restricted sessions for AD users to this group. This prevents a logged in user from doing an "su -" to ...
0
votes
2answers
2k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
79 views

Can I setup a Samba master password?

I want to be able to connect to a Samba share as a specific user but I don't know his password, and I don't want to change it. I did this on Dovecot by setting up a master password, can I do something ...
0
votes
2answers
271 views

Can't get pam_time.so to work with http

The /etc/security/time.conf man page contains this example: All users except for root are denied access to console-login at all times: login ; tty* & !ttyp* ; !root ; !Al0000-2400 For this ...
0
votes
1answer
320 views

Call Pam module before public key authentication on SSH

I am currently writing a pam module which does some checks if the key stored in authorized_keys is still valid. However I cant find a possiblity to run the module before the public key authentication ...
4
votes
0answers
3k views

Linux samba server: cifs_mount failed w/return code = -12

Server: RHEL 5.9 / smbd 3.0.33 - Clients: various, though all were using current mount.cifs (5.2) I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
1
vote
1answer
165 views

When changing passwords, how to let one PAM module check for old passwords and another to save new ones?

Our server is currently using the blowfish cipher to store passwords and it uses pam_unix2. We'd like to gradually switch to SHA. The idea is that all newly changed passwords would be hashed with SHA. ...
2
votes
1answer
96 views

configuring pam with flat files backend

I would like to configure pam module to use flat files for authentication. Basically I need same thing like pam_unix just with possibility to use different files (other than /etc/passwd and ...
0
votes
0answers
464 views

Why would Dovecot POP3 and IMAP Authentication from external IP address stop working?

Over a year ago I setup a Dovecot 1.2.9 POP3/IMAP server (which works alongside a Postfix SMTP server) with PAM authentication. This has been operating (I believe) without incident until recently ...
0
votes
3answers
438 views

validate only one user with pam ldap and nslcd

I want only user "theuser" to login to this host. I have tried the following in nslcd.conf: pam_authz_search (&(objectClass=posixAccount)(IsActive=TRUE)(uid=theuser)) but all can login. If ...
1
vote
1answer
2k views

Postfix smtpd won't talk to saslauthd

I have an saslauthd setup to authenticate against PAM. It seems to do its stuff: root@sasltest:~# testsaslauthd -u quest -p #### -s smtp 0: OK "Success." I have libsasl 2.1.23, postfix 2.7.1. I ...
1
vote
1answer
360 views

Ubuntu 12.10 - Can't find my logs

Up until few days ago, my Ubuntu 10.04 worked like a clock. Then I switched to Ubuntu 12.10 and things don't work the same way with this setup. First, the new system wasn't logging any mail activity, ...
3
votes
1answer
66 views

sudo failing even though ownership and modes set correctly

I am getting the dreaded sudo: must be setuid root error even though the executable in /usr/bin/sudo has ownership root:root and mode 4755 (-rwsr-xr-x). /etc/sudoers is mode 440. My user is in sudoers ...
2
votes
0answers
185 views

pam_mysql / vsftpd error 'AUTHENTICATION FALURE (FIRST_PASS)'

I setup vsftpd and mysql auth via pam on Debian Squeeze. Config: auth required pam_mysql.so user=server passwd=x host=localhost db=server table=ftp usercolumn=username passwdcolumn=password ...
1
vote
4answers
355 views

PAM LDAP authentication restriction

I have integrated PAM with LDAP authentication. Q- how to restrict login for some users to some Linux servers. For example- we have integrated 100 Linux servers in the Org with PAM LDAP auth and we ...
1
vote
1answer
307 views

MariaDB + PAM: Is Remote Auth Secure?

I have a MariaDB instance which is using PAM to auth against Active Directory. Is remote authentication with this service secure? I ran a Wireshark trace during the auth process, and passwords are not ...
2
votes
1answer
760 views

edit crontab for apache

I am transfering crontabs from an old server (centos 5.5) to a a new (centos 6.0) and there is a problem with (the most important) user apache. On the new server I am getting the following: ...
4
votes
1answer
1k views

Can I use DenyHosts for a SMTP service

I would like to block some hosts that are brute forcing my SMTP server. I'm currently using DenyHosts for SSHD and was wondering if I can add the SMTP service too. It could be possible based on this ...
2
votes
1answer
424 views

Authenticate Git virtual users via PAM

Can Git authenticate virtual users via PAM? In particular, would Git require some additional utility, such as gitolite or gitosis?
4
votes
4answers
2k views

How to increase max FD limit for a daemon process running under a headless user?

To increase the FD limit for a daemon process running under a headless user on a Ubuntu Linux machine we did following changes in /etc/security/limits.conf soft nofile 10000 hard nofile 10000 We ...
3
votes
2answers
2k views

Ubuntu 12.04 updates broke VSFTP

I am running Ubuntu 12.04 LTS. I did some minor updates using apt. After rebooting vsftp stopped accepting connections system user logins. In the auth log I am getting the following errors Dec 22 ...