Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

2
votes
1answer
204 views

Customize PAM messages

I would like to customize my password expiration warnings. I figured PAM reads them from somewhere, but can't find from where. The question is relevant for both Ubuntu/Debian and Fedora/RHEL/CentOS. ...
0
votes
1answer
114 views

How to merge .rpmnew files in Pluggable Authentication Modules (PAM)?

A few .rpmnew files are being created after performing an upgrade of the Fedora OS. The normal procedure for merging .rpmnew files into the original ones is to compare the differences, make the ...
1
vote
1answer
270 views

MySQL Password Authentication with Proxy Users and Group Mapping

I'm actually using MariaDB here, but I'm working under the pretext that MariaDB is a "drop in replacement" for MySQL. I won't be surprised if this winds up being a cross platform difference/issue, but ...
2
votes
4answers
5k views

pam_ldap.so before pam_unix.so? Is it ever possible?

we have a couple of servers with PAM+LDAP. The configuration is standard (see http://arthurdejong.org/nss-pam-ldapd/setup or http://wiki.debian.org/LDAP/PAM). For example, /etc/pam.d/common-auth ...
2
votes
1answer
2k views

How do I disable password complexity in pam

I found tons of articles how to enable password complexity, can someone guide me to how to disable it? (oracle linux) This is my system-auth #%PAM-1.0 # This file is auto-generated. # User changes ...
0
votes
1answer
1k views

Authenticate by libpam-mysql and libnss-mysql (CentOS)

I'm trying to get MySQL to function as a backend for authenticating users on CentOS 6.3. So far I have successfully installed and configured libnss-mysql. I can test this by doing: # groups testuser ...
5
votes
3answers
3k views

vsftpd will not accept passwords encrypted with MD5

I am setting up an server with vsftpd to let virtual users access their space. Now it is fully working but only with CRYPT passwords. So sudo htpasswd -c /etc/vsftpd/ftpd.passwd phpmyadmin will ...
2
votes
2answers
1k views

Linux ldap authentication, pam_filter ignored

I've set up linux client authentication via ldap, it works. I want to control user's access to several services by adding or removing different OUs for accounts. E.g., if user is allowed to login ...
6
votes
2answers
12k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
1
vote
1answer
363 views

ssh login fails for user with empty password [closed]

How do you enable ssh login on OS X 10.8 (Mountain Lion) for a user with an empty password? I've seen others asking this question, and like me it's for the same reason: a parent who can't deal with ...
3
votes
1answer
170 views

Can I use both the RSA 2-Factor PAM and an Active Directory PAM at the same time?

Let's use the product formerly known as Likewise as an example. I can very easily install this on a Linux machine and join it to an Active Directory domain. I can also use an RSA PAM module so that ...
0
votes
1answer
5k views

How do you configure /etc/pam.d/system-auth-ac on CentOS 6 using authconfig?

I'm trying to replace the cracklib module with passwdqc. Every time I do an authconfig --update (or --updateall), the changes I make on the system-auth-ac file goes away. The authconfig command line ...
3
votes
1answer
195 views

Locking user account on RHEL using PAM LDAP

I have a bit of an edge case here. My institution has a RHEL server where students can log in and do their work. Accounts are held in LDAP and the server uses PAM and LDAP to authenticate. At the end ...
1
vote
1answer
487 views

Immediate logout after login with PAM, Kerberos, and LDAP

I've set up remote login on a computer using Kerberos and LDAP. I've also configured NFS to mount onto /home so that the user's home directory is the same wherever they login. Kerberos authentication ...
12
votes
2answers
488 views

SSH only works after intentionally failed password

So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
1
vote
0answers
546 views

CentOS PAM+LDAP login and host attribute

My system is CentOS 6.3, openldap is configured well, PAM authorization works fine. But after turning pam_check_host_attr to yes, all LDAP-auths fail with message "Access denied for this host". ...
0
votes
1answer
80 views

Can you use LDAP and PAM to implement a restricted shell?

Can you use LDAP and PAM to implement a restricted shell and control those users via groups on the LDAP DC? I would like to do this for several Red Hat, Solaris and Ubuntu servers? Thanks!
1
vote
1answer
489 views

Cannot login as root to centos server

I used to login as ssh root@servip with a password authentication into my CentOS 6 server. I am not sure if what I have done has caused this, but while trying to get over my problem of accessing ...
1
vote
3answers
66 views

Rip authentication from LDAP to local

We are taking a small portion of our network offline, and running a separate network using that portion. (By small portion I mean 2 servers, that will be connected to 30 odd boxes that aren't usually ...
5
votes
2answers
2k views

Nginx with PAM authentication through pam_script

Have anyone set up such a configuration? It's not working for me. I've installed nginx-extras on Ubuntu 12.04 (it's built with PAM module), and added to site config: location ^~ /restricted_place/ { ...
4
votes
1answer
624 views

pam_tty_audit and non privileged users

I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file: session ...
0
votes
1answer
917 views

PAM Errors in auth.log [Debian Squeeze]

Based on the the Securing Debian article on debian.org, I added the following to /etc/pam.d/other. auth required pam_securetty.so auth required pam_unix_auth.so auth required ...
1
vote
1answer
2k views

libpam-ldapd not looking for secondary groups

I'm migrating from libpam-ldap to libpam-ldapd. I'm having some trouble gathering the secondary groups from LDAP. On libpam-ldap, I had this on the /etc/ldap.conf file: nss_schema rfc2307bis ...
0
votes
1answer
773 views

What is the package name to install pam-pwdfile via yum on Red Hat?

I am installing vsftpd and want to create virtual users. I want to have a file and add users to it via htpasswd and use it for authentication.
5
votes
1answer
4k views

SMTP authentication failure + PAM-MySQL cannot authenticate

I am building a mail server using Postfix, and set up the authentication to check against a database set-up using Postfixadmin. I can authenticate via Courier IMAP okay, as it can authenticate ...
4
votes
1answer
2k views

Purpose Behind Disabling PAM in SSH

I'm setting up key based authentication for SSH on a new box, and was reading a few articles that mention setting UsePAM to no along with PasswordAuthentication. My question is, what is the purpose ...
1
vote
2answers
2k views

Why isn't my cronjob running?

I have a cronjob in /etc/cron.d/mycron that looks like this: 0 3 * * * apache php /path/to/my/script.php In the same file there are other cronjobs begin run as root and other users (which ...
2
votes
4answers
4k views

PAM module causes flurry of SSH sessions

While tailing /var/log/auth.log I noticed that there where multiple entries being entered (instantly) by the minute for user "foo". I personally had only one connection open as user "root_bar" while ...
7
votes
2answers
9k views

Reload /etc/security/limits.conf

I would like to: make a soft 64GB limit for resident memory (so inexperienced users will get their run-amok processes killed, but experienced users can raise the limit for memory hungry processes) ...
2
votes
1answer
7k views

PAM unable to dlopen(/lib64/security/pam_fprintd.so) causing CentOS/Redhat server to crash

CentOS 6, Parallels PLESK 10.4, Apache One of my servers went down over the weekend much to my dismay. On the day and time it occurred, my log errors/messages end with this - /var/log/secure: Jul ...
1
vote
2answers
1k views

CentOS: Missing dependencies when installing vsftpd with MySQL

I'm using the guide at http://wiki.centos.org/HowTos/VirtualVsFtpd to install virtual users into vsftpd on CentOS. After getting partway through the installation, I get to the problem of missing ...
1
vote
2answers
795 views

LDAP and pam without binddn and anonymous access

I am working in a large company and can use its central read-only LDAP server remotely. The LDAP server does not allow anonymous binding. In order to use this server for authentication of the users on ...
1
vote
1answer
556 views

Using pam just for authorisation, without authentification

Helo there, I'm having a situation here which I cannot resolve. I set up a pptp connection between two computers. One acts as a server, other as a client. The connection is made my calling pon ...
2
votes
1answer
642 views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
4
votes
2answers
429 views

Samba: read-only LDAP + additional local users

My server has access to a read-only LDAP where information about 99% of user accounts will reside. On my server I want to configure Samba to use LDAP for authentication. Now and then there will be ...
1
vote
1answer
553 views

Can't configure PAM + LDAP on Debian Lenny - Getting error=49 on server logs

I've been migrating some servers and desktops using Ubuntu 10.04 from getting the users from an old OpenLDAP implementation to a newer Centos Active Directory. I haven't had any problems so far, until ...
2
votes
1answer
540 views

pam_cracklib on Linux: how to disable credits

The pam_cracklib 'minlen' does not work as I want it to. PAM allows passwords even with lesser length than it is set to with the 'minlen' option. It gives credits (by default 1) to the 'upper-case', ...
5
votes
1answer
5k views

Users cannot use crontab after password security upgrade

I have a box being upgraded from CentOS 5 to CentOS 6. On the original server, all users have MD5 passwords. The upgraded server is now using SHA-512 passwords. Users who have changed their password ...
0
votes
1answer
764 views

pam_radius_auth.so - Setting up Radius on RHEL 5.6

I am currently dissecting a single-sign-on RPM. Contained within the RPM there is the module pam_radius_auth.so. Based on the documentation here: http://freeradius.org/pam_radius_auth/ and here: ...
1
vote
1answer
4k views

LdapErr: DSID-0C0903AA, data 52e: authenticating against AD '08 with pam_ldap

I have full admin access to the AD '08 server I'm trying to authenticate towards. The error code means invalid credentials, but I wish this was as simple as me typing in the wrong password. First ...
2
votes
2answers
940 views

pam_unix(su:session): session opened for user

Jun 26 15:58:52 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 15:59:02 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 ...
1
vote
1answer
2k views

nginx public webdav server

Can you check the user group from a $remote_user? location ~ ^/dav/(.*)$ { alias /home/$remote_user/$1; auth_pam "Restricted"; auth_pam_service_name "nginx"; dav_methods PUT DELETE ...
4
votes
1answer
242 views

Weird stuff in in my /var/log/auth.log

I just check my logs on my deed server, I spotted some weird log in the auth.log: Jun 17 22:27:01 mutualab CRON[16249]: pam_unix(cron:session): session opened for user user by (uid=0) Jun 17 22:27:01 ...
1
vote
1answer
400 views

pam_ecryptfs: Error getting passwd (ProFTPD)

proftpd: pam_ecryptfs: Error getting passwd info for user [USERNAME] I am getting this error in the syslog nearly every time any user connects via FTP, the user is able to connect and the session ...
3
votes
1answer
1k views

Linux with winbind, disable local users while AD is available?

Routers and switches with RADIUS authentication can be configured such that login is disabled for locally configured users as long as the RADIUS server is available. If the RADIUS server becomes ...
0
votes
1answer
214 views

PAM module for authentication by IP or other password-disabling module

I'm looking for a Linux pam module that accepts any password for connections from a specific IP. I don't want to disable passwords completely. I need it for migration from one imap server to another ...
2
votes
3answers
3k views

How to use PAM to limit failed login attempts by IP?

I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
10
votes
3answers
2k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
1
vote
2answers
2k views

Samba + LDAP: Newly created users cannot log in

I'm having a problem where users which recently were created are unable to log in, even though they have been added to the correct groups. When viewing the error logs, I'm getting these errors: ...
0
votes
2answers
2k views

How to enable LDAP auth for SFTP logins only

I currently use ActiveDirectory for authentication on my Ubuntu 10.04 servers using a tool called Centrify Express. Centrify has a custom .so file that is configured in /etc/pam.d/common-auth. I'd ...