Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
0answers
22 views

How to enforce the use of google-authenticator on a specfic group?

I've installed google_authenticator on one of our deploy servers (Ubuntu trusty on AWS EC2) and I would like to enforce the use of google two-factor authentication only on one specific group ...
1
vote
1answer
1k views

pam_tty_audit apparently not working

I just compiled pam_tty_audit module, because my Linux distro doesn't include it with the usual PAM modules. I included to the /etc/common-session the configuration line, as suggested in this ...
0
votes
1answer
1k views

pam_tally2 being called before Password entry

Based on the suggestion given in: Account Lockout with pam_tally2 in RHEL6 I have come to a working configuration, wherein account is getting locked out after 3 failed logins. Catch is that ...
3
votes
1answer
1k views

vsftpd with pam_winbind.so

I'm trying to setup vsftpd to use logins from our domain. I want the ftp users to be able to login using their active directory username/password and have be able to have full access to ...
2
votes
2answers
2k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
2
votes
0answers
16 views

PAM vs /etc/shadow in Dovecot SASL configuration - Security differences?

I set up a server with Postfix SMTP auth through Dovecot SASL. However, it was not possible to get the PAM authentification working as standard out of the box. So more by chance, I changed it to ...
0
votes
1answer
33 views

How can I allow all users to run mount as root?

How can I allow all users to run mount as root? I know there's a lot of solutions out there recommending the following edit, but it's not working for me. I've edited /etc/sudoers to include: ALL ...
4
votes
2answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
1
vote
1answer
3k views

libpam-ldapd not looking for secondary groups

I'm migrating from libpam-ldap to libpam-ldapd. I'm having some trouble gathering the secondary groups from LDAP. On libpam-ldap, I had this on the /etc/ldap.conf file: nss_schema rfc2307bis ...
4
votes
3answers
18k views

How to fix a crontab access issue with a pam configuration error message? [closed]

I attempted to access my crontab as the non-root user "coins" when I encountered a permissions issue as shown in the following error message mentioning the pam configuration: [coins@COINS-TEST ~]$ ...
1
vote
1answer
2k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
0
votes
1answer
62 views

how to control ldap users access using groupdn?

i am using openldap, nslcd and nss-pam-ldapd. i want to restrict users login to ldap client. i have configured this in centos6.5 without any problem using groupdn. but in centos 7, there is no ...
1
vote
1answer
3k views

pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968]?

Why is the following log produced? pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968] Is it because of a timeout, or is there some other reason?
4
votes
1answer
61 views

openldap user can't login when using tcsh

I would appreciate any help in the following problem: I have an openladp (2.3.39) server (Fedora 8) which authenticates users from other ldap clients (various versions of Fedora). On my attempt to ...
0
votes
1answer
20 views

How can I ensure auditability and least privilege based on AWS users inside an EC2 image?

I'm interning at a company which runs in an AWS environment and is starting to look into locking down user privileges, so I'm looking into ways to secure EC2 instances. Specifically, I want to find a ...
8
votes
2answers
1k views

vsftpd - PAM - MySQL and pam_mkhomedir to create directories

I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection. Here is ...
0
votes
0answers
30 views

Mounting samba directory changes all file permissions to user who mounted it

I have a xubuntu 14.04 client, a debian 8 Samba File server and an external Active Directory service. I log in as user1 on the client authenticating against the ADS with winbind. My home directory ...
0
votes
0answers
23 views

Dovecot auth-worker permission denied to PAM and even /dev/log

Problem I have a problem dovecot authenticating users via pam_sss.so (in an LXC container, which may be related or may be not). # doveadm auth login semenov Password: passdb: semenov auth failed ...
3
votes
2answers
2k views

Public-Key -or- Password & Google Authenticator for SSH Login

I found an article (http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/) that explains how to configure OpenSSH to ask for a Google Authenticator ...
1
vote
2answers
36 views

Initialise Kerberos ticket on ssh login using PAM

Right, so I am struggling a bit with PAM in Centos7. I have no idea how to configure it manually and make the changes permanent so that I get a kerberos ticket after a successful ssh login. The ...
6
votes
3answers
196 views

Conflicts with PAM configuration files when upgrading system

I have a VPS that runs Ubuntu 14.04.4 LTS; it was installed as a whole with Plesk by OVH. I juste did a apt-get upgrade, and at some point I had a message regarding PAM. The system is in French, but ...
1
vote
2answers
3k views

passwd: Authentication token manipulation error

I am running a Ubuntu 12 machine, and have recently been working to secure it. I made all the changes from this guide. I am not running a Linode, but I used these as a starting point for setting up ...
0
votes
0answers
26 views

Kerberos-based SSH login requires local user account

I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access. The only issue is, ...
3
votes
1answer
3k views

How to restore pam configuration?

I did some modifications in /etc/pam.d/common-auth, /etc/pam.d/common-account, /etc/pam.d/common-password, /etc/pam.d/common-session files. Is there any way to restore default pam configuration? I am ...
1
vote
1answer
65 views

How to config vsftpd to map virtual user to a custom local user?

I would like that virtual user use a defined local user. this local user is member of groups apache (www-data for debian user, I use here a centos7) and ftp useradd ftpuser -d /var/www -g apache -G ...
0
votes
3answers
968 views

Using PAM and vsftpd without root access

I'm trying to set up a few vsftpd instances on a machine that I have no root access to. The authentication should be done through PAM with pam_listfile, like this: pam_listfile.so item=group ...
0
votes
1answer
953 views

vsftpd virtual users home directories with pam-mysql

ive saw many solutions like homedir=/somepath/$USER where $USER takes from sysvar and i want to change it for every user with mysql database. Im using it with pam-mysql so it will look like Id login ...
0
votes
1answer
2k views

vsftpd Unable to log in to ftp using Berkeley DB (V4) databases and PAM (pam_userdb.so)

I just recently tried setting up vsftpd, following this nixCraft article on cyberciti and their article to set up virutal users. I can connect using ftp localhost but it doesn't recognize the ...
0
votes
3answers
103 views

openvpn pam authentication failure

I am trying to setup PAM authentication on my openVPN instance running on Ubuntu Server 15.04 but i keep getting an authentication failed error, am i missing anything? server.conf port 1194 proto ...
0
votes
1answer
31 views

what does “-session …” mean in /etc/pam.d/system-session?

In Red Hat 7 I see -session optional pam_systemd.so in /etc/pam.d/system-session. I also see that the - prefix is mentioned in LFS docs: ...
2
votes
1answer
53 views

OpenLDAP - How to restrict Debian login to specific groups (posixGroup)?

I'm trying to restrict login to specific LDAP groups in Debian 8. The system is configured to use OpenLDAP (PAM) as authentication method. My goal is to configure the system to allow all local users ...
0
votes
1answer
298 views

Red Hat 6.5 - Login Errors After Security Hardening

I followed the information below, however, it is strangely blocking me from entering a password upon entering the login prompt on the server: To configure the system to lock out accounts after a ...
2
votes
0answers
59 views

X11rdp/xrdp with aad-login -> pam authentication fails (xrdp_mm_process_login_response: login failed)

We are implementing a solution that allows users to login via aad-login (Azure Active Directory login) following this guide: https://github.com/bureado/aad-login Everything works fine - I can login ...
1
vote
1answer
873 views

530 Login incorrect - vsftpd w/SSL (Not using PAM?)

I cannot log in with any local users on my vsftpd running on CentOS6 32-bit. The server simply reports login incorrect. My log files look like this: [doctorblue@guardian ~]$ sudo tail ...
1
vote
1answer
39 views

PAM authentication - Write error: broken pipe

In order to allow the 2FA in my domain, I setup a LinOTP server to manage the map between tokens and users (from LDAP) in my realm. So, I configured the PAM stack to integrate this authentication ...
0
votes
1answer
17 views

Nonsystem authentication for unprivileged sftpd

I am creating a test system that needs to be able to briefly act as a sftp server on a nonprivalaged port. The test system runs as a normal user. So I'm thinking as running sshd with the sftp ...
1
vote
1answer
28 views

Local credentials used when radius server is available sshd pam_radius

I have pam_radius setup and it works (centos6, pam_radius: 1.4.0-2.el6), i can authenticate via the radius server using ssh. What i am trying to accomplish is that when the radius server is ...
1
vote
6answers
3k views

Authentication failed of pure-ftpd

I installed pure-ftpd on Ubuntu 8.04 using aptitude install pure-ftpd What's the step to add users? I'm new to pure-ftpd and PAM authentication, but I followed pure-ftpd documentation to do ...
0
votes
0answers
16 views

Linux Samba Server: PAM?

I've read several places that the Linux Samba server cannot use PAM authentication - some say because of the challenge-response pattern and other say because it requires unencrypted passwords. ...
0
votes
1answer
23 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
1
vote
1answer
311 views

PAM Module works fine on i386 but fails on x64 when used in vsftpd

We have a custom PAM module that works fine on our i386 development machines but when we try and use it in production on our x64 production servers with vsftpd it fails. The PAM module has been ...
0
votes
0answers
53 views

pam_sss(sudo:auth): authentication failure

I'm having some CentOS 7 machines joined a windows domain with the following steps: #yum -y install realmd sssd oddjob oddjob-mkhomedir adcli samba-common #nmcli c modify eth0 ipv4.dns 192.168.3.18 ...
2
votes
1answer
208 views

vsftpd freezes after failed pam_script authentication

I have an Ubuntu 14.04 server with vsftpd and pam_script installed using apt-get. I've configured vsftpd to use pam_script for virtual user authentication and my /etc/pam.d/vsftpd file looks like ...
0
votes
1answer
51 views

Trying to execute a script with pam authentication

I want to be able to execute a custom script when pam does the authentication but I get an error out that I can't seem to pass: Feb 20 17:39:47 DC03R07DS25-08 sockd[2874]: pam_exec(sockd:auth): send ...
4
votes
4answers
21k views

PBIS Open AD authentication stops working on ubuntu with errors: “user accout has expired” and “is your account locked?”

We have been using PowerBroker Identity Services Open to authenticate active directory users from ubuntu hosts successfully for six months. Recently AD authentication stopped working on several ...
3
votes
2answers
2k views

sshd: How to enable PAM authentication for specific users under

I am using sshd, and allow logins with public key authentication. I want to allow select users to log in with a PAM two-factor authentication module. Is there any way I can allow PAM two-factor ...
0
votes
0answers
26 views

do not allow multiple sessions if user have different IPs

I am running Red Hat Enterprise Linux 6.6 and for authentication we use LDAP authentication. We have running application on a server (doesn't really matter which one it is) and the way application ...
3
votes
1answer
4k views

vsftp login errors 530 login incorrect

Using Ubuntu 10.04 on an aws ec2 instance. I was happy just using ssh but then a wordpress plugin needs ftp access...I just need ftp access for one site www.sitebuilt.net which is in /home/sitebuil. ...
2
votes
0answers
99 views

Monitoring failed ssh logins with pam and bash?

I modified /etc/pam.d/common-auth to run a bash script when a login fails or when a login is successful and it works for successful logins but not failed login attempts when trying to ssh. Once I am ...
0
votes
1answer
28 views

configure a PAM module to be required for all but certain users for which it should be sufficient [duplicate]

I'd like to be able to configure /etc/pam.d/sshd so that: for all users except those in group "admin", module pam_radius is required. for those users in group admin, module pam_radius is ...