Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
0
votes
0answers
32 views
How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?
Fail2Ban on Ubuntu 10.04
Configuration files
/etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1
bantime = 10 # made for test purposes
maxretry = 3
backend = polling
destemail = ...
0
votes
2answers
23 views
Locking a user's account locally when kerberos is enabled
I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics:
If there is no local account, login is blocked.
If there is a local account with SSH keys, use ...
3
votes
1answer
215 views
Should pam_mkhomedir go in /etc/pam.d/login , sshd or system-auth?
I want to enable pam_mkhomedir.so for users who authenticate to our system. I want a user's home directory to be created when they SSH into the box.
One common convention seems to be to put ...
0
votes
0answers
26 views
Including pending update list in motd [migrated]
How would you include the list and / or count of pending updates in the welcome banner?
Eg.
username: User
password: *****
Hi 'User', welcome on 'localhost'
There are 8 pending updates, you need to ...
3
votes
1answer
1k views
How to use nginx PAM module?
I would like to use nginx PAM module to authenticate a site with existing users on a FreeBSD system. I tried to use pam_unix.so, but no luck. It's just not let me in with my usr/psw pair. :(
nginx ...
-2
votes
0answers
26 views
Linux mail server allowing users access by windows clients without entering password [closed]
I have long been trying to solve a problem but I could not.
I want to install a linux mail server allowing users access by by windows clients without entering password.
I tried with a combination of ...
3
votes
1answer
41 views
What does this plugable authentication module (PAM) “code” mean?
I am reading a configuration file for Linux PAM and am wondering what it means:
auth [success=2 default=ignore] pam_krb5.so minimum_uid=1000
I understand that "auth" means this rule is ...
4
votes
1answer
831 views
Expired “authentication token” for user with deleted password
The Setup:
1) The user's password was deleted with "passwd -d " command
2) The user has cron jobs running
The Problem:
Once every 30 days (default password expiration policy) the cron fails with an ...
0
votes
1answer
26 views
Kerberos pre-authentication failed on nfs mount
I have the following nfs export:
/home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534)
When trying to mount that on a client I get:
client:/home # ...
0
votes
0answers
19 views
Samba4 compiled from source alongside winbind repo package, not working with PAM
I am on Linux Mint. I have compiled and installed Samba4 from source and joined a Samba4 DC I have elsewhere on my network. I have also been trying to get Samba/winbind to work with PAM to ...
-1
votes
0answers
15 views
How do I make a pam configuration to test that the account exists and ignore wrong or null password?
I got the configuration for this from the same site...
auth sufficient pam_permit.so
But it doesn't work if user gives empty or null password.
Can you please let me know what should be the ...
0
votes
1answer
35 views
PAM configuration for MSCHAP for radius/tacacs
I would like to know how to enable MSCHAP for radius or tacacs.
Please help.
1
vote
1answer
101 views
MySQL Password Authentication with Proxy Users and Group Mapping
I'm actually using MariaDB here, but I'm working under the pretext that MariaDB is a "drop in replacement" for MySQL. I won't be surprised if this winds up being a cross platform difference/issue, but ...
0
votes
2answers
650 views
limits.conf not being applied.
I have the following lines in /etc/security/limits.conf
* soft nofile 32768
* hard nofile 65536
root soft nofile 32768
root ...
2
votes
2answers
671 views
ProFTPD / PAM issues with new centos/virtualmin install
I just installed CentOS 5.4 on a rackspace cloud server and installed virtualmin which all seemed to go fine. The only problem I have is that I can not access the virtual servers directories via FTP.
...
0
votes
0answers
19 views
Dell OMSA Authentication Fail on Ubuntu
I am trying to log into an install of Dell OMSA 5 on a Dell PowerEdge 2850 running Ubuntu 8.04 LTS x64.
OMSA is 32bit and is trying to load the 64bit pam modules for authentication. Whatever ...
3
votes
4answers
767 views
/usr/bin/sshd isn't linked against PAM on one of my systems. What is wrong and how can I fix it?
I'm using AD as my user account server with ldap.
Most of the servers run with UsePam yes except this one,
it has lack of pam support on sshd.
root@linserv9:~# ldd /usr/sbin/sshd
...
-1
votes
0answers
32 views
Log every user command RedHat Linux [closed]
After making the change to the system-auth file and adding the line "session required pam_tty_audit.so enable=*" how do you make this take effect? Is there a process that needs to be started? I can ...
0
votes
0answers
13 views
PAM authentication: external falling back to internal
I am trying to configure PAM authentication in a linux box with an external provider falling back to internal when it is not available.
I query the external provider using a custom script via the ...
0
votes
1answer
75 views
Account lockout setting in Centos 6
I'm trying to implement an account lockout after 3 fail sign-on attempt. Root is exempted.
Here's what I have in my /etc/pam.d/system-auth file so far
auth required pam_tally2.so deny=3 ...
2
votes
1answer
127 views
vsftpd - PAM - MySQL and pam_mkhomedir to create directories
I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection.
Here is ...
1
vote
0answers
16 views
Set pam_unix password without knowing current password, having authenticated with pam_winbind
Right, so I have winbind authentication set up for login. However, I think there may still be some situations in which it would be useful for the user to be able to set their unix password (in the ...
0
votes
1answer
64 views
MariaDB + PAM: Is Remote Auth Secure?
I have a MariaDB instance which is using PAM to auth against Active Directory. Is remote authentication with this service secure? I ran a Wireshark trace during the auth process, and passwords are not ...
0
votes
1answer
63 views
restarting authconfig changes order of my /etc/nsswitch.conf
Here is my nsswitch.conf:
passwd: files ldap sss
shadow: files ldap sss
group: files sss
When I restart authconfig, it removes ldap from passwd, shadow, and group.
Here's my ...
0
votes
1answer
53 views
Lag between PAM password acceptance and session open on CentOS5
I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
4
votes
2answers
7k views
Switch on PAM debugging to Syslog
I hate PAM since it came up.
How do I switch on PAM debugging in Debian Squeeze at the admin level?
I have checked every resource I was able to find. Google, manpages, whatever. The only thing I ...
0
votes
0answers
140 views
MySQL/SASLAuthd/Postfix authentication issue
Can't seem to get authentication via Mysql with SASLAuthd with postfix working. Dovecot connects to mysql by itself fine, and connections/queries show up in /var/log/mysql/mysql.log. When connecting ...
0
votes
2answers
29 views
changing /etc/pam.d location
is there a way to change location of /etc/pam.d directory, or is it hardcoded into PAM?
can't it be changed with some environment variable for specific client programs?
for example:
...
0
votes
1answer
167 views
getent and ldapsearch results are inconsistent concerning the loginShell
I have a test that creates a user in LDAP with /bin/bash and I then modify the ldap attributes to /bin/noshell but the results from getent and ldapsearch are inconsistent for the shell.
This user does ...
1
vote
2answers
405 views
How to use PAM to limit failed login attempts by IP?
I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
1
vote
4answers
108 views
PAM LDAP authentication restriction
I have integrated PAM with LDAP authentication. Q- how to restrict login for some users to some Linux servers.
For example- we have integrated 100 Linux servers in the Org with PAM LDAP auth and we ...
1
vote
1answer
118 views
Restricting LDAP users from authenticating without a valid shell
What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
0
votes
2answers
240 views
sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?
OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
selinux-policy-2.4.6-338.el5
pam-0.99.6.2-12.el5
SELinux is running in permissive mode:
# sestatus
SELinux status: enabled
...
0
votes
2answers
59 views
Requiring two-factor ssh authentication only from certain clients
I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses.
...
1
vote
1answer
137 views
Linux PAM pam_succeed_if.so
I've specified an AD security group in PAM to restrict which domain users can login. I've also restricted sessions for AD users to this group. This prevents a logged in user from doing an "su -" to ...
0
votes
1answer
47 views
Can I setup a Samba master password?
I want to be able to connect to a Samba share as a specific user but I don't know his password, and I don't want to change it.
I did this on Dovecot by setting up a master password, can I do something ...
0
votes
2answers
71 views
Can't get pam_time.so to work with http
The /etc/security/time.conf man page contains this example:
All users except for root are denied access to console-login at all times:
login ; tty* & !ttyp* ; !root ; !Al0000-2400
For this ...
0
votes
1answer
38 views
Call Pam module before public key authentication on SSH
I am currently writing a pam module which does some checks if the key stored in authorized_keys is still valid. However I cant find a possiblity to run the module before the public key authentication ...
1
vote
3answers
40 views
Rip authentication from LDAP to local
We are taking a small portion of our network offline, and running a separate network using that portion. (By small portion I mean 2 servers, that will be connected to 30 odd boxes that aren't usually ...
2
votes
0answers
334 views
Linux samba server: cifs_mount failed w/return code = -12
Server: RHEL 5.9 / smbd 3.0.33
- Clients: various, though all were using current mount.cifs (5.2)
I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
0
votes
2answers
2k views
login as rsh in rhel 6 without entering password
I need to be able to login to a RHEL 6 server using rsh (please don't flame me about security, it's irrelevant in this particular instance) as root without having to enter a password. My procedure ...
2
votes
1answer
261 views
pam_tally2 or pam_faillock account lockout with ssh
I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local.
I need to lock users out after N failed password logins.
The examples in ...
5
votes
2answers
418 views
Nginx with PAM authentication through pam_script
Have anyone set up such a configuration? It's not working for me.
I've installed nginx-extras on Ubuntu 12.04 (it's built with PAM module), and added to site config:
location ^~ /restricted_place/ {
...
0
votes
1answer
68 views
When changing passwords, how to let one PAM module check for old passwords and another to save new ones?
Our server is currently using the blowfish cipher to store passwords and it uses pam_unix2. We'd like to gradually switch to SHA. The idea is that all newly changed passwords would be hashed with SHA. ...
0
votes
0answers
78 views
OpenVPN + PAM + Keberos + AD + Domain shares
I would like to ask if someone the setup mentioned in the title already set up?
I have a domain with serval DC's, fileservers, etc. At the moment I set up the OpenVPN server as domain member and use ...
2
votes
1answer
37 views
configuring pam with flat files backend
I would like to configure pam module to use flat files for authentication. Basically I need same thing like pam_unix just with possibility to use different files (other than /etc/passwd and ...
4
votes
1answer
190 views
pam_tty_audit and non privileged users
I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file:
session ...
0
votes
0answers
70 views
PAM error on reboot of the RADIUS client
I have a debian squeeze machine that acts as RADIUS client talking with the Freeradius server. I have configured PAM on the client, so made following changes.
Added radiusd to /etc/pam.d which ...
0
votes
0answers
151 views
PAM unable to dlopen() failed to map segment from shared object: Cannot allocate memory
i was going to configure the system to enable mysql auth through PAM while i saw the following error on /var/log/auth.log:
PAM unable to dlopen(pam_ck_connector.so): ...
0
votes
0answers
238 views
Why would Dovecot POP3 and IMAP Authentication from external IP address stop working?
Over a year ago I setup a Dovecot 1.2.9 POP3/IMAP server (which works alongside a Postfix SMTP server) with PAM authentication. This has been operating (I believe) without incident until recently ...
