Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
1answer
7 views

How can I verify that my PAM configuration works as expected

I'm trying to setup a vsftpd server in a virtual machine and all I can ever get from it is an authentication error (530 Login incorrect). Since I've tried to configure it using virtual users with PAM, ...
10
votes
4answers
15k views

Switch on PAM debugging to Syslog

I hate PAM since it came up. How do I switch on PAM debugging in Debian Squeeze at the admin level? I have checked every resource I was able to find. Google, manpages, whatever. The only thing I ...
2
votes
3answers
1k views

How to increase max FD limit for a daemon process running under a headless user?

To increase the FD limit for a daemon process running under a headless user on a Ubuntu Linux machine we did following changes in /etc/security/limits.conf soft nofile 10000 hard nofile 10000 We ...
6
votes
1answer
62 views

Different “RequiredAuthentications2” for sshd and sftp subsystem

we're currently using a 2factor authentication on our SSH servers, so we have "RequiredAuthentications2 publickey,keyboard-interactive" in our sshd_config (publickey for the key, keyboard-interactive ...
2
votes
1answer
816 views

vsftpd with pam_winbind.so

I'm trying to setup vsftpd to use logins from our domain. I want the ftp users to be able to login using their active directory username/password and have be able to have full access to ...
2
votes
1answer
657 views

pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968]?

Why is the following log produced? pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968] Is it because of a timeout, or is there some other reason?
0
votes
0answers
27 views

LDAP: forced to change root password on every login

I have finally configured my new server as LDAP-client of my existing one. Now, every time I login as root, I am prompted to change my 'LDAP password': login as: root root@111.111.111.111's password: ...
0
votes
0answers
15 views

PAM Authentication with LDAP on Debian Jessie Not Finding LDAP Users

Debian Jessie (specifically, Debian Server Wheezy x64 with testing repos) OpenLDAP 2.4.39 libpam-ldapd 0.9.4-1 Upon installing libpam-ldapd, the dpkg configuration asked for my LDAP address ...
0
votes
0answers
12 views

pam_exec not working for auth?

Here's my PAM configuration file: #%PAM-1.0 auth requisite pam_exec.so seteuid /srv/auth/pam_auth_user.py Here's /srv/auth/pam_auth_user.py (I've run chmod +x and chown root:root on it): ...
2
votes
3answers
46 views

is there a PAM module for DNSBL lookups?

I have been enumerating the remaining security concerns on one of my back-end production servers, when I came to the realization that something which could be incredibly useful was missing from my ...
4
votes
3answers
2k views

pam service(sshd) ignoring max retries

I have vps that I use to run a webserver on, it currently runs ubuntu server 12.04. Since a few weeks I keep getting a lot of errors in my ssh console. 2014 Apr 11 08:41:18 vps847 PAM service(sshd) ...
1
vote
1answer
69 views

Token error when trying to change password through pam-mysql

I am currently preparing a machine for a web hosting service, and I decided to use MySQL to store all our users (since the rest of our services use it already). For that, I am using libnss-mysql and ...
1
vote
3answers
1k views

How to use PAM to limit failed login attempts by IP?

I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
1
vote
1answer
1k views

libpam-ldapd not looking for secondary groups

I'm migrating from libpam-ldap to libpam-ldapd. I'm having some trouble gathering the secondary groups from LDAP. On libpam-ldap, I had this on the /etc/ldap.conf file: nss_schema rfc2307bis ...
2
votes
1answer
146 views

Prevent fork bomb inside docker container

I am currently struggling with limiting number of processes for user which I called sandbox. I configured processes limit inside /etc/security/limits.conf like this: sandbox hard nproc ...
2
votes
2answers
800 views

ProFTPD / PAM issues with new centos/virtualmin install

I just installed CentOS 5.4 on a rackspace cloud server and installed virtualmin which all seemed to go fine. The only problem I have is that I can not access the virtual servers directories via FTP. ...
2
votes
1answer
110 views

build user chroot on first login

I'm using ldap for remote user authentication and I basically need to either figure out how to: a. chroot a user on machine b from machine a via nfs,(which doesn't seem possible without mounting ...
0
votes
1answer
70 views

Pam-Mysql “Can't initialize threads: error 11”

Inside a Debian OpenVZ container, I have 2 OpenVPN servers (udp on port 53 and tcp on port 443). The authentication is based on Pam-Mysql. Inside my OpenVPN conf file I have: [...] plugin ...
-1
votes
0answers
16 views

Openldap ppolicy and pam_ldap interoperability

I followed ubuntu server guide, set up openldap for user authentication and connect my server to it using pam_ldap and things goes fine. But when i tried to add ppolicy to openldap, I'm not sure about ...
2
votes
2answers
1k views

Ubuntu 12.04 updates broke VSFTP

I am running Ubuntu 12.04 LTS. I did some minor updates using apt. After rebooting vsftp stopped accepting connections system user logins. In the auth log I am getting the following errors Dec 22 ...
3
votes
1answer
799 views

vsftpd - PAM - MySQL and pam_mkhomedir to create directories

I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection. Here is ...
0
votes
0answers
18 views

pam_exec not working? cannot allocate 2 bytes?

I am trying to run a script during the login process using PAM and libpam_exec; I have added this line to the desired file under /etc/pam.d/: auth required pam_exec.so debug log=/var/log/debug ...
1
vote
1answer
21 views

skip 2 steps verification when there is ssh key Debian [closed]

I had installed 2 steps verification on my server using this great manual: http://support.jpgottech.com/knowledgebase.php?article=72 Everything works great but I had encountered a small issue, I want ...
0
votes
0answers
16 views

enforce password length on ubuntu with pam_cracklib

I was trying to enforce password length to a minimum of 10 using pam_cracklib. here is my /etc/pam.d/common-password password requisite pam_cracklib.so retry=3 minlen=10 ...
1
vote
0answers
159 views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
0
votes
1answer
841 views

Authenticate by libpam-mysql and libnss-mysql (CentOS)

I'm trying to get MySQL to function as a backend for authenticating users on CentOS 6.3. So far I have successfully installed and configured libnss-mysql. I can test this by doing: # groups testuser ...
0
votes
0answers
12 views

Multiple server with Pam radius?

I have an issue with Pam radius . I want to use two radius servers at same time with different databases with Pam_radius I use Open-connect which use Pam authentication . in ...
0
votes
1answer
103 views

Users Password does not reset after successful login at the console but works fine with SSH

The title says it all. I have my unsuccessful login attempts set to three. I purposefully fail logging in 2x, then when I SSH into the box successfully the 3rd time my count drops back to zero; ...
2
votes
1answer
30 views

pam_tally2 causing unwanted lockouts with SCOM or Nervecenter

We use pam_tally2 in our system-auth config file which works fine for users. With services such as SCOM or Nervecenter it causes lockouts. Same behavior on RHEL5 and RHEL6 This is ...
0
votes
1answer
28 views

Why does debian not set the pam module called pam_limits.so in the file /etc/pam.d/su

I am using debian version 7.4 The /etc/pam.d/su file there does not enable pam_limits.so the snippet is: # Sets up user limits, please uncomment and read /etc/security/limits.conf # to enable ...
4
votes
1answer
3k views

Users cannot use crontab after password security upgrade

I have a box being upgraded from CentOS 5 to CentOS 6. On the original server, all users have MD5 passwords. The upgraded server is now using SHA-512 passwords. Users who have changed their password ...
0
votes
0answers
50 views

Red Hat 6.5 - Login Errors After Security Hardening

I followed the information below, however, it is strangely blocking me from entering a password upon entering the login prompt on the server: To configure the system to lock out accounts after a ...
0
votes
0answers
19 views

Getting PAM/user info into php - something like Net_Finger instead of a db?

I've got a very small user group who just need to login, upload, check and then move specific files to a different area when ready. Right now, I use the nginx PAM auth module to log them in against ...
5
votes
1answer
2k views

SMTP authentication failure + PAM-MySQL cannot authenticate

I am building a mail server using Postfix, and set up the authentication to check against a database set-up using Postfixadmin. I can authenticate via Courier IMAP okay, as it can authenticate ...
3
votes
1answer
79 views

Understanding PAM authentication procedure on FreeBSD with security/sssd

I'm trying to understand what's behaving errantly on my PAM configuration on FreeBSD 10.0 The machine is configured with two different authentication realms, one is the default Unix authentication ...
1
vote
1answer
42 views

On Solaris, can I create a user account in a single command line entry that is not disabled, but is password disabled (only allows SSH)

I am building a script for SA's to follow when performing a certain task. That task requires adding a user to a system that can only SSH to the system (using a key) and not log in with a password. ...
0
votes
0answers
52 views

authenticating and authorizing linux users kept in mysql database using pam and nss

I am not able to authenticate and authorize users present in my mysql database. If someone can point out where I am wrong it would be very helpful.Following are the steps that I followed. Firstly I ...
0
votes
0answers
18 views

Linux PAM auth chain w/ module independence

I have a working PAM configuration using google_authentitcator in addition to the standard pam_unix password module as a two factor solution. In short it prompts (requisite) for a verification code ...
0
votes
1answer
265 views

CentOS PAM unable to open /etc/pam.d/system-auth

In gdm I have checked "Require smartcard login" but forgot about adding any smartcard for authentication. Then I've tried to boot from LiveCD and disable SC auth. Something went wrong and now I am not ...
1
vote
4answers
4k views

login as rsh in rhel 6 without entering password

I need to be able to login to a RHEL 6 server using rsh (please don't flame me about security, it's irrelevant in this particular instance) as root without having to enter a password. My procedure ...
3
votes
1answer
178 views

Public-Key -or- Password & Google Authenticator for SSH Login

I found an article (http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/) that explains how to configure OpenSSH to ask for a Google Authenticator ...
1
vote
1answer
116 views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
2
votes
2answers
112 views

OpenSSH and PAM authentication using a public key

I'm looking for a way to authenticate users using a public key which is stored in a db (MongoDB). Similar questions usually resulted with a suggestion to installed a patched version of OpenSSH ...
4
votes
3answers
132 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source. Managing access to multiple linux system One problem I ran into is that if a user is given local root ...
2
votes
1answer
1k views

vsftp login errors 530 login incorrect

Using Ubuntu 10.04 on an aws ec2 instance. I was happy just using ssh but then a wordpress plugin needs ftp access...I just need ftp access for one site www.sitebuilt.net which is in /home/sitebuil. ...
1
vote
0answers
72 views

How to add two-factor authetntication to ssh?

I am trying to add 2FA to sshd using PAM from oathtool package. I want two ways to login to server: publickey and 2FA, or password and 2FA So far I managed to add 2FA to publickey authentication, ...
1
vote
1answer
158 views

PAM won't authenticate with mysql (make_scrambled_password deprecated)

I have spent some time searching for this and it seems I'm the only one having problem with PAM not authenticating through mysql due to current updates so I thought I will post my problem here and if ...
0
votes
1answer
405 views

How to I authenticate with Dovecot + IMAP + PAM on CentOS?

I set up Dovecot IMAP to use PAM as suggested here: http://wiki2.dovecot.org/PasswordDatabase/PAM PAM/dovecot [root@ip-172-31-15-65 pam.d]# cat dovecot #%PAM-1.0 auth required ...
0
votes
0answers
83 views

Apache + PAM + Winbind slow logins

Since upgrading our old Debian Lenny server to Ubuntu 12.04, we've noticed intermittent slow or failed access to Apache. Many or most web requests work fine, but occasionally, a Subversion client ...
1
vote
0answers
38 views

Centos 6.2 Openwebmail change password issue

Recently build environment to test, install openldap, openwebmail and PAM authentication module After experiencing the current account login webmail change password will be "password is wrong, change ...