Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

5
votes
3answers
9k views

Suggest methods for testing changes to “pam.d/common-*” files

How do I test the changes to the pam.d configuration files: Do I need to restart the PAM service to test the changes? Should I go through every service listed in the /etc/pam.d/ directory? I'm ...
4
votes
2answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
4
votes
0answers
23 views

How to set-up google-authenticator and set specific match rules to allow different login rules?

I'm trying to set Google-Authenticator (google 2 factor authentication). The relevant files are: [root@srv01 ~]# cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_google_authenticator.so auth ...
0
votes
0answers
9 views

How to limit number logins with su using pam_limits

I have configured the /etc/security/limits.conf to have the below line: testuser hard maxlogins 1 I have tried to ssh to the system from that user, and its blocked me the second time... ...
2
votes
1answer
36 views

SUDO Keeps promting for password, when using SSSD with AD

Hi I am trying to setup SSSD to authenticate to AD on RHEL. I able able to login with my AD user and password and see my groups when I run id. But when I try to use sudo, it just keeps prompting for ...
1
vote
1answer
31 views

OpenLDAP client inside a docker container

I have a docker container running CentOS 6 with a non-root user and OpenLDAP. When I use getent passwd it just returns the data from /etc/passwd. The config file /etc/nsswitch.conf is customized ...
2
votes
0answers
55 views

LDAP changing password for wrong user?

I have an OpenLDAP server setup. I currently have two users added to my server. As far as my testing goes, a single user instance work just perfectly. My first issue arise when i have two users on the ...
1
vote
1answer
2k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = email@...
0
votes
1answer
16 views

LDAP SSH + PubKey auth Fallback

I have followed this guide here : https://github.com/jirutka/ssh-ldap-pubkey In order to setup a LDAP server that allows authentication requesting both Password and Public Key in order to login. Now ...
0
votes
1answer
27 views

Ssh + ldap not asking for private/public key

I have fully configured a LDAP server which works perfectly for authenticating users across my multiple nodes. I wanted to add an extra layer of security with the usual two factor public private key. ...
2
votes
1answer
1k views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
8
votes
2answers
1k views

vsftpd - PAM - MySQL and pam_mkhomedir to create directories

I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection. Here is /etc/pam.d/...
12
votes
3answers
12k views

Restricting account logins using LDAP and PAM

I was hoping some PAM/LDAP gurus may be able to help me out here. I've recently set up an LDAP directory on Ubuntu Server to hold accounts for both my clients (for use with web-based systems) and ...
0
votes
1answer
1k views

pam_tally2 being called before Password entry

Based on the suggestion given in: Account Lockout with pam_tally2 in RHEL6 I have come to a working configuration, wherein account is getting locked out after 3 failed logins. Catch is that ...
0
votes
0answers
13 views

Restrict access to Linux via PAM with configured SSO

i have SLES 12 in Active Directory Domain. Single Sign On for SSH is configured. I want to allow access to server only to some AD groups via PAM (not only for SSH Service, ftp, etc.). I tried to add ...
1
vote
2answers
3k views

passwd: Authentication token manipulation error

I am running a Ubuntu 12 machine, and have recently been working to secure it. I made all the changes from this guide. I am not running a Linode, but I used these as a starting point for setting up ...
0
votes
0answers
13 views

OpenVPN authentication using pam_winbind

I'm running an OpenVPN Server on a Debian machine joined to my Active Directory Domain. I'd like to use pam_winbind for VPN authentication. This is where the troubles arise. Authentication is working ...
0
votes
0answers
12 views

Force nproc ulimit on non interactive user

I have a script that can be launched n times at the same time through php-fpm. php-fpm pool is set to run under a certain username and I want to limit the number of processes this username can launch. ...
1
vote
1answer
1k views

pam_tty_audit apparently not working

I just compiled pam_tty_audit module, because my Linux distro doesn't include it with the usual PAM modules. I included to the /etc/common-session the configuration line, as suggested in this ...
0
votes
1answer
13 views

changing where pam_mkhomedir makes a directory

I want to create user directories for an LDAP user (389-ds) If they don't exist so I am using pam_mkhomedir . How do I create these directories on a different mount point say /nfs/home instead . I ...
3
votes
1answer
1k views

vsftpd with pam_winbind.so

I'm trying to setup vsftpd to use logins from our domain. I want the ftp users to be able to login using their active directory username/password and have be able to have full access to /media/storage/...
1
vote
0answers
35 views

Domain User home directory upon first login

I'm having some trouble setting up default files in the user home directory. The setup is a Centos 7, and I've successfully let it join the company's domain and authenticate through our AD. I'm able ...
0
votes
1answer
15 views

SunLDAP Schema Extensions to support Linux/Unix Authentication + Sudo

We are running SunLDAP (Sun/Oracle Directory server 11), and would like our Linux/Unix machines to authenticate against LDAP and also use LDAP for storing SUDO policies. What Schema Extensions are ...
0
votes
0answers
33 views

PAM understanding use_first_pass

In PAM modules like pam_unix.so, the manual describes the difference between use_first_pass and try_first_pass. However, i wanted to test that with the passwd command (Changing the password for a user)...
0
votes
0answers
21 views

Winbind locks up useradd and userdel

Running userdel or useradd locks up on one of our AD-connected Debian 8 machines. ┌[root][machine]:/ └$ useradd -p "superdupersecret" peter While this command is blocking one can observe how ...
1
vote
0answers
25 views

PAM+LDAP no longer working after SLES 10.4->11.4 Upgrade

authentication via LDAP has ceased functioning after we upgraded to SLES 11.4 via recommended method (boot from DVD). Unfortunately with SLES I cannot give you any meaningful log output since neither ...
0
votes
1answer
41 views

Server allows logging in without supplying a password and no ssh keys were exchanged, what could be the reason?

I'm trying to secure an outbound server with Google 2FA solution. For the time being, I'm first configuring everything on a local Vagrant machine and once everything works as intended I'll run it as ...
1
vote
1answer
32 views

How to configure pam sshd to allow different rules on different users/groups?

I'm configuring google two-factor authentication on an outbound server in the company I work for. Here are the relevant configurations: /etc/ssh/sshd_config: ubuntu@stage-itai-1:~$ egrep -v '^#' /...
2
votes
2answers
1k views

Google Authenticator PAM for specific users

My current sshd PAM config: #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session ...
1
vote
0answers
22 views

libnss-ldapd and Onelogin vLDAP

I'm trying to get Onelogin's new vLDAP service working with libnss-ldapd on an Ubuntu server (14.04). It looks like vLDAP uses authenticated bind per user. I've tried lots of different configurations ...
4
votes
4answers
3k views

How to increase max FD limit for a daemon process running under a headless user?

To increase the FD limit for a daemon process running under a headless user on a Ubuntu Linux machine we did following changes in /etc/security/limits.conf soft nofile 10000 hard nofile 10000 We ...
1
vote
1answer
3k views

libpam-ldapd not looking for secondary groups

I'm migrating from libpam-ldap to libpam-ldapd. I'm having some trouble gathering the secondary groups from LDAP. On libpam-ldap, I had this on the /etc/ldap.conf file: nss_schema rfc2307bis ...
1
vote
1answer
51 views

How to use the ssh server with PAM but disallow password auth?

Many tutorials tell you to config your ssh server like this: ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no but with this setup you cannot use PAM, as i plan to use 2 ...
5
votes
1answer
173 views

SSH works with expired Kerberos Password

I have setup SSH - single sign on using kerberos V5. When a user password has expired , it returns 'Warning: password has expired.' and allows the user to login! I even made changes in the /etc/pam.d/...
0
votes
2answers
3k views

pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968]?

Why is the following log produced? pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968] Is it because of a timeout, or is there some other reason?
1
vote
1answer
57 views

How to only allow users and/or groups access to certain client machines that are connected to an openldap server?

I would really like to figure out how I can allow users and/or groups access to certain client machines that are all connected to an OpenLDAP server. I would like to do this whether the user is ...
1
vote
3answers
3k views

Is anyone using access.conf and netgroup authentication with sssd?

I want to be able to authenticate users (via ssh) to specific groups of hosts based on the users' LDAP netgroup membership. The LDAP server is dsee7. The distro is OEL 6.5 with openldap as the client. ...
2
votes
2answers
2k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
2
votes
0answers
25 views

PAM vs /etc/shadow in Dovecot SASL configuration - Security differences?

I set up a server with Postfix SMTP auth through Dovecot SASL. However, it was not possible to get the PAM authentification working as standard out of the box. So more by chance, I changed it to ...
0
votes
1answer
49 views

How can I allow all users to run mount as root?

How can I allow all users to run mount as root? I know there's a lot of solutions out there recommending the following edit, but it's not working for me. I've edited /etc/sudoers to include: ALL ...
4
votes
3answers
21k views

How to fix a crontab access issue with a pam configuration error message? [closed]

I attempted to access my crontab as the non-root user "coins" when I encountered a permissions issue as shown in the following error message mentioning the pam configuration: [coins@COINS-TEST ~]$ ...
0
votes
1answer
107 views

how to control ldap users access using groupdn?

i am using openldap, nslcd and nss-pam-ldapd. i want to restrict users login to ldap client. i have configured this in centos6.5 without any problem using groupdn. but in centos 7, there is no ...
4
votes
1answer
64 views

openldap user can't login when using tcsh

I would appreciate any help in the following problem: I have an openladp (2.3.39) server (Fedora 8) which authenticates users from other ldap clients (various versions of Fedora). On my attempt to ...
0
votes
1answer
24 views

How can I ensure auditability and least privilege based on AWS users inside an EC2 image?

I'm interning at a company which runs in an AWS environment and is starting to look into locking down user privileges, so I'm looking into ways to secure EC2 instances. Specifically, I want to find a ...
0
votes
0answers
41 views

Mounting samba directory changes all file permissions to user who mounted it

I have a xubuntu 14.04 client, a debian 8 Samba File server and an external Active Directory service. I log in as user1 on the client authenticating against the ADS with winbind. My home directory /...
0
votes
0answers
44 views

Dovecot auth-worker permission denied to PAM and even /dev/log

Problem I have a problem dovecot authenticating users via pam_sss.so (in an LXC container, which may be related or may be not). # doveadm auth login semenov Password: passdb: semenov auth failed ...
3
votes
2answers
2k views

Public-Key -or- Password & Google Authenticator for SSH Login

I found an article (http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/) that explains how to configure OpenSSH to ask for a Google Authenticator ...
1
vote
2answers
54 views

Initialise Kerberos ticket on ssh login using PAM

Right, so I am struggling a bit with PAM in Centos7. I have no idea how to configure it manually and make the changes permanent so that I get a kerberos ticket after a successful ssh login. The ...
6
votes
3answers
343 views

Conflicts with PAM configuration files when upgrading system

I have a VPS that runs Ubuntu 14.04.4 LTS; it was installed as a whole with Plesk by OVH. I juste did a apt-get upgrade, and at some point I had a message regarding PAM. The system is in French, but ...
0
votes
0answers
47 views

Kerberos-based SSH login requires local user account

I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access. The only issue is, ...