Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

6
votes
2answers
2k views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
10
votes
1answer
6k views

open file descriptor limits.conf setting isn't read by ulimit even when pam_limits.so is required

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. I've added the following lines to /etc/security/limits.conf: * soft nofile 100000 ...
3
votes
2answers
8k views

VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
1
vote
2answers
1k views

How Can I Restrict FTP to a Particular Local Group?

I am running the FTP daemon VSFTPD. I'd like to control FTP access by adding users to a group such that only members of the defined group can access the FTP services. I am thinking I can do this by ...
6
votes
2answers
11k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
3
votes
5answers
3k views

Limiting Failed SSH Logins

I would like to limit failure retries on my Fedora machine to 5. I think I can accomplish it with PAM. But was unable to to do this. I have referred to this article to do this ...
16
votes
1answer
22k views
3
votes
2answers
4k views

How to display SSH banner at login, but only for password authentication

I have a warning message that is displayed to a user after they enter their username to log in to our Linux servers. I only want to display this message for password authentications, and not when ...
4
votes
2answers
2k views

/etc/pam.d/login vs. /etc/pam.d/system-auth

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this: password required pam_cracklib.so dcredit=-1 ...
7
votes
1answer
4k views

“success=n” control syntax in pam.conf / pam.d/* files

After sucessfully configuring Kerberos, this is what I've found in /etc/pam.d/common-auth file: auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] ...
5
votes
1answer
4k views

Users cannot use crontab after password security upgrade

I have a box being upgraded from CentOS 5 to CentOS 6. On the original server, all users have MD5 passwords. The upgraded server is now using SHA-512 passwords. Users who have changed their password ...
2
votes
3answers
536 views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
2
votes
3answers
4k views

How can I install pam_mount on Centos 6 x86_64?

I need to use pam_mount to mount user home directories individually at the time that each user logs in. I cant locate a package for this, at least for Centos 6. I would not have a problem building ...
2
votes
2answers
2k views

Authenticate CVS users against Active Directory

I have a mixed Linux/Windows software development environment where the Linux clients are migrating to a system where they are able to authenticate against Active Directory. (That part I figured out) ...
1
vote
2answers
2k views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
0
votes
1answer
833 views

vsftpd virtual users home directories with pam-mysql

ive saw many solutions like homedir=/somepath/$USER where $USER takes from sysvar and i want to change it for every user with mysql database. Im using it with pam-mysql so it will look like Id login ...
5
votes
1answer
3k views

Expired “authentication token” for user with deleted password

The Setup: 1) The user's password was deleted with "passwd -d " command 2) The user has cron jobs running The Problem: Once every 30 days (default password expiration policy) the cron fails with an ...
5
votes
3answers
3k views

PAM: Execute a command before pam_mkhomedir?

When a user logs into a system and there is no home directory, we would like to to create the user's home directory using pam_mkhomedir. This is a common practice. Here's a quick description of ...
4
votes
1answer
1k views

Can I use DenyHosts for a SMTP service

I would like to block some hosts that are brute forcing my SMTP server. I'm currently using DenyHosts for SSHD and was wondering if I can add the SMTP service too. It could be possible based on this ...
3
votes
1answer
1k views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
3
votes
3answers
4k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
3
votes
2answers
2k views

changing shadow hash algorithm to bcrypt: how to rehash

I want to change my SHA512 shadow file to use bcrypt as shown in this question/answer: Enable blowfish-based hash support for crypt The problem is that i run into a chicken and egg problem, because ...
3
votes
1answer
1k views

Private key authentication with pam_ldap

I'd like to set up pam_ldap on some of our servers so that we can centrally manage who has access to which server, and easily revoke access if e.g. someone leaves the company. I've done some research ...
2
votes
1answer
100 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
2
votes
1answer
1k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
2
votes
3answers
6k views

How to use Linux username and password with Subversion?

I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it ...
1
vote
1answer
54 views

vsftpd freezes after failed pam_script authentication

I have an Ubuntu 14.04 server with vsftpd and pam_script installed using apt-get. I've configured vsftpd to use pam_script for virtual user authentication and my /etc/pam.d/vsftpd file looks like ...
1
vote
0answers
315 views

Ubuntu server + Samba + PAM + Apple OpenDirectory

Due to various reasons, we are looking to migrate our file servers from OS X Server 10.9 over to a true Samba implementation running on Ubuntu 14.04LTS. We have Ubuntu up and running with Samba ...
1
vote
1answer
89 views

SSH locale wrong

I have a debian server with locales set to hu_HU.UTF-8, and if i log in trough console it works perfectly in hungarian. It also worked with ssh logins until i disabled PAM in the sshd config. Since ...
1
vote
1answer
724 views

Restricting LDAP users from authenticating without a valid shell

What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
1
vote
3answers
2k views

Samba File Server + PAM + Berkeley DB or Samba + PAM

I've set up VSFTPD with PAM and Berkeley DB before using this article. It's a great article and was really easy to walk through setting it up. Now that I'm setting up Samba, I would like to do the ...
0
votes
1answer
958 views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...
0
votes
2answers
3k views

Cyrus on CentOS with sasl / pam / ldap

SASL/PAM/LDAP is driving me crazy... that's what I read a lot when googling for problems in this area, and what I experience myself :-S I'm trying to get Cyrus imap working for virtual hosting on ...
0
votes
1answer
3k views

LDAP/NFS/PAM/AutoFS : mkhomedir PAM plugin failling

I got a working setup with OpenLDAP (authentication and NFS mount options), NFS server, AutoFS (to mount the NFS homedir) and required PAM plugin. Everything works fine except that the mkhomedir PAM ...