Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

7
votes
2answers
2k views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
11
votes
1answer
6k views

open file descriptor limits.conf setting isn't read by ulimit even when pam_limits.so is required

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. I've added the following lines to /etc/security/limits.conf: * soft nofile 100000 ...
3
votes
2answers
9k views

VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
1
vote
2answers
2k views

How Can I Restrict FTP to a Particular Local Group?

I am running the FTP daemon VSFTPD. I'd like to control FTP access by adding users to a group such that only members of the defined group can access the FTP services. I am thinking I can do this by ...
6
votes
2answers
12k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
3
votes
1answer
379 views

build user chroot on first login

I'm using ldap for remote user authentication and I basically need to either figure out how to: a. chroot a user on machine b from machine a via nfs,(which doesn't seem possible without mounting ...
3
votes
5answers
4k views

Limiting Failed SSH Logins

I would like to limit failure retries on my Fedora machine to 5. I think I can accomplish it with PAM. But was unable to to do this. I have referred to this article to do this ...
1
vote
1answer
64 views

Can I configure pam_ldap without configuring nss?

On my servers I have my system users provisioned with Chef and have no desire to expose any additional users to these machines. I would however like to utilize pam for the authentication backend for ...
1
vote
3answers
3k views

Samba File Server + PAM + Berkeley DB or Samba + PAM

I've set up VSFTPD with PAM and Berkeley DB before using this article. It's a great article and was really easy to walk through setting it up. Now that I'm setting up Samba, I would like to do the ...
16
votes
1answer
23k views
3
votes
2answers
4k views

How to display SSH banner at login, but only for password authentication

I have a warning message that is displayed to a user after they enter their username to log in to our Linux servers. I only want to display this message for password authentications, and not when ...
4
votes
2answers
2k views

/etc/pam.d/login vs. /etc/pam.d/system-auth

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this: password required pam_cracklib.so dcredit=-1 ...
7
votes
1answer
4k views

“success=n” control syntax in pam.conf / pam.d/* files

After sucessfully configuring Kerberos, this is what I've found in /etc/pam.d/common-auth file: auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] ...
1
vote
2answers
2k views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
5
votes
1answer
5k views

Users cannot use crontab after password security upgrade

I have a box being upgraded from CentOS 5 to CentOS 6. On the original server, all users have MD5 passwords. The upgraded server is now using SHA-512 passwords. Users who have changed their password ...
4
votes
3answers
5k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
3
votes
3answers
6k views

ldap force user to change password

I am using CentOS-ds (based off Redhat-DS and 389 directory servers). I have LDAP setup, and working to authenticate users (and Sudo, thats a handy feature!). even passwd is working great to change ...
2
votes
3answers
620 views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
2
votes
3answers
5k views

How can I install pam_mount on Centos 6 x86_64?

I need to use pam_mount to mount user home directories individually at the time that each user logs in. I cant locate a package for this, at least for Centos 6. I would not have a problem building ...
2
votes
2answers
2k views

Authenticate CVS users against Active Directory

I have a mixed Linux/Windows software development environment where the Linux clients are migrating to a system where they are able to authenticate against Active Directory. (That part I figured out) ...
0
votes
2answers
3k views

Cyrus on CentOS with sasl / pam / ldap

SASL/PAM/LDAP is driving me crazy... that's what I read a lot when googling for problems in this area, and what I experience myself :-S I'm trying to get Cyrus imap working for virtual hosting on ...
0
votes
1answer
883 views

vsftpd virtual users home directories with pam-mysql

ive saw many solutions like homedir=/somepath/$USER where $USER takes from sysvar and i want to change it for every user with mysql database. Im using it with pam-mysql so it will look like Id login ...
5
votes
1answer
4k views

Expired “authentication token” for user with deleted password

The Setup: 1) The user's password was deleted with "passwd -d " command 2) The user has cron jobs running The Problem: Once every 30 days (default password expiration policy) the cron fails with an ...
5
votes
3answers
4k views

PAM: Execute a command before pam_mkhomedir?

When a user logs into a system and there is no home directory, we would like to to create the user's home directory using pam_mkhomedir. This is a common practice. Here's a quick description of ...
4
votes
1answer
1k views

Can I use DenyHosts for a SMTP service

I would like to block some hosts that are brute forcing my SMTP server. I'm currently using DenyHosts for SSHD and was wondering if I can add the SMTP service too. It could be possible based on this ...
3
votes
1answer
2k views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
3
votes
2answers
2k views

changing shadow hash algorithm to bcrypt: how to rehash

I want to change my SHA512 shadow file to use bcrypt as shown in this question/answer: Enable blowfish-based hash support for crypt The problem is that i run into a chicken and egg problem, because ...
3
votes
1answer
2k views

Private key authentication with pam_ldap

I'd like to set up pam_ldap on some of our servers so that we can centrally manage who has access to which server, and easily revoke access if e.g. someone leaves the company. I've done some research ...
2
votes
1answer
209 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
2
votes
1answer
2k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
2
votes
3answers
6k views

How to use Linux username and password with Subversion?

I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it ...
1
vote
1answer
91 views

vsftpd freezes after failed pam_script authentication

I have an Ubuntu 14.04 server with vsftpd and pam_script installed using apt-get. I've configured vsftpd to use pam_script for virtual user authentication and my /etc/pam.d/vsftpd file looks like ...
1
vote
0answers
501 views

Ubuntu server + Samba + PAM + Apple OpenDirectory

Due to various reasons, we are looking to migrate our file servers from OS X Server 10.9 over to a true Samba implementation running on Ubuntu 14.04LTS. We have Ubuntu up and running with Samba ...
1
vote
1answer
140 views

SSH locale wrong

I have a debian server with locales set to hu_HU.UTF-8, and if i log in trough console it works perfectly in hungarian. It also worked with ssh logins until i disabled PAM in the sshd config. Since ...
1
vote
1answer
781 views

Restricting LDAP users from authenticating without a valid shell

What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
0
votes
1answer
1k views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...
0
votes
1answer
4k views

LDAP/NFS/PAM/AutoFS : mkhomedir PAM plugin failling

I got a working setup with OpenLDAP (authentication and NFS mount options), NFS server, AutoFS (to mount the NFS homedir) and required PAM plugin. Everything works fine except that the mkhomedir PAM ...