Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
4
votes
1answer
186 views
pam_tty_audit and non privileged users
I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file:
session ...
4
votes
1answer
819 views
Expired “authentication token” for user with deleted password
The Setup:
1) The user's password was deleted with "passwd -d " command
2) The user has cron jobs running
The Problem:
Once every 30 days (default password expiration policy) the cron fails with an ...
2
votes
1answer
120 views
vsftpd - PAM - MySQL and pam_mkhomedir to create directories
I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection.
Here is ...
2
votes
1answer
154 views
Can I use DenyHosts for a SMTP service
I would like to block some hosts that are brute forcing my SMTP server.
I'm currently using DenyHosts for SSHD and was wondering if I can add the SMTP service too.
It could be possible based on this ...
2
votes
1answer
101 views
Authenticate Git virtual users via PAM
Can Git authenticate virtual users via PAM? In particular, would Git require some additional utility, such as gitolite or gitosis?
2
votes
1answer
475 views
Ubuntu 12.04 updates broke VSFTP
I am running Ubuntu 12.04 LTS. I did some minor updates using apt.
After rebooting vsftp stopped accepting connections system user logins. In the auth log I am getting the following errors
Dec 22 ...
2
votes
1answer
246 views
pam_tally2 or pam_faillock account lockout with ssh
I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local.
I need to lock users out after N failed password logins.
The examples in ...
2
votes
1answer
1k views
How to use nginx PAM module?
I would like to use nginx PAM module to authenticate a site with existing users on a FreeBSD system. I tried to use pam_unix.so, but no luck. It's just not let me in with my usr/psw pair. :(
nginx ...
2
votes
1answer
468 views
vsftpd with pam_winbind.so
I'm trying to setup vsftpd to use logins from our domain. I want the ftp users to be able to login using their active directory username/password and have be able to have full access to ...
2
votes
1answer
41 views
setting the “FROM” field in /usr/bin/w output
I'd like to set the FROM field in /usr/bin/w to various different strings that aren't my sshd's opinion of where the user has come from. Mostly this is because inbound ssh is often via on-host relays ...
1
vote
1answer
115 views
Restricting LDAP users from authenticating without a valid shell
What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
1
vote
1answer
101 views
MySQL Password Authentication with Proxy Users and Group Mapping
I'm actually using MariaDB here, but I'm working under the pretext that MariaDB is a "drop in replacement" for MySQL. I won't be surprised if this winds up being a cross platform difference/issue, but ...
1
vote
1answer
238 views
error in auth.log but can login; LDAP/PAM
I have a server running OpenLDAP. When I start a ssh-session I can log in without problems, but an error appears in the logs. This only happens when I log in with a LDAP account (so not with a system ...
1
vote
1answer
88 views
how to limit maxlogin for a port forward over ssh user who Do not execute a remote command
I have some users, who connect to my server through the ssh for port forwarding and ssh tunneling, but there is a problem:
I cannot limit their concurrent logins, because they have no session and ...
1
vote
1answer
39 views
LDAP authenticating partially. Password being replaced
After a week of struggling to find out why some of our machines are Authenticating off of our LDAP servers and some are not I noticed that after PAM binds to see if the uid exists it then sends the ...
0
votes
1answer
21 views
Kerberos pre-authentication failed on nfs mount
I have the following nfs export:
/home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534)
When trying to mount that on a client I get:
client:/home # ...
0
votes
1answer
33 views
PAM configuration for MSCHAP for radius/tacacs
I would like to know how to enable MSCHAP for radius or tacacs.
Please help.
0
votes
1answer
59 views
restarting authconfig changes order of my /etc/nsswitch.conf
Here is my nsswitch.conf:
passwd: files ldap sss
shadow: files ldap sss
group: files sss
When I restart authconfig, it removes ldap from passwd, shadow, and group.
Here's my ...
0
votes
1answer
34 views
Call Pam module before public key authentication on SSH
I am currently writing a pam module which does some checks if the key stored in authorized_keys is still valid. However I cant find a possiblity to run the module before the public key authentication ...
0
votes
1answer
64 views
MariaDB + PAM: Is Remote Auth Secure?
I have a MariaDB instance which is using PAM to auth against Active Directory. Is remote authentication with this service secure? I ran a Wireshark trace during the auth process, and passwords are not ...
0
votes
1answer
486 views
libpam-ldapd not looking for secondary groups
I'm migrating from libpam-ldap to libpam-ldapd. I'm having some trouble gathering the secondary groups from LDAP.
On libpam-ldap, I had this on the /etc/ldap.conf file:
nss_schema rfc2307bis
...
0
votes
1answer
237 views
pam_ldap, where is the filter set?
A while ago I asked a question about this same issue already (Cyrus on CentOS with sasl / pam / ldap), and I came a bit further.
The Bind DN is no longer empty; LDAP works with all apps except imap.
...
3
votes
0answers
749 views
SMTP authentication failure + PAM-MySQL cannot authenticate
I am building a mail server using Postfix, and set up the authentication to check against a database set-up using Postfixadmin.
I can authenticate via Courier IMAP okay, as it can authenticate ...
2
votes
0answers
320 views
Linux samba server: cifs_mount failed w/return code = -12
Server: RHEL 5.9 / smbd 3.0.33
- Clients: various, though all were using current mount.cifs (5.2)
I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
2
votes
0answers
234 views
Adding local users / passwords on Kerberized Linux box
Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
2
votes
0answers
755 views
vsftp login errors 530 login incorrect
Using Ubuntu 10.04 on an aws ec2 instance. I was happy just using ssh but then a wordpress plugin needs ftp access...I just need ftp access for one site www.sitebuilt.net which is in /home/sitebuil.
...
2
votes
0answers
415 views
User not recognized by underlying authentication
I'm running lxc on Linux Mint Debian Edition tracking Wheezy/Sid. I created a container using "lxc-create -t debian -n dev". In accordance with the Debian wiki article on LXC I have mounted the ...
2
votes
0answers
367 views
pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968]?
Why is the following log produced?
pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968]
Is it because of a timeout, or is there some other reason?
1
vote
0answers
16 views
Set pam_unix password without knowing current password, having authenticated with pam_winbind
Right, so I have winbind authentication set up for login. However, I think there may still be some situations in which it would be useful for the user to be able to set their unix password (in the ...
1
vote
0answers
83 views
pam_mysql / vsftpd error 'AUTHENTICATION FALURE (FIRST_PASS)'
I setup vsftpd and mysql auth via pam on Debian Squeeze.
Config:
auth required pam_mysql.so user=server passwd=x host=localhost db=server table=ftp usercolumn=username passwdcolumn=password ...
1
vote
0answers
323 views
CentOS PAM+LDAP login and host attribute
My system is CentOS 6.3, openldap is configured well, PAM authorization works fine.
But after turning pam_check_host_attr to yes, all LDAP-auths fail with message "Access denied for this host".
...
1
vote
0answers
2k views
SASL LOGIN authentication failed: generic failure
I'm setting up a mail server with SMTP authentication and the backend
database is MySQL 5.1.53 with pam_mysql and cyrus-sasl2 2.1.23 on
Slackware Linux 13.1. When I telnet to test my server-side
...
0
votes
0answers
13 views
Samba4 compiled from source alongside winbind repo package, not working with PAM
I am on Linux Mint. I have compiled and installed Samba4 from source and joined a Samba4 DC I have elsewhere on my network. I have also been trying to get Samba/winbind to work with PAM to ...
0
votes
0answers
16 views
Dell OMSA Authentication Fail on Ubuntu
I am trying to log into an install of Dell OMSA 5 on a Dell PowerEdge 2850 running Ubuntu 8.04 LTS x64.
OMSA is 32bit and is trying to load the 64bit pam modules for authentication. Whatever ...
0
votes
0answers
13 views
PAM authentication: external falling back to internal
I am trying to configure PAM authentication in a linux box with an external provider falling back to internal when it is not available.
I query the external provider using a custom script via the ...
0
votes
0answers
138 views
MySQL/SASLAuthd/Postfix authentication issue
Can't seem to get authentication via Mysql with SASLAuthd with postfix working. Dovecot connects to mysql by itself fine, and connections/queries show up in /var/log/mysql/mysql.log. When connecting ...
0
votes
0answers
77 views
OpenVPN + PAM + Keberos + AD + Domain shares
I would like to ask if someone the setup mentioned in the title already set up?
I have a domain with serval DC's, fileservers, etc. At the moment I set up the OpenVPN server as domain member and use ...
0
votes
0answers
68 views
PAM error on reboot of the RADIUS client
I have a debian squeeze machine that acts as RADIUS client talking with the Freeradius server. I have configured PAM on the client, so made following changes.
Added radiusd to /etc/pam.d which ...
0
votes
0answers
143 views
PAM unable to dlopen() failed to map segment from shared object: Cannot allocate memory
i was going to configure the system to enable mysql auth through PAM while i saw the following error on /var/log/auth.log:
PAM unable to dlopen(pam_ck_connector.so): ...
0
votes
0answers
224 views
Why would Dovecot POP3 and IMAP Authentication from external IP address stop working?
Over a year ago I setup a Dovecot 1.2.9 POP3/IMAP server (which works alongside a Postfix SMTP server) with PAM authentication. This has been operating (I believe) without incident until recently ...
0
votes
0answers
15 views
I'm getting invalid argument (22) when pam_abl is ran
I'm running Arch Linux with pam_abl version 0.5.0-3. So far it has been working well, and it seems as if it is still working, but when I look at the auth.log this is what an invalid authentication ...
0
votes
0answers
34 views
pam_abl with ChallengeResponseAuthentication
Is there any chance to get pam_abl working with sshd's ChallengeResponseAuthentication?
With
ChallengeResponseAuthentication yes
PasswordAuthentication yes
I get
$ ssh myserver
Password:
...
0
votes
0answers
65 views
Pam module that allows for non-standard username characters?
does anyone here know of a PAM module that would allow me to use non-unix-kosher characters in a username? I have to migrate a bunch of people from some FTP host to the server with VSFTPd I setup; the ...
0
votes
0answers
74 views
Samba and pam_group.so: add group on log in
I am using pam_group.so to add some additional groups to the users. However, although Samba obeys pam restrictions, it obeys only "session" type of management. pam_group.so, however can be used only ...
0
votes
0answers
61 views
saslauthd using PAM and IMAP auth
I need to setup saslauthd to accept both pam authentication and rimap (IMAP) for SMTP auth. Is there anyway to do this ?
I needed PAM for shell user smtp authentication.
0
votes
0answers
115 views
credit or minclass does not work well with pam_cracklib.so in common-password (opeSuSe 11.3)
I'm trying to implement password complexities on my pdc. It's a samba PDC with openLDAP backend. I tried cracklib-check but it looks like that I should have a decent and localize version of password ...
0
votes
0answers
419 views
Clients not recognizing secondary LDAP groups?
I'm having an issue where users who are members of secondary groups in LDAP are not being recognized as members of that group by the client. In this case, user jdoe is not being recognized as a member ...
0
votes
0answers
408 views
Postfix SASL Authentication using PAM_Python
Cross-post from: http://stackoverflow.com/questions/4337995/postfix-sasl-authentication-using-pam-python
Hey guys,
I just set up a Postfix server in Ubuntu and I want to add SASL authentication ...
0
votes
0answers
244 views
Configure password rule: white space is not allowed in password
I am configuring system (RHEL5), setting password rules.
One requirement is related to security:
local accounts with passwords containing characters from ISO/IEC 8859-1 with codes in the range of 2x ...
-1
votes
0answers
15 views
How do I make a pam configuration to test that the account exists and ignore wrong or null password?
I got the configuration for this from the same site...
auth sufficient pam_permit.so
But it doesn't work if user gives empty or null password.
Can you please let me know what should be the ...
