Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

Filter by
Sorted by
Tagged with
45 votes
2 answers
38k views

Slow ssh login - Activation of org.freedesktop.login1 timed out

On one of my servers I've noticed really delay on SSH logins. Connecting using the ssh -vvv options the delay occurs at debug1: Entering interactive session. extract of connection: debug1: ...
Alasdair's user avatar
  • 571
42 votes
7 answers
109k views

Switch on PAM debugging to Syslog

How do I switch on PAM debugging in Debian Squeeze at the admin level? I have checked every resource I was able to find. Google, manpages, whatever. The only thing I haven't tried yet (I simply not ...
Tino's user avatar
  • 1,153
41 votes
8 answers
33k views

Is there a command line two-factor authentication verification code generator?

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...
dan's user avatar
  • 907
37 votes
6 answers
36k views

pam service(sshd) ignoring max retries

I have vps that I use to run a webserver on, it currently runs ubuntu server 12.04. Since a few weeks I keep getting a lot of errors in my ssh console. 2014 Apr 11 08:41:18 vps847 PAM service(sshd) ...
Jerodev's user avatar
  • 481
33 votes
7 answers
133k views

ssh: "Access denied by PAM account configuration" for one non-root user but not another

On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is ...
zwol's user avatar
  • 1,365
27 votes
2 answers
21k views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
ColOfAbRiX's user avatar
  • 1,080
26 votes
1 answer
22k views

Purpose Behind Disabling PAM in SSH

I'm setting up key based authentication for SSH on a new box, and was reading a few articles that mention setting UsePAM to no along with PasswordAuthentication. My question is, what is the purpose ...
tacotuesday's user avatar
  • 1,389
24 votes
3 answers
3k views

What can be learned about a user from a failed SSH attempt?

What can be learned about a 'user' from a failed malicious SSH attempt? User name entered (/var/log/secure) Password entered (if configured, i.e. by using a PAM module) Source IP address (/var/log/...
Exbi's user avatar
  • 373
24 votes
5 answers
62k views

ulimit -n not changing - values limits.conf has no effect

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. This question is somewhat of a follow up to this question. open file descriptor limits.conf setting isn'...
Abbas Gadhia's user avatar
21 votes
2 answers
23k views

"success=n" control syntax in pam.conf / pam.d/* files

After sucessfully configuring Kerberos, this is what I've found in /etc/pam.d/common-auth file: auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] ...
Jamie's user avatar
  • 1,314
20 votes
2 answers
54k views

How to use the ssh server with PAM but disallow password auth?

Many tutorials tell you to config your ssh server like this: ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no but with this setup you cannot use PAM, as i plan to use 2 Factor ...
c33s's user avatar
  • 1,535
18 votes
1 answer
39k views

How to authenticate Linux accounts against an Active Directory and mount a Windows share on login?

I'm using Ubuntu 10.04 Server.
Jamie's user avatar
  • 1,314
18 votes
2 answers
85k views

Connection closed by UNKNOWN port 65535 when SSH using AD Creds on RHEL Machine

Recently I installed PAM & all the necessary packages needed to enable ssh authentication via AD on my RHEL 7.5 machines. When I try to SSH using "ssh user@domainname@hostname" it asks ...
Doug's user avatar
  • 299
18 votes
2 answers
17k views

open file descriptor limits.conf setting isn't read by ulimit even when pam_limits.so is required

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. I've added the following lines to /etc/security/limits.conf: * soft nofile 100000 ...
bantic's user avatar
  • 1,549
16 votes
1 answer
10k views

Linux samba server: cifs_mount failed w/return code = -12

Server: RHEL 5.9 / smbd 3.0.33 - Clients: various, though all were using current mount.cifs (5.2) I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
zastard's user avatar
  • 163
15 votes
3 answers
106k views

How to fix a crontab access issue with a pam configuration error message? [closed]

I attempted to access my crontab as the non-root user "coins" when I encountered a permissions issue as shown in the following error message mentioning the pam configuration: [coins@COINS-TEST ~]$ ...
Raj's user avatar
  • 161
15 votes
2 answers
4k views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...
eggyal's user avatar
  • 412
14 votes
2 answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
born to hula's user avatar
14 votes
3 answers
9k views

libpam-ldap or libpam-ldapd?

I'm setting up LDAP authentication on my personal VPS, and Ubuntu has two packages for the same purpose: libpam-ldap and libpam-ldapd. Which should I use?
jldugger's user avatar
  • 14.5k
14 votes
3 answers
42k views

The difference between /etc/pam.d/login and /etc/pam.d/system-auth?

I want to configure securetty to limit root directly access. Now I am clear if I add: auth required pam_securetty.so into /etc/pam.d/system-auth, and keep only "console" in /etc/...
zhaojing's user avatar
  • 195
14 votes
5 answers
50k views

Debugging sssd login: pam_sss [...] System error

How does one properly debug the shell login in the following case? Authentication is handled via sssd configuration and a krb5 authentication server. Logging in with the same .conf-file on Ubuntu 16....
2xB's user avatar
  • 243
14 votes
3 answers
23k views

Restricting account logins using LDAP and PAM

I was hoping some PAM/LDAP gurus may be able to help me out here. I've recently set up an LDAP directory on Ubuntu Server to hold accounts for both my clients (for use with web-based systems) and ...
Andy Shellam's user avatar
  • 1,878
13 votes
2 answers
3k views

SSH only works after intentionally failed password

So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
pyraz's user avatar
  • 161
13 votes
4 answers
18k views

How to get full control of umask/PAM/permissions?

// Updated Feb 8 - Outstanding issues in brief: How to umask directories differently from files? How to umask on Nautilus copy/paste? How to set umask for SSHFS? OUR SITUATION Several people from ...
user avatar
13 votes
4 answers
4k views

OpenLDAP, Samba and password aging

I'm configuring a system in which all IT resources are available through a single user-password pair, be it access to shell on the servers, logging to Samba domain, WiFi, OpenVPN, Mantis, etc. (with ...
Hubert Kario's user avatar
  • 6,401
12 votes
2 answers
9k views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
Brian's user avatar
  • 333
12 votes
1 answer
50k views

LDAP authentication on CentOS 7

After upgrading to CentOS 7 it's no longer possible to login via LDAP. With CentOS 6 I used the package pam_ldap which worked fine, but now pam_ldap is no longer available for the new version of ...
lszrh's user avatar
  • 683
11 votes
3 answers
24k views

sshd: How to enable PAM authentication for specific users under

I am using sshd, and allow logins with public key authentication. I want to allow select users to log in with a PAM two-factor authentication module. Is there any way I can allow PAM two-factor ...
Brad's user avatar
  • 487
11 votes
1 answer
5k views

What's the downside of disabling PAM in OpenSSH if only public-key login is allowed?

/etc/ssh/sshd_config by default has the following line UsePAM yes I read through available documentation and came to the conclusion that PAM is not used if I only use public-key login. What possible ...
Rio's user avatar
  • 335
11 votes
3 answers
3k views

vsftpd - PAM - MySQL and pam_mkhomedir to create directories

I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection. Here is /etc/pam.d/...
Tom's user avatar
  • 143
10 votes
3 answers
13k views

vsftpd will not accept passwords encrypted with MD5

I am setting up an server with vsftpd to let virtual users access their space. Now it is fully working but only with CRYPT passwords. So sudo htpasswd -c /etc/vsftpd/ftpd.passwd phpmyadmin will not ...
Marco's user avatar
  • 307
10 votes
1 answer
5k views

PAM accepting any password for valid users

I just linked my Arch Linux workstation to the Samba AD I set up for our company. I tested it, and it worked, or so I thought. It accepted my password, created my homedir and everything, and logged me ...
Dessa Simpson's user avatar
10 votes
1 answer
26k views

What is nsswitch compat mode?

Red Hat recommended me compat mode in /etc/nsswitch.conf as one of the options to enumerate LDAP users, but later said that it's not a much-used method. nsswitch.conf passwd: files compat ...
ujjain's user avatar
  • 4,033
10 votes
3 answers
5k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
PhilR's user avatar
  • 483
10 votes
3 answers
20k views

ldap force user to change password

I am using CentOS-ds (based off Redhat-DS and 389 directory servers). I have LDAP setup, and working to authenticate users (and Sudo, thats a handy feature!). even passwd is working great to change ...
Brian's user avatar
  • 1,253
10 votes
2 answers
24k views

Reload /etc/security/limits.conf

I would like to: make a soft 64GB limit for resident memory (so inexperienced users will get their run-amok processes killed, but experienced users can raise the limit for memory hungry processes) ...
Ole Tange's user avatar
  • 3,106
10 votes
1 answer
3k views

Prevent fork bomb inside docker container

I am currently struggling with limiting number of processes for user which I called sandbox. I configured processes limit inside /etc/security/limits.conf like this: sandbox hard nproc ...
eXPi's user avatar
  • 101
9 votes
3 answers
14k views

How can I delay sshd login after bad password

How can I delay the retry response from SSH when a bad password is tried or unsuccessful login attempt. I wanted the delay to be 2-3 second more that usual. I could not find any option in ...
Milan's user avatar
  • 229
8 votes
3 answers
11k views

How to automatically create user accounts ( SSH + LDAP )

I set up remote LDAP server (Server1) and SSH with pam_ldap on Server2. Everything is working ok, I can login to SSH with LDAP credentials. But when I want to add new user, I have to firstly create it ...
John's user avatar
  • 1,493
8 votes
3 answers
7k views

PAM: Execute a command before pam_mkhomedir?

When a user logs into a system and there is no home directory, we would like to to create the user's home directory using pam_mkhomedir. This is a common practice. Here's a quick description of ...
Stefan Lasiewski's user avatar
8 votes
4 answers
18k views

Conflicts with PAM configuration files when upgrading system

I have a VPS that runs Ubuntu 14.04.4 LTS; it was installed as a whole with Plesk by OVH. I juste did a apt-get upgrade, and at some point I had a message regarding PAM. The system is in French, but ...
piwi's user avatar
  • 336
8 votes
3 answers
16k views

Suggest methods for testing changes to "pam.d/common-*" files

How do I test the changes to the pam.d configuration files: Do I need to restart the PAM service to test the changes? Should I go through every service listed in the /etc/pam.d/ directory? I'm ...
Jamie's user avatar
  • 1,314
8 votes
3 answers
10k views

Expired "authentication token" for user with deleted password

The Setup: 1) The user's password was deleted with "passwd -d " command 2) The user has cron jobs running The Problem: Once every 30 days (default password expiration policy) the cron fails with an ...
Aleksey Sanin's user avatar
7 votes
3 answers
14k views

sudo taking long time

On a Ubuntu 9 64bit Linux machine, sudo takes longer time to start. "sudo echo hi" takes 2-3 minutes. strace on sudo tells poll("/etc/pam.d/system-auth", POLLIN) timesout after 5 seconds and there ...
user avatar
7 votes
2 answers
13k views

debian: cannot change password

As the root user, I can change the password: hussie:/home/claudiu# passwd Enter new password: Retype new password: passwd: password updated successfully As a non-root user I cannot: claudiu@hussie:~...
Claudiu's user avatar
  • 1,207
7 votes
3 answers
16k views

How to use PAM to limit failed login attempts by IP?

I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
Philip Couling's user avatar
7 votes
2 answers
22k views

How to use nginx PAM module?

I would like to use nginx PAM module to authenticate a site with existing users on a FreeBSD system. I tried to use pam_unix.so, but no luck. It's just not let me in with my usr/psw pair. :( nginx ...
noirello's user avatar
7 votes
5 answers
64k views

PBIS Open AD authentication stops working on ubuntu with errors: "user accout has expired" and "is your account locked?"

We have been using PowerBroker Identity Services Open to authenticate active directory users from ubuntu hosts successfully for six months. Recently AD authentication stopped working on several ...
Peter M's user avatar
  • 973
7 votes
5 answers
18k views

limits.conf not being applied.

I have the following lines in /etc/security/limits.conf * soft nofile 32768 * hard nofile 65536 root soft nofile 32768 root ...
diolemo's user avatar
  • 283
7 votes
3 answers
13k views

LDAP Users Home Directories

I'm trying to setup linux login via an LDAP server. I have everything working except setting the user's home directory. There is no parameter in the LDAP database that I can map to the ...
Tom Kiley's user avatar
  • 111

1
2 3 4 5
16