Questions tagged [pam]
Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
757
questions
45
votes
2
answers
38k
views
Slow ssh login - Activation of org.freedesktop.login1 timed out
On one of my servers I've noticed really delay on SSH logins.
Connecting using the ssh -vvv options the delay occurs at debug1: Entering interactive session.
extract of connection:
debug1: ...
42
votes
7
answers
109k
views
Switch on PAM debugging to Syslog
How do I switch on PAM debugging in Debian Squeeze at the admin level?
I have checked every resource I was able to find. Google, manpages, whatever. The only thing I haven't tried yet (I simply not ...
41
votes
8
answers
33k
views
Is there a command line two-factor authentication verification code generator?
I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...
37
votes
6
answers
36k
views
pam service(sshd) ignoring max retries
I have vps that I use to run a webserver on, it currently runs ubuntu server 12.04. Since a few weeks I keep getting a lot of errors in my ssh console.
2014 Apr 11 08:41:18 vps847 PAM service(sshd) ...
33
votes
7
answers
133k
views
ssh: "Access denied by PAM account configuration" for one non-root user but not another
On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is
...
27
votes
2
answers
21k
views
Understand PAM and NSS
In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
26
votes
1
answer
22k
views
Purpose Behind Disabling PAM in SSH
I'm setting up key based authentication for SSH on a new box, and was reading a few articles that mention setting UsePAM to no along with PasswordAuthentication.
My question is, what is the purpose ...
24
votes
3
answers
3k
views
What can be learned about a user from a failed SSH attempt?
What can be learned about a 'user' from a failed malicious SSH attempt?
User name entered (/var/log/secure)
Password entered (if configured, i.e. by using a PAM module)
Source IP address (/var/log/...
24
votes
5
answers
62k
views
ulimit -n not changing - values limits.conf has no effect
I am trying to raise the open file descriptor maximum for all users on an ubuntu machine.
This question is somewhat of a follow up to this question.
open file descriptor limits.conf setting isn'...
21
votes
2
answers
23k
views
"success=n" control syntax in pam.conf / pam.d/* files
After sucessfully configuring Kerberos, this is what I've found in /etc/pam.d/common-auth file:
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] ...
20
votes
2
answers
54k
views
How to use the ssh server with PAM but disallow password auth?
Many tutorials tell you to config your ssh server like this:
ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no
but with this setup you cannot use PAM, as i plan to use 2 Factor ...
18
votes
1
answer
39k
views
How to authenticate Linux accounts against an Active Directory and mount a Windows share on login?
I'm using Ubuntu 10.04 Server.
18
votes
2
answers
85k
views
Connection closed by UNKNOWN port 65535 when SSH using AD Creds on RHEL Machine
Recently I installed PAM & all the necessary packages needed to enable ssh authentication via AD on my RHEL 7.5 machines.
When I try to SSH using "ssh user@domainname@hostname" it asks ...
18
votes
2
answers
17k
views
open file descriptor limits.conf setting isn't read by ulimit even when pam_limits.so is required
I am trying to raise the open file descriptor maximum for all users on an ubuntu machine.
I've added the following lines to /etc/security/limits.conf:
* soft nofile 100000
...
16
votes
1
answer
10k
views
Linux samba server: cifs_mount failed w/return code = -12
Server: RHEL 5.9 / smbd 3.0.33
- Clients: various, though all were using current mount.cifs (5.2)
I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
15
votes
3
answers
106k
views
How to fix a crontab access issue with a pam configuration error message? [closed]
I attempted to access my crontab as the non-root user "coins" when I encountered a permissions issue as shown in the following error message mentioning the pam configuration:
[coins@COINS-TEST ~]$ ...
15
votes
2
answers
4k
views
What do the OS X authorization mechanisms actually do?
Background
I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On.
Please do correct me if I'm wrong, but I believe ...
14
votes
2
answers
2k
views
How to prevent users from extending their window of valid login
Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired.
For one of our clients ...
14
votes
3
answers
9k
views
libpam-ldap or libpam-ldapd?
I'm setting up LDAP authentication on my personal VPS, and Ubuntu has two packages for the same purpose: libpam-ldap and libpam-ldapd. Which should I use?
14
votes
3
answers
42k
views
The difference between /etc/pam.d/login and /etc/pam.d/system-auth?
I want to configure securetty to limit root directly access. Now I am clear if I add:
auth required pam_securetty.so
into /etc/pam.d/system-auth, and keep only "console" in /etc/...
14
votes
5
answers
50k
views
Debugging sssd login: pam_sss [...] System error
How does one properly debug the shell login in the following case?
Authentication is handled via sssd configuration and a krb5 authentication server. Logging in with the same .conf-file on Ubuntu 16....
14
votes
3
answers
23k
views
Restricting account logins using LDAP and PAM
I was hoping some PAM/LDAP gurus may be able to help me out here. I've recently set up an LDAP directory on Ubuntu Server to hold accounts for both my clients (for use with web-based systems) and ...
13
votes
2
answers
3k
views
SSH only works after intentionally failed password
So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
13
votes
4
answers
18k
views
How to get full control of umask/PAM/permissions?
// Updated Feb 8 - Outstanding issues in brief:
How to umask directories differently from files?
How to umask on Nautilus copy/paste?
How to set umask for SSHFS?
OUR SITUATION
Several people from ...
13
votes
4
answers
4k
views
OpenLDAP, Samba and password aging
I'm configuring a system in which all IT resources are available through a single user-password pair, be it access to shell on the servers, logging to Samba domain, WiFi, OpenVPN, Mantis, etc. (with ...
12
votes
2
answers
9k
views
Adding local users / passwords on Kerberized Linux box
Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
12
votes
1
answer
50k
views
LDAP authentication on CentOS 7
After upgrading to CentOS 7 it's no longer possible to login via LDAP. With CentOS 6 I used the package pam_ldap which worked fine, but now pam_ldap is no longer available for the new version of ...
11
votes
3
answers
24k
views
sshd: How to enable PAM authentication for specific users under
I am using sshd, and allow logins with public key authentication.
I want to allow select users to log in with a PAM two-factor authentication module.
Is there any way I can allow PAM two-factor ...
11
votes
1
answer
5k
views
What's the downside of disabling PAM in OpenSSH if only public-key login is allowed?
/etc/ssh/sshd_config by default has the following line
UsePAM yes
I read through available documentation and came to the conclusion that PAM is not used if I only use public-key login. What possible ...
11
votes
3
answers
3k
views
vsftpd - PAM - MySQL and pam_mkhomedir to create directories
I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection.
Here is /etc/pam.d/...
10
votes
3
answers
13k
views
vsftpd will not accept passwords encrypted with MD5
I am setting up an server with vsftpd to let virtual users access their space. Now it is fully working but only with CRYPT passwords. So
sudo htpasswd -c /etc/vsftpd/ftpd.passwd phpmyadmin
will not ...
10
votes
1
answer
5k
views
PAM accepting any password for valid users
I just linked my Arch Linux workstation to the Samba AD I set up for our company. I tested it, and it worked, or so I thought. It accepted my password, created my homedir and everything, and logged me ...
10
votes
1
answer
26k
views
What is nsswitch compat mode?
Red Hat recommended me compat mode in /etc/nsswitch.conf as one of the options to enumerate LDAP users, but later said that it's not a much-used method.
nsswitch.conf
passwd: files compat
...
10
votes
3
answers
5k
views
How to deny access to disabled AD accounts via kerberos in pam_krb5?
I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login.
It's clear that ...
10
votes
3
answers
20k
views
ldap force user to change password
I am using CentOS-ds (based off Redhat-DS and 389 directory servers).
I have LDAP setup, and working to authenticate users (and Sudo, thats a handy feature!). even passwd is working great to change ...
10
votes
2
answers
24k
views
Reload /etc/security/limits.conf
I would like to:
make a soft 64GB limit for resident memory (so inexperienced users will get their run-amok processes killed, but experienced users can raise the limit for memory hungry processes)
...
10
votes
1
answer
3k
views
Prevent fork bomb inside docker container
I am currently struggling with limiting number of processes for user which I called sandbox.
I configured processes limit inside /etc/security/limits.conf like this:
sandbox hard nproc ...
9
votes
3
answers
14k
views
How can I delay sshd login after bad password
How can I delay the retry response from SSH when a bad password is tried or unsuccessful login attempt. I wanted the delay to be 2-3 second more that usual.
I could not find any option in ...
8
votes
3
answers
11k
views
How to automatically create user accounts ( SSH + LDAP )
I set up remote LDAP server (Server1) and SSH with pam_ldap on Server2. Everything is working ok, I can login to SSH with LDAP credentials. But when I want to add new user, I have to firstly create it ...
8
votes
3
answers
7k
views
PAM: Execute a command before pam_mkhomedir?
When a user logs into a system and there is no home directory, we would like to to create the user's home directory using pam_mkhomedir. This is a common practice. Here's a quick description of ...
8
votes
4
answers
18k
views
Conflicts with PAM configuration files when upgrading system
I have a VPS that runs Ubuntu 14.04.4 LTS; it was installed as a whole with Plesk by OVH. I juste did a apt-get upgrade, and at some point I had a message regarding PAM. The system is in French, but ...
8
votes
3
answers
16k
views
Suggest methods for testing changes to "pam.d/common-*" files
How do I test the changes to the pam.d configuration files:
Do I need to restart the PAM service to test the changes?
Should I go through every service listed in the /etc/pam.d/ directory?
I'm ...
8
votes
3
answers
10k
views
Expired "authentication token" for user with deleted password
The Setup:
1) The user's password was deleted with "passwd -d " command
2) The user has cron jobs running
The Problem:
Once every 30 days (default password expiration policy) the cron fails with an ...
7
votes
3
answers
14k
views
sudo taking long time
On a Ubuntu 9 64bit Linux machine, sudo takes longer time to start. "sudo echo hi" takes 2-3 minutes.
strace on sudo tells poll("/etc/pam.d/system-auth", POLLIN) timesout after 5 seconds and there ...
7
votes
2
answers
13k
views
debian: cannot change password
As the root user, I can change the password:
hussie:/home/claudiu# passwd
Enter new password:
Retype new password:
passwd: password updated successfully
As a non-root user I cannot:
claudiu@hussie:~...
7
votes
3
answers
16k
views
How to use PAM to limit failed login attempts by IP?
I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
7
votes
2
answers
22k
views
How to use nginx PAM module?
I would like to use nginx PAM module to authenticate a site with existing users on a FreeBSD system. I tried to use pam_unix.so, but no luck. It's just not let me in with my usr/psw pair. :(
nginx ...
7
votes
5
answers
64k
views
PBIS Open AD authentication stops working on ubuntu with errors: "user accout has expired" and "is your account locked?"
We have been using PowerBroker Identity Services Open to authenticate active directory users from ubuntu hosts successfully for six months.
Recently AD authentication stopped working on several ...
7
votes
5
answers
18k
views
limits.conf not being applied.
I have the following lines in /etc/security/limits.conf
* soft nofile 32768
* hard nofile 65536
root soft nofile 32768
root ...
7
votes
3
answers
13k
views
LDAP Users Home Directories
I'm trying to setup linux login via an LDAP server.
I have everything working except setting the user's home directory. There is no parameter in the LDAP database that I can map to the ...