Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

16
votes
1answer
23k views
16
votes
5answers
28k views

Switch on PAM debugging to Syslog

I hate PAM since it came up. How do I switch on PAM debugging in Debian Squeeze at the admin level? I have checked every resource I was able to find. Google, manpages, whatever. The only thing I ...
14
votes
2answers
1k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
14
votes
6answers
11k views

pam service(sshd) ignoring max retries

I have vps that I use to run a webserver on, it currently runs ubuntu server 12.04. Since a few weeks I keep getting a lot of errors in my ssh console. 2014 Apr 11 08:41:18 vps847 PAM service(sshd) ...
13
votes
4answers
2k views

OpenLDAP, Samba and password aging

I'm configuring a system in which all IT resources are available through a single user-password pair, be it access to shell on the servers, logging to Samba domain, WiFi, OpenVPN, Mantis, etc. (with ...
12
votes
1answer
7k views

open file descriptor limits.conf setting isn't read by ulimit even when pam_limits.so is required

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. I've added the following lines to /etc/security/limits.conf: * soft nofile 100000 ...
12
votes
2answers
544 views

SSH only works after intentionally failed password

So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
11
votes
3answers
9k views

Restricting account logins using LDAP and PAM

I was hoping some PAM/LDAP gurus may be able to help me out here. I've recently set up an LDAP directory on Ubuntu Server to hold accounts for both my clients (for use with web-based systems) and ...
11
votes
2answers
565 views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...
10
votes
3answers
2k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
10
votes
4answers
11k views

How to get full control of umask/PAM/permissions?

// Updated Feb 8 - Outstanding issues in brief: How to umask directories differently from files? How to umask on Nautilus copy/paste? How to set umask for SSHFS? OUR SITUATION Several people from ...
9
votes
1answer
14k views

ssh: “Access denied by PAM account configuration” for one non-root user but not another

On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is ...
7
votes
2answers
3k views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
7
votes
1answer
4k views

“success=n” control syntax in pam.conf / pam.d/* files

After sucessfully configuring Kerberos, this is what I've found in /etc/pam.d/common-auth file: auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] ...
7
votes
2answers
9k views

Reload /etc/security/limits.conf

I would like to: make a soft 64GB limit for resident memory (so inexperienced users will get their run-amok processes killed, but experienced users can raise the limit for memory hungry processes) ...
7
votes
1answer
853 views

Prevent fork bomb inside docker container

I am currently struggling with limiting number of processes for user which I called sandbox. I configured processes limit inside /etc/security/limits.conf like this: sandbox hard nproc ...
6
votes
4answers
1k views

Ubuntu linux takes longer time for incorrect passwords

When I log into my Ubuntu 8.10 box with a correct password the system figures out almost instantaneously that the password is correct and logs me in. However, if I supply an incorrect password, it ...
6
votes
3answers
3k views

libpam-ldap or libpam-ldapd?

I'm setting up LDAP authentication on my personal VPS, and Ubuntu has two packages for the same purpose: libpam-ldap and libpam-ldapd. Which should I use?
6
votes
3answers
11k views

The difference between /etc/pam.d/login and /etc/pam.d/system-auth?

I want to configure securetty to limit root directly access. Now I am clear if I add: auth required pam_securetty.so into /etc/pam.d/system-auth, and keep only "console" in ...
6
votes
2answers
13k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
6
votes
1answer
706 views

Need help understanding PAM directives

I have the following directives in my /etc/pam.d/sshd file on a RHEL5 box and I'm a bit confused. These directives are there to make LDAP+RADIUS+OTP work. What I'm trying to do is tell pam not to ...
6
votes
1answer
423 views

Different “RequiredAuthentications2” for sshd and sftp subsystem

we're currently using a 2factor authentication on our SSH servers, so we have "RequiredAuthentications2 publickey,keyboard-interactive" in our sshd_config (publickey for the key, keyboard-interactive ...
6
votes
5answers
6k views

Linux authentication via ADS — allowing only specific groups in PAM

I'm taking the samba / winbind / PAM route to authenticate users on our linux servers from our Active Directory domain. Everything works, but I want to limit what AD groups are allowed to ...
5
votes
3answers
3k views

vsftpd will not accept passwords encrypted with MD5

I am setting up an server with vsftpd to let virtual users access their space. Now it is fully working but only with CRYPT passwords. So sudo htpasswd -c /etc/vsftpd/ftpd.passwd phpmyadmin will ...
5
votes
1answer
5k views

Users cannot use crontab after password security upgrade

I have a box being upgraded from CentOS 5 to CentOS 6. On the original server, all users have MD5 passwords. The upgraded server is now using SHA-512 passwords. Users who have changed their password ...
5
votes
3answers
4k views

PAM: Execute a command before pam_mkhomedir?

When a user logs into a system and there is no home directory, we would like to to create the user's home directory using pam_mkhomedir. This is a common practice. Here's a quick description of ...
5
votes
3answers
4k views

sudo taking long time

On a Ubuntu 9 64bit Linux machine, sudo takes longer time to start. "sudo echo hi" takes 2-3 minutes. strace on sudo tells poll("/etc/pam.d/system-auth", POLLIN) timesout after 5 seconds and there ...
5
votes
2answers
353 views

Logins take a long time

After upgrading to Debian 7.4 password authentication from any service take a long time. This is true for SSH logins, sudo'ing and authentication with dovecot (which is configured to use PAM). I am ...
5
votes
4answers
742 views

Locking a user's account locally when kerberos is enabled

I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics: If there is no local account, login is blocked. If there is a local account with SSH keys, use ...
5
votes
2answers
275 views

How to handle large number of users in SELinux?

A while back we started authenticating users on our Linux servers against Active Directory. As far as the actual authentication part goes, things are working great. However, one of the side effects ...
5
votes
4answers
571 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source based on this question: Managing access to multiple linux system One problem I ran into is that if a ...
5
votes
1answer
677 views

Combination of SSH key auth, and two-factor authentication

I was wondering if it is possible to accomplish the following, all at the same time: Disable root logins Enable SSH login for personal user, only via SSH keys Enable SSH login for unprivileged user, ...
5
votes
1answer
4k views

SMTP authentication failure + PAM-MySQL cannot authenticate

I am building a mail server using Postfix, and set up the authentication to check against a database set-up using Postfixadmin. I can authenticate via Courier IMAP okay, as it can authenticate ...
5
votes
2answers
724 views

Access control to 100's of LAMP box via LDAP

This is every SysAdmin's nightmare of things to do. Basically we want to control who has access to which hosts. As simple it may sound, the problem is to find a scalable and low maintenance(mgmt. ...
5
votes
3answers
2k views

LDAP Users Home Directories

I'm trying to setup linux login via an LDAP server. I have everything working except setting the user's home directory. There is no parameter in the LDAP database that I can map to the ...
5
votes
2answers
2k views

Nginx with PAM authentication through pam_script

Have anyone set up such a configuration? It's not working for me. I've installed nginx-extras on Ubuntu 12.04 (it's built with PAM module), and added to site config: location ^~ /restricted_place/ { ...
5
votes
2answers
461 views

Samba: read-only LDAP + additional local users

My server has access to a read-only LDAP where information about 99% of user accounts will reside. On my server I want to configure Samba to use LDAP for authentication. Now and then there will be ...
5
votes
1answer
4k views

Expired “authentication token” for user with deleted password

The Setup: 1) The user's password was deleted with "passwd -d " command 2) The user has cron jobs running The Problem: Once every 30 days (default password expiration policy) the cron fails with an ...
5
votes
2answers
2k views

configure pam with ssh to do 2 factor authentication

I am trying to configure ssh with my custom radius server for authentication. So what i want is, First it should authenticate with current ssh login (unix login) and then prompt user for second ...
5
votes
2answers
1k views

vsftpd - PAM - MySQL and pam_mkhomedir to create directories

I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection. Here is ...
4
votes
1answer
247 views

Weird stuff in in my /var/log/auth.log

I just check my logs on my deed server, I spotted some weird log in the auth.log: Jun 17 22:27:01 mutualab CRON[16249]: pam_unix(cron:session): session opened for user user by (uid=0) Jun 17 22:27:01 ...
4
votes
6answers
3k views

How to customize telnet login prompt on linux

When I run login command on debian, I get: hostname login: _ on RHEL5, Solaris or HP-UX I get: login: _ I need to be able to customize login: and password: prompts it on a Linux box. I can ...
4
votes
2answers
2k views

/etc/pam.d/login vs. /etc/pam.d/system-auth

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this: password required pam_cracklib.so dcredit=-1 ...
4
votes
3answers
5k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
4
votes
1answer
609 views

Display different motd file based on group

Is it possible in ubuntu to print a different motd file based on the group of the user that is logging in? I want to display different motd messages for admins and regular users when they login to my ...
4
votes
2answers
1k views

How to grant su access to wheel without asking for password on FreeBSD?

I would like to grant users of the wheel group (other sysadmins) su access without being asked for password. I know how to do it with pam in linux, but the question now is for FreeBSD. I am not ...
4
votes
1answer
2k views

How to use PAM to check LDAP password for some users, yet always use UID/GIDs from local files?

For a subset of my users in /etc/passwd, I would like to configure PAM (on Linux) to do the password checking part of the logon against an LDAP server, ignoring that these users are actually are ...
4
votes
1answer
2k views

Purpose Behind Disabling PAM in SSH

I'm setting up key based authentication for SSH on a new box, and was reading a few articles that mention setting UsePAM to no along with PasswordAuthentication. My question is, what is the purpose ...
4
votes
4answers
1k views

How can I require a certain group of users to login via LDAP while letting others use either LDAP or local login?

I have set up my system to allow either LDAP or the local password for login. I did this by adding "password sufficient pam_ldap.so" to PAM and calling "pam_unix2.so" afterwards. However I would ...
4
votes
5answers
6k views

Multiple logins with pam_mount means multiple (redundant) mounts

I've configured pam_mount.so to automagically mount a cifs share when users login; the problem is if a user logs into multiple times simultaneously, the mount command is repeated multiple times. ...