Tag Info

Hot answers tagged

26

[Edit] I've since tested this the full release of Ubuntu 10.04 Server (21/May/2010). I've configured my Ubuntu 10.04 Server LTS residing on a windows network to authenticate logins using active directory, then mount a windows share to serve as there home directory. Here is what I did starting from the initial installation of Ubuntu. Download and install ...


24

If you remove the setuid bit from the passwd command, only root will be able to use it. This will also disable the users from changing the password before it expires - which could otherwise be a way for the users to extend the account for another four hours. [jenny@finch ~] sudo chmod -s /usr/bin/passwd [jenny@finch ~]$ passwd Changing password for user ...


21

Generally, password expiration is used to force users to change their passwords. What it sounds like you want to do is to lock the account, which prevents all login. What I would suggest you do instead is, when you create the account, also set up an at job which will lock the account after four hours. For example: useradd temp8143 echo chage -E 0 temp8143 ...


20

It's a security feature to slow down people who are trying to guess your password. It takes Ubuntu the same amount of time to see if it's correct or not, but then it waits for a few seconds before letting you try again.


17

You might be interested in fail2ban.


16

PAM is telling you that it is configured with "retry=3" and it will ignore any further auth requests from sshd within the same session. SSH however will continue trying until it exhausts MaxAuthTries setting (which defaults to 6). You should probably set both of these (SSH and PAM) to same value for maximum auth retries. Updated To change this behaviour: ...


14

While the other answers are correct in elimiating the error message you got, consider that this error message may just be a symptom of another underlying problem. You get these messages because there are many failing login attempts via ssh on your system. There may be someone trying to brute-force into your box (was the case when I got the same messages on ...


14

As Dentrasi has explained - this is to make it more difficult for the attacker to carry out a brute-force attack on the password store. In almost all circumstances, you don't to change this behavior. If you have a good reason to (which I can't think of), you can modify it via /etc/login.defs - See the login.defs(5) man page. FAIL_DELAY (number) Delay ...


12

A couple of things for you to try: Did you enable logging of debug messages in syslog? cp /etc/syslog.conf /etc/syslog.conf.original vi /etc/syslog.conf Add the following line: *.debug /var/log/debug.log Exit with :wq!. touch /var/log/debug.log service syslog restart You can enable debugging for all modules like so: touch /etc/pam_debug OR ...


11

You can do this in many ways. You can limit how many times a user can connect via SSH by using the pam_tally (better pam_tally2) module with something like auth required pam_tally.so deny=10 unlock_time=60 per_user which limits every user to 10 logins / minute. This is of course not blocking the connection to the SSH daemon in any way. To do ...


11

That's just cron running the cronjobs. It opens (and then closes) a PAM session for the appropriate user when it executes commands. Based on the timestamps, you have a cronjob which executes every minute.


10

You don't need to actually make the user on the server2, only their home directory on first login. You're looking for pam_mkhomedir: http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_mkhomedir.html Google will find you many howtos and examples on getting this set up.


8

Simply modify your /etc/ssh/sshd_config file; add MaxAuthTries 5 and restart sshd.


8

You can use pam_succeed_if in your /etc/pam.d/telnet or similar file: auth required pam_suceed_if.so user = ${telnet_user} quiet Where ${telnet_user} is the user allowed to use telnet. But, if you weren't aware, telnet is a Bad Thing. The allowed account's details can easily be sniffed and may enable other people to use the account. Really do you SSH if ...


8

The largest cause of sudo being slow is the system not being able to resolve it's own hostname. Do you have your local hostname included in /etc/hosts? If not I would recommend adding it with the IP 127.0.1.1 which is what I do on all my systems. I add the entry with both the short hostname and the full qualified domain name (FQDN). This then removes the ...


8

From my understanding, success=$num will specify how many rules to skip when successful. So in both cases, with either pam_unix.so or pam_winbind.so, they will skip to the final line. Of course, the final line permits access in all cases.


8

I managed to fix this moments after posting the question. It turns out that the /etc/shadow entries for the affected MD5 password users had somehow had the field after the hashed password duplicated, causing PAM to be unable to interpret the line. In other words, a bad cut and paste job. I haven't had enough coffee...


8

If you block all user even block root you can add this lines to /etc/pam.d/password-auth or /etc/pam.d/sshd, in the auth section add this to block all user for 5 minutes: auth required pam_tally2.so file=/var/log/tallylog deny=3 even_deny_root unlock_time=300 Now add the following line to the account section: account required ...


7

This excerpt was taken from amazing book written by Linux advocate Evi Nemeth( unfortunately recently lost in the sea http://www.theregister.co.uk/2013/07/05/evi_nemeth_unix_dead/ ) in her one of the first and best linux admin book: Linux® Administration Handbook. For this case it was in the second edition of the book, I am not sure if this was duplicated ...


7

Yes, oauthtool can do this. You'll need to seed it with the shared secret from your server.


7

It helps to break things down like this in your head: NSS - A module based system for controlling how various OS-level databases are assembled in memory. This includes (but is not limited to) passwd, group, shadow (this is important to note), and hosts. UID lookups use the passwd database, and GID lookups use the group database. PAM - A module based system ...


7

After all that, it turns out to have been a one-character typo in /etc/shadow. Spot the difference: admin:!:15891:0:99999:7::: tbbscraper:!::15966:0:99999:7::: That's right, there are two colons after the exclamation point on the tbbscraper line. That shoves all the fields over one and makes PAM think that the account expired on January 8, 1970.


7

There is a PAM module called pam_exec - if you write a script which checks for and/or creates the ZFS volume, you can chain this into your existing PAM rules and keep things nice without assuming interactive login, default shells & skeleton directories, etc. For example, you could have session required pam_unix.so session required pam_exec.so ...


7

I tried to post this answer yesterday but the website was failing. Anyway I managed to solve this in a more elegant way. PAM has the ability to restrict access based on an access control list (at least on Ubuntu) which, like kubanskamac's answer (+1) regards the groups as posix groups, whether they're stored in LDAP, /etc/group or NIS. ...


7

You're probably quicker adding a shell script onto the end of /etc/profile file to do a group check then spit out a message Something like: #!/bin/bash # script at /usr/local/bin/motdcheck PGROUP=`groups|awk '{print $1}'` cat /etc/motd.${PGROUP} would run as a script which outputs a file named /etc/motd.groupname where groupname is the first group in the ...


7

You should be using sudo for this, not su. With sudo, you can specify NOPASSWD in /etc/sudoers: username ALL=/path/to/command NOPASSWD: ALL


7

It looks like your /usr/sbin/sshd binary has been overwritten. This could mean you have had a security breach, or maybe someone just compiled a version locally and the Ubuntu version was overwritten. The 1:4.7p1-8ubuntu1.2 (x86) version of the openssh-server definitely is definitely linked against libpam. It is conceivable that the pam support was left out ...


7

I figured out that the system doesn't seem to like the wildcard for the user in limits.conf. Changing that to: root soft nofile 100000 and root hard nofile 100000 worked fine.


6

The /etc/pam.d/system-auth file is used by Red-Hat and like systems to group together common security policies. It is often included in other /etc/pam.d policy files where those common policies are required. When accessing a system via ssh through sshd the /etc.pam.d/sshd policy file is consulted. This file includes /etc/pam.d/system-auth so your changes to ...


6

Yes, you can use the pam_echo plugin: auth required pam_unix.so auth optional pam_echo.so file=/etc/ssh/password_banner.txt This should produce the pam_echo output after password login. See http://www.linux-pam.org/Linux-PAM-html/sag-pam_echo.html for docs. Edit: You'll also need to make sure you have UsePAM yes in your sshd_config. Replaced password ...



Only top voted, non community-wiki answers of a minimum length are eligible