Tag Info

Hot answers tagged

24

[Edit] I've since tested this the full release of Ubuntu 10.04 Server (21/May/2010). I've configured my Ubuntu 10.04 Server LTS residing on a windows network to authenticate logins using active directory, then mount a windows share to serve as there home directory. Here is what I did starting from the initial installation of Ubuntu. Download and install ...


20

It's a security feature to slow down people who are trying to guess your password. It takes Ubuntu the same amount of time to see if it's correct or not, but then it waits for a few seconds before letting you try again.


17

You might be interested in fail2ban.


14

As Dentrasi has explained - this is to make it more difficult for the attacker to carry out a brute-force attack on the password store. In almost all circumstances, you don't to change this behavior. If you have a good reason to (which I can't think of), you can modify it via /etc/login.defs - See the login.defs(5) man page. FAIL_DELAY (number) Delay ...


11

You can do this in many ways. You can limit how many times a user can connect via SSH by using the pam_tally (better pam_tally2) module with something like auth required pam_tally.so deny=10 unlock_time=60 per_user which limits every user to 10 logins / minute. This is of course not blocking the connection to the SSH daemon in any way. To do ...


11

That's just cron running the cronjobs. It opens (and then closes) a PAM session for the appropriate user when it executes commands. Based on the timestamps, you have a cronjob which executes every minute.


11

PAM is telling you that it is configured with "retry=3" and it will ignore any further auth requests from sshd within the same session. SSH however will continue trying until it exhausts MaxAuthTries setting (which defaults to 6). You should probably set both of these (SSH and PAM) to same value for maximum auth retries. Updated To change this behaviour: ...


10

A couple of things for you to try: Did you enable logging of debug messages in syslog? cp /etc/syslog.conf /etc/syslog.conf.original vi /etc/syslog.conf Add the following line: *.debug /var/log/debug.log Exit with :wq!. touch /var/log/debug.log service syslog restart You can enable debugging for all modules like so: touch /etc/pam_debug OR ...


10

You don't need to actually make the user on the server2, only their home directory on first login. You're looking for pam_mkhomedir: http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_mkhomedir.html Google will find you many howtos and examples on getting this set up.


9

While the other answers are correct in elimiating the error message you got, consider that this error message may just be a symptom of another underlying problem. You get these messages because there are many failing login attempts via ssh on your system. There may be someone trying to brute-force into your box (was the case when I got the same messages on ...


8

Simply modify your /etc/ssh/sshd_config file; add MaxAuthTries 5 and restart sshd.


8

You can use pam_succeed_if in your /etc/pam.d/telnet or similar file: auth required pam_suceed_if.so user = ${telnet_user} quiet Where ${telnet_user} is the user allowed to use telnet. But, if you weren't aware, telnet is a Bad Thing. The allowed account's details can easily be sniffed and may enable other people to use the account. Really do you SSH if ...


8

From my understanding, success=$num will specify how many rules to skip when successful. So in both cases, with either pam_unix.so or pam_winbind.so, they will skip to the final line. Of course, the final line permits access in all cases.


8

I managed to fix this moments after posting the question. It turns out that the /etc/shadow entries for the affected MD5 password users had somehow had the field after the hashed password duplicated, causing PAM to be unable to interpret the line. In other words, a bad cut and paste job. I haven't had enough coffee...


7

Yes, oauthtool can do this. You'll need to seed it with the shared secret from your server.


7

This excerpt was taken from amazing book written by Linux advocate Evi Nemeth( unfortunately recently lost in the sea http://www.theregister.co.uk/2013/07/05/evi_nemeth_unix_dead/ ) in her one of the first and best linux admin book: Linux® Administration Handbook. For this case it was in the second edition of the book, I am not sure if this was duplicated ...


7

There is a PAM module called pam_exec - if you write a script which checks for and/or creates the ZFS volume, you can chain this into your existing PAM rules and keep things nice without assuming interactive login, default shells & skeleton directories, etc. For example, you could have session required pam_unix.so session required pam_exec.so ...


7

I tried to post this answer yesterday but the website was failing. Anyway I managed to solve this in a more elegant way. PAM has the ability to restrict access based on an access control list (at least on Ubuntu) which, like kubanskamac's answer (+1) regards the groups as posix groups, whether they're stored in LDAP, /etc/group or NIS. ...


7

The largest cause of sudo being slow is the system not being able to resolve it's own hostname. Do you have your local hostname included in /etc/hosts? If not I would recommend adding it with the IP 127.0.1.1 which is what I do on all my systems. I add the entry with both the short hostname and the full qualified domain name (FQDN). This then removes the ...


7

You're probably quicker adding a shell script onto the end of /etc/profile file to do a group check then spit out a message Something like: #!/bin/bash # script at /usr/local/bin/motdcheck PGROUP=`groups|awk '{print $1}'` cat /etc/motd.${PGROUP} would run as a script which outputs a file named /etc/motd.groupname where groupname is the first group in the ...


7

You should be using sudo for this, not su. With sudo, you can specify NOPASSWD in /etc/sudoers: username ALL=/path/to/command NOPASSWD: ALL


7

It looks like your /usr/sbin/sshd binary has been overwritten. This could mean you have had a security breach, or maybe someone just compiled a version locally and the Ubuntu version was overwritten. The 1:4.7p1-8ubuntu1.2 (x86) version of the openssh-server definitely is definitely linked against libpam. It is conceivable that the pam support was left out ...


7

I figured out that the system doesn't seem to like the wildcard for the user in limits.conf. Changing that to: root soft nofile 100000 and root hard nofile 100000 worked fine.


7

If you block all user even block root you can add this lines to /etc/pam.d/password-auth or /etc/pam.d/sshd, in the auth section add this to block all user for 5 minutes: auth required pam_tally2.so file=/var/log/tallylog deny=3 even_deny_root unlock_time=300 Now add the following line to the account section: account required ...


6

The /etc/pam.d/system-auth file is used by Red-Hat and like systems to group together common security policies. It is often included in other /etc/pam.d policy files where those common policies are required. When accessing a system via ssh through sshd the /etc.pam.d/sshd policy file is consulted. This file includes /etc/pam.d/system-auth so your changes to ...


6

Yes, you can use the pam_echo plugin: auth required pam_unix.so auth optional pam_echo.so file=/etc/ssh/password_banner.txt This should produce the pam_echo output after password login. See http://www.linux-pam.org/Linux-PAM-html/sag-pam_echo.html for docs. Edit: You'll also need to make sure you have UsePAM yes in your sshd_config. Replaced password ...


6

Not for local users on ESXi, but you can LDAP integrate vCentre to allow management. EDIT - ESXi 4.1 can now authenticate directly with LDAP/AD.


5

Another dynamic connection blocker based on failed login attempts is DenyHosts. It functions similarly to fail2ban, but specifically targets ssh login attempts. The last time I set it up, I found it very easy to configure.


5

I use an iptables rule that limits SSH connections to no more than 10 per minute. After 10 connections (or attempts), new incoming connections from that IP are dropped, which is usually enough to make the would-be crackers go away. iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --rttl --name SSH -j ...


5

Why allow root ssh access at all? Murphy's law would have it that the time you'll need root access you'll be away from your approved IP address. This is just my opinion but the better approach to this is to log in as a regular user and then su to root. To gain access to root someone would need both your user password and the root password. So you're ...



Only top voted, non community-wiki answers of a minimum length are eligible