Tag Info

Hot answers tagged

24

[Edit] I've since tested this the full release of Ubuntu 10.04 Server (21/May/2010). I've configured my Ubuntu 10.04 Server LTS residing on a windows network to authenticate logins using active directory, then mount a windows share to serve as there home directory. Here is what I did starting from the initial installation of Ubuntu. Download and install ...


20

It's a security feature to slow down people who are trying to guess your password. It takes Ubuntu the same amount of time to see if it's correct or not, but then it waits for a few seconds before letting you try again.


14

As Dentrasi has explained - this is to make it more difficult for the attacker to carry out a brute-force attack on the password store. In almost all circumstances, you don't to change this behavior. If you have a good reason to (which I can't think of), you can modify it via /etc/login.defs - See the login.defs(5) man page. FAIL_DELAY (number) Delay ...


12

You might be interested in fail2ban.


11

You can do this in many ways. You can limit how many times a user can connect via SSH by using the pam_tally (better pam_tally2) module with something like auth required pam_tally.so deny=10 unlock_time=60 per_user which limits every user to 10 logins / minute. This is of course not blocking the connection to the SSH daemon in any way. To do ...


10

You don't need to actually make the user on the server2, only their home directory on first login. You're looking for pam_mkhomedir: http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_mkhomedir.html Google will find you many howtos and examples on getting this set up.


9

That's just cron running the cronjobs. It opens (and then closes) a PAM session for the appropriate user when it executes commands. Based on the timestamps, you have a cronjob which executes every minute.


8

A couple of things for you to try: Did you enable logging of debug messages in syslog? cp /etc/syslog.conf /etc/syslog.conf.original vi /etc/syslog.conf Add the following line: *.debug /var/log/debug.log Exit with :wq!. touch /var/log/debug.log service syslog restart You can enable debugging for all modules like so: touch /etc/pam_debug OR ...


8

Simply modify your /etc/ssh/sshd_config file; add MaxAuthTries 5 and restart sshd.


8

You can use pam_succeed_if in your /etc/pam.d/telnet or similar file: auth required pam_suceed_if.so user = ${telnet_user} quiet Where ${telnet_user} is the user allowed to use telnet. But, if you weren't aware, telnet is a Bad Thing. The allowed account's details can easily be sniffed and may enable other people to use the account. Really do you SSH if ...


7

You're probably quicker adding a shell script onto the end of /etc/profile file to do a group check then spit out a message Something like: #!/bin/bash # script at /usr/local/bin/motdcheck PGROUP=`groups|awk '{print $1}'` cat /etc/motd.${PGROUP} would run as a script which outputs a file named /etc/motd.groupname where groupname is the first group in the ...


7

Why allow root ssh access at all? Murphy's law would have it that the time you'll need root access you'll be away from your approved IP address. This is just my opinion but the better approach to this is to log in as a regular user and then su to root. To gain access to root someone would need both your user password and the root password. So you're ...


7

You should be using sudo for this, not su. With sudo, you can specify NOPASSWD in /etc/sudoers: username ALL=/path/to/command NOPASSWD: ALL


7

It looks like your /usr/sbin/sshd binary has been overwritten. This could mean you have had a security breach, or maybe someone just compiled a version locally and the Ubuntu version was overwritten. The 1:4.7p1-8ubuntu1.2 (x86) version of the openssh-server definitely is definitely linked against libpam. It is conceivable that the pam support was left out ...


7

I figured out that the system doesn't seem to like the wildcard for the user in limits.conf. Changing that to: root soft nofile 100000 and root hard nofile 100000 worked fine.


7

There is a PAM module called pam_exec - if you write a script which checks for and/or creates the ZFS volume, you can chain this into your existing PAM rules and keep things nice without assuming interactive login, default shells & skeleton directories, etc. For example, you could have session required pam_unix.so session required pam_exec.so ...


7

I managed to fix this moments after posting the question. It turns out that the /etc/shadow entries for the affected MD5 password users had somehow had the field after the hashed password duplicated, causing PAM to be unable to interpret the line. In other words, a bad cut and paste job. I haven't had enough coffee...


7

If you block all user even block root you can add this lines to /etc/pam.d/password-auth or /etc/pam.d/sshd, in the auth section add this to block all user for 5 minutes: auth required pam_tally2.so file=/var/log/tallylog deny=3 even_deny_root unlock_time=300 Now add the following line to the account section: account required ...


6

Yes, oauthtool can do this. You'll need to seed it with the shared secret from your server.


6

The /etc/pam.d/system-auth file is used by Red-Hat and like systems to group together common security policies. It is often included in other /etc/pam.d policy files where those common policies are required. When accessing a system via ssh through sshd the /etc.pam.d/sshd policy file is consulted. This file includes /etc/pam.d/system-auth so your changes to ...


6

Yes, you can use the pam_echo plugin: auth required pam_unix.so auth optional pam_echo.so file=/etc/ssh/password_banner.txt This should produce the pam_echo output after password login. See http://www.linux-pam.org/Linux-PAM-html/sag-pam_echo.html for docs. Edit: You'll also need to make sure you have UsePAM yes in your sshd_config. Replaced password ...


6

Not for local users on ESXi, but you can LDAP integrate vCentre to allow management. EDIT - ESXi 4.1 can now authenticate directly with LDAP/AD.


6

From my understanding, success=$num will specify how many rules to skip when successful. So in both cases, with either pam_unix.so or pam_winbind.so, they will skip to the final line. Of course, the final line permits access in all cases.


5

I tried to post this answer yesterday but the website was failing. Anyway I managed to solve this in a more elegant way. PAM has the ability to restrict access based on an access control list (at least on Ubuntu) which, like kubanskamac's answer (+1) regards the groups as posix groups, whether they're stored in LDAP, /etc/group or NIS. ...


5

I use an iptables rule that limits SSH connections to no more than 10 per minute. After 10 connections (or attempts), new incoming connections from that IP are dropped, which is usually enough to make the would-be crackers go away. iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --rttl --name SSH -j ...


5

The largest cause of sudo being slow is the system not being able to resolve it's own hostname. Do you have your local hostname included in /etc/hosts? If not I would recommend adding it with the IP 127.0.1.1 which is what I do on all my systems. I add the entry with both the short hostname and the full qualified domain name (FQDN). This then removes the ...


5

You want system-auth. It is a "generic" set of PAM parameters used by (typically) all services on the system. The login service is used by (unsurprisingly) the /bin/login program (which is invoked for logins to virtual consoles only). If you add that line to /etc/pam.d/login, then only password changes initiated by the login program would have the ...


5

If you read the pam.d manpage, more about what can be done inside the [ ] is explained in there. success=2 means that if this particular authentication is successful, the next two items in that file will be skipped over. default=ignore basically means to ignore any and all failures. They won't be a successful auth, but neither will they cause ...


5

I agree with Michael Hampton's comments - you can and should use Kerberos to do this. But if you do want to do it by changing things on the local machine, here's a solution that should work. In your sshd_config, add the line DenyGroups blocked Create a group named "blocked". When locking a user's local password, also add them to the group "blocked". ...


5

This excerpt was taken from amazing book written by Linux advocate Evi Nemeth( unfortunately recently lost in the sea http://www.theregister.co.uk/2013/07/05/evi_nemeth_unix_dead/ ) in her one of the first and best linux admin book: Linux® Administration Handbook. For this case it was in the second edition of the book, I am not sure if this was duplicated ...



Only top voted, non community-wiki answers of a minimum length are eligible