Tag Info

Hot answers tagged

26

[Edit] I've since tested this the full release of Ubuntu 10.04 Server (21/May/2010). I've configured my Ubuntu 10.04 Server LTS residing on a windows network to authenticate logins using active directory, then mount a windows share to serve as there home directory. Here is what I did starting from the initial installation of Ubuntu. Download and install ...


24

If you remove the setuid bit from the passwd command, only root will be able to use it. This will also disable the users from changing the password before it expires - which could otherwise be a way for the users to extend the account for another four hours. [jenny@finch ~] sudo chmod -s /usr/bin/passwd [jenny@finch ~]$ passwd Changing password for user ...


21

Generally, password expiration is used to force users to change their passwords. What it sounds like you want to do is to lock the account, which prevents all login. What I would suggest you do instead is, when you create the account, also set up an at job which will lock the account after four hours. For example: useradd temp8143 echo chage -E 0 temp8143 ...


20

It's a security feature to slow down people who are trying to guess your password. It takes Ubuntu the same amount of time to see if it's correct or not, but then it waits for a few seconds before letting you try again.


17

You might be interested in fail2ban.


17

PAM is telling you that it is configured with "retry=3" and it will ignore any further auth requests from sshd within the same session. SSH however will continue trying until it exhausts MaxAuthTries setting (which defaults to 6). You should probably set both of these (SSH and PAM) to same value for maximum auth retries. Updated To change this behaviour: ...


14

While the other answers are correct in elimiating the error message you got, consider that this error message may just be a symptom of another underlying problem. You get these messages because there are many failing login attempts via ssh on your system. There may be someone trying to brute-force into your box (was the case when I got the same messages on ...


14

As Dentrasi has explained - this is to make it more difficult for the attacker to carry out a brute-force attack on the password store. In almost all circumstances, you don't to change this behavior. If you have a good reason to (which I can't think of), you can modify it via /etc/login.defs - See the login.defs(5) man page. FAIL_DELAY (number) Delay ...


12

A couple of things for you to try: Did you enable logging of debug messages in syslog? cp /etc/syslog.conf /etc/syslog.conf.original vi /etc/syslog.conf Add the following line: *.debug /var/log/debug.log Exit with :wq!. touch /var/log/debug.log service syslog restart You can enable debugging for all modules like so: touch /etc/pam_debug OR ...


11

You can do this in many ways. You can limit how many times a user can connect via SSH by using the pam_tally (better pam_tally2) module with something like auth required pam_tally.so deny=10 unlock_time=60 per_user which limits every user to 10 logins / minute. This is of course not blocking the connection to the SSH daemon in any way. To do ...


11

You don't need to actually make the user on the server2, only their home directory on first login. You're looking for pam_mkhomedir: http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_mkhomedir.html Google will find you many howtos and examples on getting this set up.


11

That's just cron running the cronjobs. It opens (and then closes) a PAM session for the appropriate user when it executes commands. Based on the timestamps, you have a cronjob which executes every minute.


9

I managed to fix this moments after posting the question. It turns out that the /etc/shadow entries for the affected MD5 password users had somehow had the field after the hashed password duplicated, causing PAM to be unable to interpret the line. In other words, a bad cut and paste job. I haven't had enough coffee...


9

The largest cause of sudo being slow is the system not being able to resolve it's own hostname. Do you have your local hostname included in /etc/hosts? If not I would recommend adding it with the IP 127.0.1.1 which is what I do on all my systems. I add the entry with both the short hostname and the full qualified domain name (FQDN). This then removes the ...


9

From my understanding, success=$num will specify how many rules to skip when successful. So in both cases, with either pam_unix.so or pam_winbind.so, they will skip to the final line. Of course, the final line permits access in all cases.


9

It helps to break things down like this in your head: NSS - A module based system for controlling how various OS-level databases are assembled in memory. This includes (but is not limited to) passwd, group, shadow (this is important to note), and hosts. UID lookups use the passwd database, and GID lookups use the group database. PAM - A module based system ...


8

After all that, it turns out to have been a one-character typo in /etc/shadow. Spot the difference: admin:!:15891:0:99999:7::: tbbscraper:!::15966:0:99999:7::: That's right, there are two colons after the exclamation point on the tbbscraper line. That shoves all the fields over one and makes PAM think that the account expired on January 8, 1970.


8

If you block all user even block root you can add this lines to /etc/pam.d/password-auth or /etc/pam.d/sshd, in the auth section add this to block all user for 5 minutes: auth required pam_tally2.so file=/var/log/tallylog deny=3 even_deny_root unlock_time=300 Now add the following line to the account section: account required ...


8

I tried to post this answer yesterday but the website was failing. Anyway I managed to solve this in a more elegant way. PAM has the ability to restrict access based on an access control list (at least on Ubuntu) which, like kubanskamac's answer (+1) regards the groups as posix groups, whether they're stored in LDAP, /etc/group or NIS. ...


8

Simply modify your /etc/ssh/sshd_config file; add MaxAuthTries 5 and restart sshd.


8

You can use pam_succeed_if in your /etc/pam.d/telnet or similar file: auth required pam_suceed_if.so user = ${telnet_user} quiet Where ${telnet_user} is the user allowed to use telnet. But, if you weren't aware, telnet is a Bad Thing. The allowed account's details can easily be sniffed and may enable other people to use the account. Really do you SSH if ...


8

I figured out that the system doesn't seem to like the wildcard for the user in limits.conf. Changing that to: root soft nofile 100000 and root hard nofile 100000 worked fine.


7

It looks like your /usr/sbin/sshd binary has been overwritten. This could mean you have had a security breach, or maybe someone just compiled a version locally and the Ubuntu version was overwritten. The 1:4.7p1-8ubuntu1.2 (x86) version of the openssh-server definitely is definitely linked against libpam. It is conceivable that the pam support was left out ...


7

You're probably quicker adding a shell script onto the end of /etc/profile file to do a group check then spit out a message Something like: #!/bin/bash # script at /usr/local/bin/motdcheck PGROUP=`groups|awk '{print $1}'` cat /etc/motd.${PGROUP} would run as a script which outputs a file named /etc/motd.groupname where groupname is the first group in the ...


7

You should be using sudo for this, not su. With sudo, you can specify NOPASSWD in /etc/sudoers: username ALL=/path/to/command NOPASSWD: ALL


7

htpasswd generates MD5 hashes in the Apache format, which you can verify by seeing that they start with $apr1$, but PAM only supports formats that your platform's implementation of crypt(3) implements. For Glibc, the equivalent (MD5-based) would be $1$. You just need to generate the passwords with a different tool. Here's an example: sh$ openssl passwd -1 ...


7

Yes, oauthtool can do this. You'll need to seed it with the shared secret from your server.


7

There is a PAM module called pam_exec - if you write a script which checks for and/or creates the ZFS volume, you can chain this into your existing PAM rules and keep things nice without assuming interactive login, default shells & skeleton directories, etc. For example, you could have session required pam_unix.so session required pam_exec.so ...


7

This excerpt was taken from amazing book written by Linux advocate Evi Nemeth( unfortunately recently lost in the sea http://www.theregister.co.uk/2013/07/05/evi_nemeth_unix_dead/ ) in her one of the first and best linux admin book: Linux® Administration Handbook. For this case it was in the second edition of the book, I am not sure if this was duplicated ...


6

Jul 29 03:53:15 u######## su: PAM adding faulty module: /lib64/security/pam_fprintd.so It looks like a bug: https://bugzilla.redhat.com/show_bug.cgi?id=505266 Install authconfig and try this: authconfig --disablefingerprint --update



Only top voted, non community-wiki answers of a minimum length are eligible