Tag Info

New answers tagged

0

As far as I know neither workgroup nor file_mode nor uid are valid mount option with a NFS mount. The supported mount options are typically listed in the system manual man 5 nfs. Remove that option from the volume definition and your error message should go away.


0

There is no excuse for having a server that will accept many failed login attempts from the same IP, or within a defined time period! That is just sloppy management. (Or, it could be argued, sloppy Linux server code. :-) I have some python scripts on my dedicated LAMP servers that does this, and more. I also have some IPTABLES entries that act much faster ...


1

So, after elevating the level of my google-fu, I found out about pamtester. It does everything I need, and it is available from the Ubuntu repositories (and I guess it is also available in other distros). The ubuntu package is simply called pamtester


1

Debian and Ubuntu (and maybe other distros) have a special log file into which all pam output is logged: /var/log/auth.log I've been struggling with a pam related problem for a day and a half, finally found out about this log file, and saved myself from insanity. Here's a sample of the contents of this file when things don't go as planned. Jul 10 ...


1

Rather than trying to loosen security with a group rule, I'd use the default security and tighten with group rules. Here's an example that requires 2factor authentication for users, but not sftp-users. # Only these groups can connect AllowGroups users sftp-users Match Group users RequiredAuthenticatios2 publickey,keyboard-interactive Match Group ...


0

You could implement this without much trouble, but it's a bad idea to do so. First, let's remember what PAM is: it's a system for handling user logins. Authentication, authorization, accounting, etc. So, where this proposal falls down is: It will slow down legitimate logins. Typically the slowdown will be imperceptible, as DNS lookups don't take that ...


1

I'm not aware of such a module. Your second question (why) is going to solicit answers that are primarily opinion based, as I cannot think of any definitive reasons for why such a PAM module couldn't exist. Below are the design considerations I identified when assessing feasibility: Speed: Must not stall logins to heck and back. ssh+PAM are already in in ...


3

While the other answers are correct in elimiating the error message you got, consider that this error message may just be a symptom of another underlying problem. You get these messages because there are many failing login attempts via ssh on your system. There may be someone trying to brute-force into your box (was the case when I got the same messages on ...


0

Okay, I found the solution for that one. First : I would strongly recommend anyone getting into this to study PAM modules basics. This really helps understanding the whole thing. Now, let's have a look at my common-* files. They all have the same structure : facility required pam_unix.so [...] facility sufficient pam_mysql.so [...] Now, after ...


1

I am more of a redhat guy myself but I've long wondered about a similar module. Good question. I haven't seen a module to handle this. As far as publishing software goes this may help. I never had good luck with the main repositories but rpmforge (now repoforge ) has some pretty easy going ways to get involved. See here. For debian / ubuntu I havent seen ...


1

What I recommend is to stagger your security solutions. Security is best implemented in Layers, and having one solutions means you will have a Single Point of Failure. Fail2Ban, as stated above by Jeff Ferland, is a good first step solution. It will monitor your log files for signs of a brute force attack, and can be configured to listen generally against ...


2

any error when connecting to an sshd is logged into /var/log/auth.log (in debian-based OS, or security in redhat-based systems) If it's not, set LogLevel VERBOSE in /etc/ssh/sshd_config and reload sshd. This will show you why sshd is refusing your connection next. That said, back to your fork-bomb limiter: docker machines are based on LXC, a container ...


1

It seems the above analysis is not completely correct. There doesn't seem to be a retry= option for pam authentication (I did find one for pam_cracklib, but that only concerns changing password in the "password" section, not authentication in the "auth" section of pam). Instead, pam_unix contains a builtin maximum number of retries of 3. After 3 retries, pam ...



Top 50 recent answers are included