Tag Info

New answers tagged

2

The homedir should be created in the path for the homedir specified in the users entry in /etc/passwd (or other similar account sources like an LDAP directory). Did you try to change that? This entry is the authoritative declaration of where the users homedir is (and should be created).


21

Generally, password expiration is used to force users to change their passwords. What it sounds like you want to do is to lock the account, which prevents all login. What I would suggest you do instead is, when you create the account, also set up an at job which will lock the account after four hours. For example: useradd temp8143 echo chage -E 0 temp8143 ...


24

If you remove the setuid bit from the passwd command, only root will be able to use it. This will also disable the users from changing the password before it expires - which could otherwise be a way for the users to extend the account for another four hours. [jenny@finch ~] sudo chmod -s /usr/bin/passwd [jenny@finch ~]$ passwd Changing password for user ...


0

I recently had to perform a PCI audit of a very similar nature (who can log in to these systems and what are their permissions), so have a good feel for what you're trying to accomplish here. The methodology varies from environment to environment depending on how PAM and LDAP are configured. The following factors seem to apply to your environment: The ...


0

First export your users to a file on wood - pdbedit -e smbpasswd:/tmp/sambausers.bak Then import users to to stone - pdbedit -i smbpasswd:/tmp/sambauses.bak


0

I just had a similar problem, and the problem was with my putty settings. Every time I logged into the server, the pam_tally2 would get incremented, even when logging in "normally" (that is, by entering my password). My Putty settings were set to attempt the connection by using a private/public key, that failing (because the destination server did not have ...


0

Can you give your entire pam config file ? If you use pam_deny.so after pam_unix.so you have to change your config to: auth [success=1 default=ignore] pam_unix.so use_first_pass It specify that the next line must be skipped if the module return success. The entire config for auth: auth requisite pam_google_authenticator.so forward_pass auth ...


0

Simply use `pam_check_host_attr yes` pam_check_host_attr to yes in /etc/pam_ldap.conf file. Man page: # Check the 'host' attribute for access control # Default is no; if set to yes, and user has no # value for the host attribute, and pam_ldap is # configured for account management (authorization) # then the user will not be allowed to login.


2

Yes, there is logic for being able to skip over arbitrary numbers of lines. There are no "grouping brackets" or anything of the sort, but if you combine the logic that you just mentioned with the ability to skip over lines, you can selectively exclude behavior. Here's an example from my personal server: # Skip Google authenticator check if they're coming ...


0

Policies on the LDAP server don't necessarily equate to policies within the OS. You seem to be picturing a framework where you set this overflay property and the OS becomes aware of the need for a password change, but as you can see that's not how it works. To trigger a prompt within the operating system, an accounting module (typically PAM) has to notice ...


2

I found the solution to the problem. By running sssd -i -d 4 and trying to log in on a different console, I saw that START TLS was where the login failed. Apparently Red Hat and Fedora by default use TLS. The server does not have TLS (we don't have enough time right now). To disable TLS edit /etc/sysconfig/authconfig on the client machine and update ...


0

You can read/set the resource limits of a running process with prlimit(1), part of util-linux: sudo prlimit --pid PID --nofile 8192:16384



Top 50 recent answers are included