Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

Filter by
Sorted by
Tagged with
-1
votes
0answers
25 views

How to use PAM and SSH to create user logins and home directories on demand? [closed]

I want to create a new user on a host on successful authentication via SSH authorized keys (via AuthorizedKeysCommand) and then create a home directory for the user. I have seen questions like ...
0
votes
0answers
18 views

Multi-layer authentication for nginx reverse proxy server

I am writing a configurable reverse proxy server with nginx and I am running into an issue with upstream servers when it comes to authentication. Each reverse proxy has a single layer of pam ...
0
votes
1answer
16 views

sshd fails to login user

I could not ssh into one of my servers this morning after successfully doing so most recently yesterday. ssh hostname Connection closed by hostname port 22 I rebooted system and it did not fix the ...
0
votes
0answers
16 views

Pam_unix sshd authentication failure even though the login works?

I have a server that is configured with winbind and samba to provide active directory authentication. The active directory integration works fine however whenever I authenticate I see the following ...
0
votes
0answers
25 views

Setting up google-authenticator-libpam (TOTP/HOTP) for authentication in combination with pam-mysql for vsftpd

I have a setup in which virtual users for vsftpd (latest, 3.0.3) are authenticated against a MySQL database using pam-MySQL[1]. This works perfectly fine, configured like this: auth required /lib/...
0
votes
2answers
53 views

Determine if Linux account locked when SELinux protects shadow

I am trying to run a script which gets the username of every locked account on a Linux system. The server is a Gentoo Hardened Server with SELinux. I tried by writing some Python which looks in /...
0
votes
0answers
9 views

change in duration for failed login attempt by setting pam_faildelay.so delay is not taking effect

I have changed the delay value using "pam_faildelay.so delay" but the delay which I added 300 ms is not taking effect. For failed login attempts still I can see 2 seconds delay. Below is rule which I ...
0
votes
0answers
21 views

FreeRADIUS + PAM + Google Authenticator + PBIS-Open Bypass by Group

I'm setting up a 2FA server to authenticate users for a VMware Horizon View system from a Microsoft AD using Ubuntu Server 20.04 with FreeRADIUS 3.0, libpam-google-authenticator and PBIS-Open for ...
1
vote
0answers
114 views

PAM: password authentication failed for remote user

I am executing a command from server1 which would do a remote ssh to server2 and execute certain commands as olcne user. I am seeing some exception in /var/log/secure file wrt to pam. Can someone ...
0
votes
0answers
42 views

How to configure PAM to authenticate SSH logins with (password & OTP) or (public key & OTP)

My goal is to develop an ansible playbook to deploy multifactor ssh logins of the type (public key and OTP) or (password and OTP) on Ubuntu Server 18.04 hosts. I followed the guide here and it ...
1
vote
0answers
115 views

Cannot change password on ESXi 6.7 after modifiying “Security.PasswordQualityControl”

See edit below for a workaround and possible explanation According to the VMware documentation (as well as the documentation for pam_passwdqc) I should be able edit the Security....
0
votes
0answers
41 views

Kerberos SSO / Delegation with Apache and PAM

I would like Apache's mod_gssapi to create / delegate a Kerberos Ticket inside a linux server in order to connect to a "downstream" database. I have a linux server that I integrated into an Active ...
0
votes
1answer
68 views

Use ssh agent forward and libpam-ssh to connect to a specific user on server without password

I am trying to achieve to setup. I can connect to my server to user A using RSA key with ssh. But i can't figure out how to forward agent to use with libpam-ssh. The goal is to make passwordless ...
2
votes
1answer
159 views

pam_unix generates a lot of open/close sessions for my domain user

I setup a new VPS with ubuntu 18.04, including virtualmin/usermin. In auth.log I see a lot of su[12936]: Successful su for domain by root su[12936]: + ??? root:domain systemd-logind[148]: New ...
0
votes
0answers
39 views

How can I force users to update an expired (ppolicy) password when they log in with SSH keys?

OpenLDAP server is Ubuntu 18.04 running slapd package version 2.4.45+dfsg-1ubuntu1.4 Client is Ubuntu 18.04 using sssd 1.16.1-1ubuntu1.4 with an LDAP backend. I am not using SSH public keys within ...
0
votes
0answers
38 views

LDAP with pam_access.so blocking package updates

I have a set of ~10 servers using LDAP to control accounts. We further use /etc/security/access.conf with pam_access.so to control which groups access which servers. Very occasionally when I run apt ...
0
votes
1answer
86 views

Linux PAM authentication without asking for username and password

Is it possible to authenticate user without asking him to provide username/password and using only "second factor", i.e USB drive or fingerprint device? The idea is that I just want to insert the ...
1
vote
1answer
56 views

Add a second /etc/passwd + /etc/shadow + /etc/group combination

Is it possible to add a second /etc/passwd + /etc/shadow + /etc/group combination like this to a linux system? /etc/passwd /etc/passwd2 /etc/shadow /etc/shadow2 /etc/group /etc/group2 During ...
1
vote
1answer
140 views

Echo something before SSH prompt with pam_exec

I want to echo some text from a pam_exec script after a successful SSH login (pubkey) but before the script itself exits (2FA purposes). Whatever the script prints during its execution is displayed ...
0
votes
0answers
81 views

How to use pam_echo.so in /etc/pam.d/sudo

I want to be able to echo a simple message in between password authentication and yubikey challenge response authentication when using sudo. I've tried multiple ways to do it, such as pam_echo.so and ...
0
votes
1answer
128 views

Debian add a new PAM module and require it even if password authentication is failed?

I have these lines in /etc/pam.d/sshd: # PAM configuration for the Secure Shell service # Standard Un*x authentication. @include common-auth # Disallow non-root logins when /etc/nologin exists. ...
1
vote
0answers
134 views

Why all users are uid=0 when connecting through SSH?

I was testing some pam rules and I noticed that all users has uid=0 (root) when they log in to the system through SSH. Could be a reason that sshd starts automatically when the server boots up? How to ...
0
votes
1answer
94 views

Login limited to a LDAP group using SSD and Kerberos

I'm trying to learn how PAM, SSSD and nsswitch works. I think these services are so useful although all the documentation over there is a little bit outdated and "esoteric". So I'm here asking for ...
0
votes
0answers
43 views

Using pam_access for VSFTPD virtual users

I tried to use the solution mentioned in https://stackoverflow.com/questions/4047115/vsftpd-per-user-ip-filtering-for-vitrual-users but it didn't work for me unfortunately. As soon as I enable ...
0
votes
0answers
71 views

Installation failing when installing PAM via PECL

I've been setting up Roundcube on Debian 10 with PHP 7.3, and so far everything has been alright. However, I'm using PAM for the email database, and when trying to install the password plugin I ...
0
votes
2answers
613 views

UsePAM not supported anymore

Running on an alpine docker image an SSH server. Starting the server I get the message: /etc/ssh/sshd_config line 24: Unsupported option UsePAM AFAIK UsePAM option has been supported for many years ...
0
votes
0answers
494 views

postfix+saslauthd+pam_mysql adds EOL to passwords, thus breaks

I'm trying to use the pam_mysql module in conjunction with postfix and saslauthd. Everything appears to be working, except the actual password comparison is failing. Note: the case being tested is ...
0
votes
0answers
99 views

Postgres/PAM/SSSD “Authentication Failed” followed by “connection authorized”

Previously I've been using LDAP authentication with postgres, but now as a result of security improvements all the machines are domain-joined via SSSD, and this is a great opportunity to get another ...
0
votes
1answer
603 views

Authenticate Samba against OpenLDAP

I am trying to setup Samba fileshares on an Ubuntu 19.04 system using an existing LDAP-Server as authentication backend. What I have: A fully operational OpenLDAP server containing all user and group ...
0
votes
0answers
251 views

Custom pam auth module is causing login prompt to not enforce password

We have a custom pam module to authenticate our own users outside of linux. We have the module registered with the sshd and login pam files. Sshd works fine, but for some reason when doing a local ...
0
votes
1answer
106 views

Logins doesn't work with PAM/NSS

I have a computer room that uses libpam-pgsql and libnss-pgsql2 for users authentication. Right now, the system is working perfectly with Debian 8 clients. I want to upgrade and I am trying to setup ...
0
votes
0answers
114 views

PAM for php 7.2 and Horde

In a VPS server I installed LAMP and Webmin/virtualmin. The default php version is 5.6 I also installed v7.2 Stuff at /opt/rh/rh-php72 In a virtual host I installed Horde webmail under php7.2 Test is ...
0
votes
0answers
65 views

sudo cron -l -u otheruser gives authentication error CentOS-6.10

CentOS-6.10 I have never run into this before: sudo crontab -l -u thatuser [sudo] password for thisuser: Authentication service cannot retrieve authentication info You (thatuser) are not allowed ...
1
vote
1answer
63 views

PAM authentication hangs because of incorrect DNS settings but who is even triggering this lookup?

Recently I ran into the issue that an application which is performing PAM authentication was hanging for up to 20 seconds before it reported whether PAM authentication was successful or not. Other ...
0
votes
1answer
59 views

Can't authenticate against a 389DS server. I suspect it's a SSSD issue on client side

I'm running a 389DS LDAPS server (with self-signed certificates) on a Fedora 30 remote machine called "miservidor.midominio.local". There I have a typical directory containing user and group entries. ...
2
votes
2answers
314 views

PAM dynamic LDAP Authorization with groups

At the moment my PAM is integrated through LDAP with a custom authentication stack in the /etc/pam.d/systhem-auth: auth required pam_env.so auth required pam_faildelay.so ...
1
vote
0answers
246 views

PAM accepting any current password when changing LDAP password

I have a Centos-7.6 system, using PAM to authenticate LDAP users. I've managed to force an LDAP user to change their password, by setting shadowLastChange to 0, so their password must be changed. But ...
1
vote
0answers
215 views

Maldet having problems with systemctl

Trying to start maldet daemon. Following shows up: "Job for maldet.service failed because the service did not take the steps required by its unit configuration." I have configured the 'maldetect/...
0
votes
0answers
90 views

Dovecot + pam ldap authentication

Im trying to authenticate my mail virtual user's by dovecot through LDAP but i want to use PAM to do it instead of dovecot-ldap ( wanna use pam_cas module later on ). I setup everything but my problem ...
1
vote
2answers
222 views

Cannot Use CURL on /etc/pam.d/sshd

I am creating a script that doing cURL everytime SSH login happens. I inserted a new line in /etc/pam.d/sshd like this: auth required pam_exec.so /bin/curl.sh and my curl script is like ...
0
votes
0answers
28 views

PAM Advanced Syntax (pam_rootok) not working as expected

I'm just experimenting with PAM and SSH. Keep in mind the OpenSSH server had a default profile, if you modify it, you will risk the security of your system! So I made an another sshd PAM profile for ...
0
votes
0answers
32 views

pam_access not matching user in access.conf

I need to modify the PAM stack so that a user listed in access.conf will be authorized. Here is the relevant portion of access.conf: +:newuser@ourdomain:ALL I also added the following line to the ...
0
votes
0answers
233 views

“pam_mount.conf.xml” only mounts first volume

I'm using pam_mount to mount home directories and other volumes at login (Ubuntu 18 client, Ubuntu 14 file server.) It works, but only for the first listed volume. The second volume does not even ...
1
vote
2answers
80 views

Try LDAP Authentication before local authentication

I've setup a LDAP system in my local network (CentOS7) and it seems to work as expected. Now I've created a user in LDAP whose username is exact the same as the username of an already existing local ...
0
votes
0answers
74 views

pam_mkhomedir silently failing in Ubuntu 18

I'm attempting to set up a workstation Ubuntu machine for use in our domain. Everything we need is working quite well (sssd is configured and the net ads join worked fine). I can authenticate using ...
0
votes
0answers
81 views

2FA with Public Key Authentication and Password for SSH with PAM Support (pam_duo)

I have followed this link: https://duo.com/docs/duounix on how to setup DUO 2FA with Public Key Authentication. Is there a way to also add Password Authentication to it so that Users who decide to use ...
0
votes
0answers
233 views

pam_radius_auth with pam_script creates user but first authentication fails

on a CentOS 7 server I have a successfully working pam_radius_auth (installed from epel). I can authenticate on a windows NPS radius but only if the user already exists. In /etc/pam_radius.conf I ...
1
vote
1answer
416 views

How to create conditional behaviour with pam_exec and PAM_TYPE?

I want to implement conditions for PAM_TYPE open_session and close_session. With this I can trigger different actions at different times for login and logout. I have a script which tests for the ...
1
vote
1answer
211 views

pam_userdb could not open database

In trying to set up vsftpd to use virtual users I hit this problem. I created a database file: db_load -T -t hash -f users.txt /etc/vsftpd/users.db And /etc/pam.d/vsftpd: session optional ...
2
votes
0answers
195 views

Must `kinit` user's ticket manually before PAM can mount SMB home directory at login

Ubuntu 14.04 file server Ubuntu 14 Active directory (AD) server running Samba 4 Ubuntu 18 client (fresh install) I've configured for Ubuntu user home directories to be mounted via PAM and SMB/CIFS. ...

1
2 3 4 5
14