Skip to main content

Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

Why is FreeIPA HBAC rule not enforced for sudo

Using FreeIPA on RHEL 9, I have both sudo rules configured and an HBAC rule. The HBAC rules are there to disable all access to certain accounts on some machines. I can test those with, e.g.: ipa ...
okapi's user avatar
  • 152
0 votes
1 answer
68 views

google-autenticator openvpn not working pam?

Hy All. I have been struggling with google-authenticator + pam.. Ubuntu 24.04 openvpn2.6.9-1ubuntu4 amd64. server.conf .... plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so "openvpn login ...
Paulo Ricardo Bruck's user avatar
0 votes
0 answers
130 views

What is function of 'account required pam_faillock.so'?

I check pam configuration in /etc/pam.d/system-auth and /etc/pam.d/password-auth and I found line 'auth required pam_faillock.so'. In some article that I read, if you want to set faillock you need ...
M. Fachrizal Utama's user avatar
0 votes
1 answer
56 views

Is there a security issue or downside with using pam_succeed_if to enable automatic login?

Consider adding a line auth succeed pam_succeed_if.so tty = /dev/ttyS0 to /etc/pam.d/login before @include common-auth. The desired effect would be password-less login via /dev/ttyS0 for root (but it ...
Helmut Grohne's user avatar
0 votes
0 answers
54 views

pam.d with MFA skips public-key authentication

I have a pam.d configuration with MFA authentication on a test server. I noticed that the IP addresses that are in file access-without-MFA.conf mentioned, can login without password and without ...
Andrew_ram's user avatar
1 vote
0 answers
118 views

Domain user has different umask than expected

I have a network domain with multiple users managed by LDAP and Kerberos. I'm managing the default umask via pam.d, in my /etc/pam.d/common-session with the line: session optional pam_umask.so ...
tdpu's user avatar
  • 111
0 votes
0 answers
54 views

pam_unix logs: xrdp-sesman:session session opened for user USERNAME(uid) by (uid=0)

recently I found a lot of these type of logs: pam_unix(xrdp-sesman:session): session opened for user username(uid=some_uid) by (uid=0) From what I read is xrdp-sesmam-session that is "opening&...
res1's user avatar
  • 125
0 votes
0 answers
427 views

Disabling Password Login for Root User via PAM on Ubuntu Server

I have a Ubuntu Server (Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-1049-oracle aarch64) specfically), Where I am hosting a few projects, I am somewhat novice in the sysadmin space, but know some basics for ...
4g0tt3nSou1's user avatar
0 votes
1 answer
1k views

Keycloak Integration with a Linux Server

I've set up a Keycloak server and I'm working on integrating it with a Linux server to allow users from Keycloak to authenticate into the Linux server using their Keycloak credentials. Ideally, I'd ...
Tisighe Livinstone's user avatar
0 votes
1 answer
209 views

Postfix - SASL Cyrus saslauthd authentication failed

Goal: Configure smtpd to authenticate connections by using postfix, cyrus, saslauthd, pam and mysql. Investigation Authentication via courier-pop3 & courier-imap using mysql works saslauthd ...
Mathew's user avatar
  • 1
0 votes
0 answers
157 views

Unable to connect via SSH or access NFS exports

This one has me puzzled, I've got a home server (Debian Bookworm) and several Raspberry Pi machines, also all running Raspbian Bookworm. Just for illustrative purposes ServerA Debian Bookworm PI1, ...
John Tetreault's user avatar
0 votes
0 answers
176 views

Debian 12 Use Yubikey OR Password for sudo authentication

Using Debian12 Hi I want to know if I can use Yubikey OR Password for sudo authentication. So basically if I do sudo date I want to immediately get a prompt for the password but at the same time be ...
Viktor Carlson's user avatar
0 votes
0 answers
44 views

Different results for NSS depending on where the user is logged in

When I call getpwuid it returns data from where NSS told it. In a PAM enabled system, we can authenticate a user logged in from console differently with a user logged in via ssh, but with NSS it is ...
SAMPro's user avatar
  • 117
0 votes
0 answers
157 views

Multiuser SMB Mount on Red Hat: Users Seeing Each Other's Folders Despite Separate cifscreds

We are attempting to mount a Windows file system on a Red Hat 9 machine. This Windows file system contains hundreds of accounts with finely tuned access rights. We are trying to implement the ...
Vincent Guyader's user avatar
0 votes
1 answer
110 views

Forbid characters in Ubuntu password

How can I forbid an user to set a password with e.g. the german Umlaut characters äöüÄÜÖß on a Ubuntu 22.04 ? Even the non-Ubuntu pam regex module can only regex on usernames and not on passwords.
der_wolle's user avatar
  • 193
0 votes
0 answers
33 views

Different LDAP Filters for Separate Services in SSSD

I'd like to use LDAP in SSSD for two separate services on the same server. Specifically, I'd like to use one LDAP group for SSH access and a separate LDAP group for access to a web portal. It only ...
Jonathan's user avatar
0 votes
1 answer
255 views

After run sudo and/or su or su - command, the command prompt not loaded, however the switch user is successful

I saw a maybe similar thread but not sure there the issue is the same: su command not responding? I have an Ubuntu 20.04 LTS baremetal server. After run sudo and/or su or su - command, the command ...
Badb0y's user avatar
  • 115
0 votes
1 answer
285 views

Cannot passwd for root with nslcd and openldap on Debian 12

Fresh Debian 12 for lab (VM). I installed: slapd, phpldapadmin, nslcd, nscd and dependencies. I have two local accounts: root and user1. Also I have only user1 POSIX-account on local LDAP server. I ...
Karol's user avatar
  • 21
0 votes
0 answers
225 views

sudo su - has a 5 minute delay should I pop back to original use

We are working with ROcky linux 8.6 - when we type sudo su - we are prompted for login and we get to root user no problem. if we type exit we go back to the original user as is expected. If we type ...
Michael Levine's user avatar
0 votes
1 answer
82 views

How change temporary primary group for user when user connect to samba?

I have samba connected via Winbind to AD. Historically, all unix enabled users has wrong primary group. May I change while user connected to samba primary group to one of the users secondary? It could ...
Oleg Zagrebelsky's user avatar
0 votes
0 answers
32 views

avoid leaking info whether the user is denied access or typed the incorrect password

I am currently tinkering with the sshd_config and /etc/security/access.d for a large system with 10k+ users. There are so many different ways of restricting user access and it makes my head spin a bit ...
N3buchadnezzar's user avatar
0 votes
1 answer
1k views

Refresh kerberos ticket instead of prompting for pam password

Using centralised auth against FreeIPA is working great. In order to use Kerberos SSO when using ssh, scp etc from jumphosts users must initiate their Kerberos tickets first with kinit. I've added ...
dmgeurts's user avatar
1 vote
0 answers
242 views

Using shadow password from LDAP while using SSSD for identity

I'd like to use SSSD ldap as a provider for shadow entries. It seems to be supported, given the default config with sssd installed adds sss to both passwd and shadow in nsswitch.conf, but I can't get ...
viraptor's user avatar
  • 1,176
0 votes
0 answers
2k views

Unable to login via SSH to a Linux machine with my LDAP credentials

I am trying to setup LDAP for users to login to Linux machines. I can change the users to any given users in the LDAP list of users using the su command. A new directory is created as well. So I'm ...
mikey1996's user avatar
1 vote
1 answer
219 views

OpenLDAP ppolicy working with passwd, but not ldappasswd

I've been working on this for about a week, and can't seem to figure out why this is happening. I've got passwd working, letting users change their own ldap password from a client machine, and it ...
zmehall's user avatar
  • 115
1 vote
0 answers
194 views

Can't authorise commands via tacacs+ server executed in shell by ssh

I've setup a tacacs+ server and a PAM tacacs client from here- https://github.com/kravietz/pam_tacplus/tree/main. When user ssh into the tacacs client machine, I want authentication from tacacs+ ...
Faisal Alam's user avatar
1 vote
2 answers
731 views

pam: reducing auth method timeout

I have set up user fingerprint auth on Fedora 37 laptops. With fingerprint auth as default auth choice, pam is waiting by default for 10 seconds for a valid fingerprint. Now, I would like to reduce ...
THX's user avatar
  • 263
0 votes
2 answers
715 views

OpenVPN + PAM + Freeradius

Situation: I have fully configured and working Freeradius server. Installed OVPN 2.6.4 on other server. And goal is auth through Radius. Installed pam-radius-auth. Configured (confs below). ...
Comandante's user avatar
0 votes
1 answer
1k views

Trouble with password rules in Linux-PAM

Ubuntu 20.04. I've installed pam_pwquality.so. Here's the contents of /opt/pam.d/common-password: password required pam_pwquality.so retry=1 minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 ...
fr0's user avatar
  • 101
0 votes
0 answers
296 views

Redhat Linux 8.5: Upgrading to OpenSSH 9.2 sees '/bin/bash: Permission denied' with root login

After successfully make-installed OpenSSH from source followed detailed instructions from a post of online community (version checked ok), only to see /bin/bash: Permission denied at root login. ...
Xiaoyu Zou's user avatar
1 vote
0 answers
324 views

How to setup pam on debian 11

I have installed debian 11 and pam-ldapd. Now, I want to setup authenticating for openvpn with pam. When I wanted to test it with 'getent passwd' command, I got only local users response. Can you help ...
Dave's user avatar
  • 35
0 votes
0 answers
163 views

vsftpd with MySQL 8 - login not working

I try to set up vsftpd using MySQL database for login users via pam.d I have this config in /etc/pam.d/vsftpd: # Standard behaviour for ftpd(8). auth required pam_listfile.so item=user sense=...
netdjw's user avatar
  • 121
0 votes
1 answer
803 views

Dovecot auth-worker logs fails but log in works

Everytime a log in occurs I get three log lines: Mar 19 15:29:05 auth-worker(6379): Info: pam([email protected],124.1.1.1,<AL/fkjf3yr98xTrl>): pam_authenticate() failed: Authentication failure (...
Grandmaster Og's user avatar
1 vote
0 answers
418 views

how to use PAM auth for ssh key clients?

How to unlock ssh private keys with PAM, so I can use fingerprintd module? There are many questions here discussing PAM and kerberos for sshd auth, but I can't find anything on the client side. Also, ...
gcb's user avatar
  • 112
0 votes
1 answer
869 views

Best practices to completely disable LDAP users' access to mixed services with mixed authentication methods?

Background We use LDAP in our department to authenticate users to various services including web apps as well as Linux servers (via SSH).  When a user leaves the department, we should disable their ...
AGI-Chandler's user avatar
0 votes
0 answers
103 views

Add Ansible Template as RPC dependancy for Privilege Vault/Secret Server

We're running Delinea/Thycotic Privilege Vault in our environment. We're trying to onboard all credentials into Privilege Vault as much as possible, so that we can leverage Auto-Change, where the ...
user1913559's user avatar
1 vote
2 answers
776 views

What did Oracle Cloud do, so I could sudo without password on SSH session?

I noticed that Oracle Cloud's pre-generated key pair could login into Linux server without password, and sudo without password, too. I can't reproduce this situation anywhere else I known. The ...
TragicLife's user avatar
0 votes
0 answers
2k views

nss_ldap failed to bind to LDAP server

i have configured ldap client (ubuntu 20.04) with nss_ldap to connect on ldap server and accept users in a specific group, it seems that everything is working fine, the client can access the ldap ...
Khloud Mostafa's user avatar
0 votes
1 answer
337 views

PAM deems Kerberos password as expired

I run Kerberos / LDAP authentication in a small network for years. Kerberos is held in LDAP, which in turn is replicated to another site. Machines at the second site authenticate to the replica, the ...
Lars Hanke's user avatar
1 vote
0 answers
885 views

Cron not working after pam customization to check groups

I need help with a PAM configuration. I've a Debian 11.5 machine with kerberos connected to an MS AD server. I want to configure the machine in order to allow some AD user to login, filtering them by ...
Lorenzo Sorace's user avatar
0 votes
0 answers
1k views

sssd/ldap does not authenticate against LDAP

I have configured SSSD with AD as ID and Auth providers. I am not caching credentials, so I expect connections to AD for authentication when I ssh to the host, but I do not see any. The user account ...
user2634153's user avatar
0 votes
2 answers
482 views

OTP before password with pam_radius and NPS

I have successfully configured pam_radius on a Ubuntu client so that users are asked for an OTP. The radius server is an NPS with Azure MFA extension. The OTP is checked against Azure. It works well, ...
francisaugusto's user avatar
1 vote
0 answers
136 views

PAM "remember me" with timeout option for 2FA?

Is it possible for PAM to remember that a second factor authentication has passed for a short period of time, e.g. an hour? This would have to be keyed to a user and IP address. For example: Log in ...
gak's user avatar
  • 743
2 votes
3 answers
662 views

Restrict Samba4 authentication by user + VPN IP address pair

We're working towards a zero trust security model in our office, with servers secured behind a WireGuard VPN. We already use WireGuard for remote access, so this is the simplest way to ensure ...
Roger Dueck's user avatar
1 vote
1 answer
2k views

Use pam_exec to run a script on an ssh login event

I'm trying out linuxserver.io openssh-server. Its a lightweight openssh image and makes it easy to configure with public key and user name. If I run it, ssh with public key auth, works as expected: $ ...
doughgle's user avatar
  • 119
2 votes
0 answers
433 views

PAM configuration popup yes or no for answer? after sudo apt install software-properties-common

I was trying to install the latest php version and after a command not found I googled it and they say to use the following command ''sudo apt install software-properties-common'' After doing this I ...
Peter Tremblay's user avatar
0 votes
1 answer
396 views

Remote ssh login does not respect pam umask

My server is on Ubuntu 22.04.1, and recently I discovered that the result of the umask command is 0002 instead of 0022 in an SSH session (non-root), which is odd because I have not messed with any ...
tearfur's user avatar
3 votes
2 answers
3k views

PAM: how to pass UID to pam_exec for sshd

I would like to execute a script during a user login per ssh on CentOS 7 with PAM pam-1.1.8-23.el7.x86_64 Thus, I added a rule to sshd's pam module to execute a script /etc/pam.d/sshd ... session ...
THX's user avatar
  • 263
0 votes
0 answers
133 views

pam-auth-update update of /etc/pam.d/common-auth doesn't work

I'm trying to match a FreeIPA user to a local group via FreeIPA group membership. When testing the manual edit of common-auth it works. But I'm trying to generate the file with pam-auth-update so that ...
dmgeurts's user avatar
0 votes
1 answer
655 views

pam radius bypass same local user (exception user)

Pam Radius login works with the following configuration. However, it would be necessary for some users to perform local authentication. How can I solve this? [xxxxxxxxxxx ~]# cat /etc/pam.d/sshd #%PAM-...
dilen7's user avatar
  • 1

1
2 3 4 5
16