Questions tagged [pam]
Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
755
questions
0
votes
0
answers
29
views
sudo su - has a 5 minute delay should I pop back to original use
We are working with ROcky linux 8.6 -
when we type sudo su - we are prompted for login and we get to root user no problem.
if we type exit we go back to the original user as is expected.
If we type ...
0
votes
1
answer
15
views
How change temporary primary group for user when user connect to samba?
I have samba connected via Winbind to AD. Historically, all unix enabled users has wrong primary group.
May I change while user connected to samba primary group to one of the users secondary? It could ...
0
votes
0
answers
15
views
Shutdown after X failed login attempts [migrated]
I have a laptop with Xubuntu 22.10, whose SSD is encrypted with LUKS, so if it's stolen when shut down, my data should be safe. But it's more likely to be stolen while it's switched on, and then only ...
0
votes
0
answers
22
views
avoid leaking info whether the user is denied access or typed the incorrect password
I am currently tinkering with the sshd_config and /etc/security/access.d for a large system with 10k+ users. There are so many different ways of restricting user access and it makes my head spin a bit ...
- 101
0
votes
1
answer
87
views
Refresh kerberos ticket instead of prompting for pam password
Using centralised auth against FreeIPA is working great. In order to use Kerberos SSO when using ssh, scp etc from jumphosts users must initiate their Kerberos tickets first with kinit. I've added ...
- 13
0
votes
0
answers
31
views
Using shadow password from LDAP while using SSSD for identity
I'd like to use SSSD ldap as a provider for shadow entries. It seems to be supported, given the default config with sssd installed adds sss to both passwd and shadow in nsswitch.conf, but I can't get ...
- 1,296
0
votes
0
answers
87
views
Unable to login via SSH to a Linux machine with my LDAP credentials
I am trying to setup LDAP for users to login to Linux machines. I can change the users to any given users in the LDAP list of users using the su command. A new directory is created as well. So I'm ...
1
vote
1
answer
53
views
OpenLDAP ppolicy working with passwd, but not ldappasswd
I've been working on this for about a week, and can't seem to figure out why this is happening.
I've got passwd working, letting users change their own ldap password from a client machine, and it ...
- 115
1
vote
0
answers
50
views
Can't authorise commands via tacacs+ server executed in shell by ssh
I've setup a tacacs+ server and a PAM tacacs client from here- https://github.com/kravietz/pam_tacplus/tree/main.
When user ssh into the tacacs client machine, I want authentication from tacacs+ ...
- 11
0
votes
0
answers
77
views
pam: reducing auth method timeout
I have set up user fingerprint auth on Fedora 37 laptops.
With fingerprint auth as default auth choice, pam is waiting by default for 10 seconds for a valid fingerprint. Now, I would like to reduce ...
- 243
0
votes
2
answers
213
views
OpenVPN + PAM + Freeradius
Situation:
I have fully configured and working Freeradius server.
Installed OVPN 2.6.4 on other server. And goal is auth through Radius.
Installed pam-radius-auth. Configured (confs below).
...
0
votes
1
answer
221
views
Trouble with password rules in Linux-PAM
Ubuntu 20.04.
I've installed pam_pwquality.so.
Here's the contents of /opt/pam.d/common-password:
password required pam_pwquality.so retry=1 minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 ...
- 101
0
votes
0
answers
146
views
Redhat Linux 8.5: Upgrading to OpenSSH 9.2 sees '/bin/bash: Permission denied' with root login
After successfully make-installed OpenSSH from source followed detailed instructions from a post of online community (version checked ok), only to see /bin/bash: Permission denied at root login.
...
0
votes
0
answers
28
views
Caching sessions with pam_timestamp on ubuntu
I am trying to use PAM and the pam_timestamp module to reduce the number of passwords I need to enter.
Test program via https://learning.oreilly.com/library/view/linux-security-cookbook/0596003919/...
- 101
0
votes
0
answers
108
views
How to setup pam on debian 11
I have installed debian 11 and pam-ldapd.
Now, I want to setup authenticating for openvpn with pam. When I wanted to test it with 'getent passwd' command, I got only local users response.
Can you help ...
- 13
0
votes
0
answers
62
views
vsftpd with MySQL 8 - login not working
I try to set up vsftpd using MySQL database for login users via pam.d
I have this config in /etc/pam.d/vsftpd:
# Standard behaviour for ftpd(8).
auth required pam_listfile.so item=user sense=...
- 121
0
votes
0
answers
91
views
Control sudoers using oidc user data
I am implementing a Linux host login using the OpenID Connect PAM module. I use Keycloak as OIDC Identity Provider. Googling, I didn't find a solution to control the sudoers file using OIDC data (like ...
- 1
0
votes
1
answer
275
views
Dovecot auth-worker logs fails but log in works
Everytime a log in occurs I get three log lines:
Mar 19 15:29:05 auth-worker(6379): Info: pam([email protected],124.1.1.1,<AL/fkjf3yr98xTrl>): pam_authenticate() failed: Authentication failure (...
0
votes
0
answers
52
views
Howto: Pam session steps loggued in GDM UI
On Ubuntu 20.04, with gdm3
When my user succesfuly loggued-in, I've a pam-session script that do a lot of long running jobs before starting gnome.
I simple looking for writing some basic info in the ...
- 1
0
votes
0
answers
137
views
sshd allows login with no authentication all accounts
This morning I was logging into an Ubuntu 18 machine that luckily we use for testing and is not on the Internet. When my SSH client got to the authentication point I accidentally hit 'ESC' which means ...
- 13
1
vote
0
answers
158
views
how to use PAM auth for ssh key clients?
How to unlock ssh private keys with PAM, so I can use fingerprintd module?
There are many questions here discussing PAM and kerberos for sshd auth, but I can't find anything on the client side.
Also, ...
- 280
0
votes
0
answers
175
views
Explanation of pam.conf for sshd
I’m trying to configure public key + TOTP-based 2FA based ssh on a server. The setup works perfectly, however I’m curious to know how exactly the configuration works.
This is what /etc/pam.d/sshd ...
- 181
0
votes
0
answers
414
views
Remote side unexpectedly closed network connection RHEL 7.9
I have a situation where a rhel server becomes inaccessible using AD accounts but lets a local account to login. We are using a PAM tool that serves as our AD broker that enables us to login with AD ...
0
votes
1
answer
371
views
Best practices to completely disable LDAP users' access to mixed services with mixed authentication methods?
Background
We use LDAP in our department to authenticate users to various services including web apps as well as Linux servers (via SSH). When a user leaves the department, we should disable their ...
- 38
0
votes
0
answers
76
views
Add Ansible Template as RPC dependancy for Privilege Vault/Secret Server
We're running Delinea/Thycotic Privilege Vault in our environment.
We're trying to onboard all credentials into Privilege Vault as much as possible, so that we can leverage Auto-Change, where the ...
- 219
1
vote
2
answers
426
views
What did Oracle Cloud do, so I could sudo without password on SSH session?
I noticed that Oracle Cloud's pre-generated key pair could login into Linux server without password, and sudo without password, too. I can't reproduce this situation anywhere else I known.
The ...
- 11
0
votes
0
answers
841
views
nss_ldap failed to bind to LDAP server
i have configured ldap client (ubuntu 20.04) with nss_ldap to connect on ldap server and accept users in a specific group, it seems that everything is working fine, the client can access the ldap ...
0
votes
0
answers
62
views
How to enable password policy on readonly filesystem?
I'm using a read-only filesystem (squashfs). I've used the overlays file system to mount /etc directory. I can change the password using passwd command.
I've included libpam & libpwquality ...
- 101
0
votes
0
answers
133
views
how to configure passwd/pam.d to confirm new password 3 or more times when changing password with passwd
I am looking to reconfigure my pam.d to prompt for new password confirmation 3 times when using passwd to change password.
I have tried to duplicate the unix.so line in password-auth and system-auth ...
0
votes
0
answers
132
views
How to show the user a PAM module’s errors when attempting SSH authentication?
I have set up TOTP 2FA authentication on my VPS, mostly thanks to this answer.
I’ve been testing the authentication to see if my setup works as intended and it does, and when looking through /var/log/...
- 1
0
votes
1
answer
176
views
PAM deems Kerberos password as expired
I run Kerberos / LDAP authentication in a small network for years. Kerberos is held in LDAP, which in turn is replicated to another site. Machines at the second site authenticate to the replica, the ...
- 285
1
vote
0
answers
379
views
Cron not working after pam customization to check groups
I need help with a PAM configuration.
I've a Debian 11.5 machine with kerberos connected to an MS AD server.
I want to configure the machine in order to allow some AD user to login, filtering them by ...
0
votes
0
answers
771
views
sssd/ldap does not authenticate against LDAP
I have configured SSSD with AD as ID and Auth providers. I am not caching credentials, so I expect connections to AD for authentication when I ssh to the host, but I do not see any. The user account ...
- 101
0
votes
2
answers
321
views
OTP before password with pam_radius and NPS
I have successfully configured pam_radius on a Ubuntu client so that users are asked for an OTP. The radius server is an NPS with Azure MFA extension. The OTP is checked against Azure.
It works well, ...
- 200
1
vote
0
answers
107
views
PAM "remember me" with timeout option for 2FA?
Is it possible for PAM to remember that a second factor authentication has passed for a short period of time, e.g. an hour? This would have to be keyed to a user and IP address.
For example:
Log in ...
- 743
2
votes
3
answers
440
views
Restrict Samba4 authentication by user + VPN IP address pair
We're working towards a zero trust security model in our office, with servers secured behind a WireGuard VPN. We already use WireGuard for remote access, so this is the simplest way to ensure ...
- 141
0
votes
0
answers
84
views
What is the downside of not including `:pam` on the keyboard-interactive AuthenticationMethod
I am using PAM for password and 2FA (with @include common auth and auth required pam_google_authenticator.so).
When configuring my AuthenticationMethods, is there any reason to not use :pam with ...
0
votes
0
answers
98
views
Why is AuthenticationMethods in sshd_config needed if UsePAM is yes?
My server requires a user password and 2FA code when SSHing in. I have enabled this in /etc/pam.d/sshd by including @include common-auth (for the password) and auth required pam_google_authenticator....
0
votes
1
answer
824
views
Use pam_exec to run a script on an ssh login event
I'm trying out linuxserver.io openssh-server. Its a lightweight openssh image and makes it easy to configure with public key and user name.
If I run it, ssh with public key auth, works as expected:
$ ...
- 99
1
vote
0
answers
287
views
PAM configuration popup yes or no for answer? after sudo apt install software-properties-common
I was trying to install the latest php version and after a command not found I googled it and they say to use the following command ''sudo apt install software-properties-common''
After doing this I ...
0
votes
1
answer
207
views
Remote ssh login does not respect pam umask
My server is on Ubuntu 22.04.1, and recently I discovered that the result of the umask command is 0002 instead of 0022 in an SSH session (non-root), which is odd because I have not messed with any ...
- 1
2
votes
2
answers
2k
views
PAM: how to pass UID to pam_exec for sshd
I would like to execute a script during a user login per ssh on CentOS 7 with PAM pam-1.1.8-23.el7.x86_64
Thus, I added a rule to sshd's pam module to execute a script
/etc/pam.d/sshd
...
session ...
- 243
0
votes
0
answers
106
views
pam-auth-update update of /etc/pam.d/common-auth doesn't work
I'm trying to match a FreeIPA user to a local group via FreeIPA group membership. When testing the manual edit of common-auth it works. But I'm trying to generate the file with pam-auth-update so that ...
- 13
0
votes
1
answer
473
views
pam radius bypass same local user (exception user)
Pam Radius login works with the following configuration.
However, it would be necessary for some users to perform local authentication. How can I solve this?
[xxxxxxxxxxx ~]# cat /etc/pam.d/sshd
#%PAM-...
- 1
1
vote
0
answers
227
views
Using `pam_access` with `substack` errors
I am implementing pam_duo for multifactor authentication for SSH on a Redhat 9 system, but I want to only require it when the user is outside the network.
The file /etc/security/access-duo.conf ...
- 1,223
0
votes
0
answers
1k
views
Ubuntu 21.10 ulimit (open file descriptors) not applying correctly
The situation is strange because I have 2 identical servers with the same application but
on one server i get a ulimit error from the custom application ulimit error: too many open files but on the ...
- 274
0
votes
1
answer
901
views
Can PAM be used with Postfix and Dovecot SASL?
I have set up Postfix to use Dovecot SASL with PAM and Unix users, and Dovecot LDA (LMTP) for local mailbox storage. After some testing, turns out incoming mail gets declined with the reason:
Error: ...
- 133
0
votes
1
answer
2k
views
Errors mounting Windows share (cifs) with pam_mount
I have an Ubuntu 21.10 pc joined to a Samba AD domain controller. Everything is working absolutely fine - Kerberos is working (can get tickets with kinit), winbind is working (can get info abount ...
- 1
1
vote
0
answers
557
views
Using ssh with sssd for password or publickey and extending with MFA support through PAM
So after some extensive testing and discussing I can no longer wrap my head around this problem on my own.
Goal: Authenticating over ssh with either publickey or password, and use PAM for MFA.
System ...
- 11
0
votes
0
answers
339
views
SSSD alternative for pam_authz_search option in nslcd
I have servers based on RHEL 7 and 8.
RHEL 7 serevers use nslcd to work with a LDAP server, RHEL 8 use SSSD.
For RHEL 7 I can provide access for users to allowed hosts only.
This functions is covered ...
- 578