Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

How to install new SSL on server that runs apahe2 and postfix

I recently inherited an old project that runs on a VPS without cPanel. Looking around I saw that the server runs an apache2 web server and that postfix is used for sending some automated mails. I have ...
1
vote
0answers
19 views

CentOS USER_CMD logs auditd

We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it? We already getting commands, starting with sudo, but not ...
3
votes
0answers
87 views

sshd on Fedora: Recent changes to UsePAM break existing security; PermitRootPassword & UsePAM no not honored, minimal PAM config doesn't work either

I did upgrade on a Fedora Server and was SHOCKED to discover thousands of root attacks on my publicly facing servers and I can't seem to figure out how to stop them! To be clear; It IS possible to log ...
1
vote
1answer
71 views

What is the easiest way to set up composable POSIX groups for SSH & Samba authentication?

Background I'm putting together what I would consider to be a fairly ordinary chunk of infrastructure, but have been running into so many problems that I can't help but wonder if there's an easier way....
0
votes
0answers
114 views

What causes - Error: pam…Multiple password values not supported?

On a linux server a user is unable to collect email using Microsoft Office. in /var/log/maillog I see this Mar 1 20:49:48 nitrogen dovecot: auth-worker(15749): Error: pam(usern@example.com, 1.2.3.4,&...
0
votes
0answers
30 views

SSH Pam only specific user enable Pam_Motd

I want to make specific user show motd when user login in ssh. I have tried used Match block in sshd_config, but PrintMotd was not able to be in Match. Therefore, I tried to config /etc/pam.d/sshd/. ...
0
votes
0answers
14 views

Dynamic mounting of remote shares for users

We have a storage solution for home directories and project directories and will use NFSv4 to mount these. To mount home directories it is straightforward, as pam_mount reads the home directory from ...
1
vote
0answers
20 views

How to customize NSS filters to match users against several attributes?

My context: I have a OpenSMTPD instance that uses PAM as its authentication backend. My PAM configuration use NSS to authenticate the users against a LDAP directory. I would like to make NSS match ...
2
votes
1answer
237 views

configure saslauthd with PAM

I'm trying to configure saslauthd with PAM. I created a user test with password test using useradd and passwd and I checked that I can login with su - test. [arch@vps-5220ce87 ~]$ systemctl status ...
0
votes
0answers
33 views

Pam_mount using ldap homeDirectory path

Our storage server where the users' home directories are stored doesn't have a fixed path for all users, such as /home. Instead, it has some users at /home01/, others at /home02, etc. All the users ...
0
votes
0answers
83 views

Define volume path for pam_mount from ldap and/or env variables

I would like to use pam_mount to mount home directories using nfs4 on RHEL 8 machines. However, since home directories on the server will be allocated on different directory structures, I cannot ...
2
votes
0answers
1k views

id: user: no such user

I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
0
votes
1answer
72 views

PAM in Linux: any way to skip local auth if remote/external auth DB returns a negative response?

Dear fellow system tinkerers, an admin friend has asked me the following question: On a number of network elements and servers, he's using remote authentication against a TACACS+ server. On some such ...
0
votes
0answers
73 views

PAM/winbind authentication fails on CentOS 7 after update to SAMBA_4.10.16

I recently applied security updates to a CentOS 7 VM; as part of this, The samba family of packages was updated from 4.10.4 to 4.10.16. Following the upgrade, PAM authentication fails in this way: Dec ...
0
votes
0answers
52 views

How to make Google Authenticator work with vsftpd

I have configured google authenticator to work with ssh. It's working fine. Now I also want to extend 2FA using google authenticator to FTP users. I am using vsftp. How do I achieve that. I could not ...
0
votes
0answers
102 views

Accidental chsh command leads to broken PAM authentication

I accidentally ran the command: chsh -s bash as root and now no password authentication works for root or any users. I have a single SSH session from which to fix it. I can't even open a second root ...
0
votes
0answers
40 views

Custom bash prompt failing when home directory is remote

0 I am trying to configure a custom prompt for RHEL 8 users. It works very nice when the users have local home directories. However, I'm mounting home directories via pam_mount (nfs4). When ssh'ing to ...
1
vote
0answers
14 views

HTTPD with SSL startup fails with missing PAM library error

I am configuring SSL to run with Apache 2.4 on RHEL7. As expected, httpd starts successfully before SSL configuration is added. After adding certificates and configuration files, startup fails with ...
0
votes
0answers
59 views

pam_tty_audit collect only TTY events

I'm trying to put together a TTY logging feature under Ubuntu 18.04 server and created /etc/pam.d/tty-audit with the following content: session required pam_tty_audit.so enable=* and added that ...
0
votes
0answers
33 views

Authenticating Domain Users Using PAM Samba AD DC centos 8

I have a Domain with Samba ADDC on CENTOS8. It's work perfectly but I can't authenticate domain users in ssh and su on the local machine .. Do you know how to do it ? I have tried by modifying the ...
0
votes
0answers
144 views

LDAP, NSLCD, and PAM Auth; Debian 10

I may be looking in the wrong place, and if so let me know and I'll find the correct place. I've been struggling with the issue for the past week or so in my homelab set up. I followed the ...
1
vote
2answers
83 views

Why can users just not login with SSH while everything else seems to work?

I have set up a pair of OpenLDAP servers on Ubuntu 20 with directional failover using Syncrepl. Things that an LDAP user can successfully do include: login su - <uid> remote bind from ...
0
votes
0answers
29 views

Linux pam_time with groups

How do I allow /etc/security/time.conf to be able to restrict groups instead of users? It works flawlessly with users but not with groups. I need to have multiple groups in my case.
0
votes
1answer
78 views

PAM authentication - automatically create user?

I've finally got LDAP auth working on Ubuntu 18.04, however it only works if I first create the local user account (eg john.smith). If I don't create the account first, it fails to bind to the LDAP ...
1
vote
1answer
76 views

Google Compute - CentOS 8 PAM Authentication Fails After Update

I have a Google Cloud project on which I'm unable to access a CentOS 8 VM. It is running kernel version 4.18.0-193.19.1.el8_2.x86_64 on an x86_64. I'm also running with selinux enabled. Before running ...
0
votes
0answers
74 views

Failed to commit changes to dconf error when homedir is remote (cifs) on RHEL 8

I am using pam_mount to remote mount home directories (CIFS), though this problem also happens if I mount a home directory manually. The home directories are mounted successfully. However, there's ...
0
votes
1answer
64 views

How to install pam_mount on RHEL 8?

I'm trying to install pam_mount on RHEL8 but keep getting this: rror: Problem: package pam_mount-2.16-10.el8.x86_64 requires hxtools, but none of the providers can be installed - conflicting ...
1
vote
0answers
34 views

Accessing KRB5CCNAME from /etc/gdm/PreSession/Default on RHEL8

I would like to run a script after a user login. This script, using his kerberos tickets, will mount an SMB share. Under RedHat 7 I could simply call the script from /etc/gdm/PreSession/Default and it ...
0
votes
1answer
1k views

cgroup fork rejected by pids controller

Have a small server program written in C/C++ that uses nginx and Postgres, currently all are hosted on the same ubuntu system. I usually run the server program from the bash command line. Recently on ...
0
votes
1answer
32 views

Let one user become another user without a password?

On (most) Linux systems, we can let a specific user su into anyone they want by placing him in the wheel group and making some settings in /etc/pam.d/su. I want to do something more limited: I want to ...
0
votes
1answer
92 views

Why does Alpine-based sshd shut down when first session ends?

I have a simple Docker container for a purposeful sshd server whose image derives from alpine:latest. It currently uses /usr/sbin/sshd -D -e -ddd as its entrypoint. When I ssh into it for running a ...
2
votes
0answers
88 views

OpenVPN auth with Freeradius fails with error message: Module is unknown

I have installed an OpenVPN server with Easy-RSA. I generated the certificate and signed it on my CA Server and copied it back to VPN server. I can establish the client-server connection via ...
2
votes
0answers
80 views

afpd[]: PAM audit_log_acct_message() failed: Operation not permitted

Im trying to debug this error in the /var/log/auth but I dont know where to look at. Jul 27 06:44:30 server afpd[6463]: PAM audit_log_acct_message() failed: Operation not permitted The syslog seems ...
-2
votes
2answers
59 views

Is using easy passwords on root account safe? [closed]

Now that I've got your attention :) This is more of a thought experiment than a real question I've been thinking about using an easy root account password for recovery purposes, having in mind these ...
0
votes
1answer
211 views

Errors log in the auth.log but all working fine

Hi I have a Linux server (18.04) that acts as a TimeMachine backup server using the netatalk service. The users are authenticating using the LDAP (/etc/ldap.conf) The client can connect to the AFP ...
2
votes
1answer
724 views

OpenVPN with PAM with systemd and SELinux

I am trying to set up an OpenVPN (2.4.9) server with PAM login on CentOS 8.2 and I am facing some strange issues. Specifically, i can successfully athenticate if I start the server with the ExecStart ...
0
votes
0answers
290 views

How to enable pam and disallow root/password login for ssh?

I want do disable password and root login via ssh. I followed this guide https://www.cyberciti.biz/faq/how-to-disable-ssh-password-login-on-linux/. It suggests making the following changes to /etc/ssh/...
0
votes
0answers
21 views

Logging Linux logins to an external server

I would like to log any successful (local, ssh) shell login of any user to an external {server,database,textfile,...}. Does anyone know of a pam plugin or other proven method to do so? The information ...
0
votes
0answers
33 views

PAM tries LDAP even though I haven't configured LDAP

Once in a while I am seeing this weird behavior that PAM is trying to use LDAP (and fail) even though I haven't configured LDAP in the PAM stack! From the logs, it looks like because the unix ...
0
votes
0answers
37 views

Pam time on Centos 7 not working

I have problem with PAM time on CentOS 7. I have this settings in /etc/security/time.conf: login & ssh;*;pawel;A12220-2300 login & ssh;*;pawel;Al2220-2300 sshd;*;pawel;Al2220-2300 sshd;*;...
0
votes
0answers
93 views

CentOS 7 Allow both domain users AND local users

I successfully joined the domain with the server as outlined at https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/ and I am able to login using my domain account. I am ...
0
votes
1answer
188 views

libpam-ldap unable to connect to LDAP server over SSL/TLS

I am trying to configure PAM to work with my LDAP server for authentication. To do this I am trying to use libpam-ldap, I decided to use libpam-ldap instead of libpam-ldapd for two reasons. First, ...
0
votes
0answers
51 views

Multi-layer authentication for nginx reverse proxy server

I am writing a configurable reverse proxy server with nginx and I am running into an issue with upstream servers when it comes to authentication. Each reverse proxy has a single layer of pam ...
0
votes
1answer
35 views

sshd fails to login user

I could not ssh into one of my servers this morning after successfully doing so most recently yesterday. ssh hostname Connection closed by hostname port 22 I rebooted system and it did not fix the ...
0
votes
0answers
826 views

Pam_unix sshd authentication failure even though the login works?

I have a server that is configured with winbind and samba to provide active directory authentication. The active directory integration works fine however whenever I authenticate I see the following ...
0
votes
0answers
153 views

Setting up google-authenticator-libpam (TOTP/HOTP) for authentication in combination with pam-mysql for vsftpd

I have a setup in which virtual users for vsftpd (latest, 3.0.3) are authenticated against a MySQL database using pam-MySQL[1]. This works perfectly fine, configured like this: auth required /lib/...
0
votes
2answers
162 views

Determine if Linux account locked when SELinux protects shadow

I am trying to run a script which gets the username of every locked account on a Linux system. The server is a Gentoo Hardened Server with SELinux. I tried by writing some Python which looks in /...
0
votes
0answers
16 views

change in duration for failed login attempt by setting pam_faildelay.so delay is not taking effect

I have changed the delay value using "pam_faildelay.so delay" but the delay which I added 300 ms is not taking effect. For failed login attempts still I can see 2 seconds delay. Below is rule which I ...
0
votes
0answers
176 views

FreeRADIUS + PAM + Google Authenticator + PBIS-Open Bypass by Group

I'm setting up a 2FA server to authenticate users for a VMware Horizon View system from a Microsoft AD using Ubuntu Server 20.04 with FreeRADIUS 3.0, libpam-google-authenticator and PBIS-Open for ...
1
vote
0answers
2k views

PAM: password authentication failed for remote user

I am executing a command from server1 which would do a remote ssh to server2 and execute certain commands as olcne user. I am seeing some exception in /var/log/secure file wrt to pam. Can someone ...

1
2 3 4 5
15