2022 Developer Survey is open! Take survey.

Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Ubuntu 21.10 ulimit (open file descriptors) not applying correctly

The situation is strange because I have 2 identical servers with the same application but on one server i get a ulimit error from the custom application ulimit error: too many open files but on the ...
user avatar
  • 274
0 votes
1 answer
51 views

Can PAM be used with Postfix and Dovecot SASL?

I have set up Postfix to use Dovecot SASL with PAM and Unix users, and Dovecot LDA (LMTP) for local mailbox storage. After some testing, turns out incoming mail gets declined with the reason: Error: ...
user avatar
0 votes
0 answers
12 views

pam module to stop login if home directory does not exist

In an previous job mny years ago a pam module was in use to stop users being able to log in if their home directory did not exist. I would like to use this module but can't find any information about ...
user avatar
0 votes
0 answers
17 views

Difference between krb5-user and Pam method for LInux to authentificate on Active Directories

I'm trying to understand what the difference between both this guides is: http://ricktbaker.com/2017/11/08/ubuntu-16-with-active-directory-connectivity/ https://computingforgeeks.com/join-ubuntu-...
user avatar
0 votes
1 answer
112 views

Errors mounting Windows share (cifs) with pam_mount

I have an Ubuntu 21.10 pc joined to a Samba AD domain controller. Everything is working absolutely fine - Kerberos is working (can get tickets with kinit), winbind is working (can get info abount ...
user avatar
  • 1
0 votes
0 answers
36 views

Using ssh with sssd for password or publickey and extending with MFA support through PAM

So after some extensive testing and discussing I can no longer wrap my head around this problem on my own. Goal: Authenticating over ssh with either publickey or password, and use PAM for MFA. System ...
user avatar
0 votes
0 answers
36 views

SSSD alternative for pam_authz_search option in nslcd

I have servers based on RHEL 7 and 8. RHEL 7 serevers use nslcd to work with a LDAP server, RHEL 8 use SSSD. For RHEL 7 I can provide access for users to allowed hosts only. This functions is covered ...
user avatar
0 votes
0 answers
19 views

SSH local authent takes 100s when LDAP server DOWN/unreachable

My use case is the following: I have EC2 in an autoscaling group. When my ldap servers are down (or network issue), I can't use ldap authentification so I have a local user on my servers. But when I ...
user avatar
0 votes
0 answers
88 views

Problems sudoing using a host connected to Active Directory (sssd, kerberos local sudoers file)

I am configuring Active Directory authentication for an Alma 8 box using SSSD, Kerberos, and initial SSH key for log in stored in an Active Directory object, and a local sudoers file that lists groups ...
user avatar
1 vote
1 answer
74 views

LDAP finds user, but "permission denied" when logging in

I am setting up an LDAP client in Red Hat 8. After setting up the config files I did an LDAP user test and it came back successfully: # id myusername uid=666(myusername) gid=510(active_users) groups=...
user avatar
  • 111
1 vote
1 answer
92 views

Enforcing 2FA configuration on next SSH login for every user

I have found numerous tutorials on how to enable 2FA (TOTP, RFC 6238) but is there also a way to force SSH users to configure it on the first login? (I am using OpenSSH server) I guess I could create ...
user avatar
  • 65
0 votes
0 answers
16 views

Where does /etc/pam.d/login come from and where can I tell when it changed between distro versions

I think the first question will enable me to figure out the second question. How can I determine when /etc/pam.d/login and /etc/pam.d/sshd changed from RHEL/CentOS 6.9 and RHEL/CentOS 7.9? Maybe ...
user avatar
1 vote
1 answer
65 views

SSH authentication: (public key xor password) + google authenticator code

I'm using Debian bullseye. I'm trying to set up SSH two types logins: password + code from Google's Authenticator (if user set it, "nullok" option), public key + code from Google's ...
user avatar
  • 11
0 votes
1 answer
37 views

PAM permit works only when dummy suffix is added

I am trying to use PAM to authenticate OpenVPN against 2FA (not important info). Here is my PAM configuration: account required pam_permit.so auth required pam_google_authenticator.so ...
user avatar
0 votes
1 answer
106 views

Apple client unable to login with LDAP backend and GSSAPI or PLAIN

I have a OpenLDAP server with Kerberos5 for authentication and on Linux/Unix/Windows environments I am able to login without a problem. The LDAP server is configured to use GSSAPI or PLAIN that passes ...
user avatar
0 votes
0 answers
34 views

Account locking without bad password pamd ssh

Here is my password-auth file: auth required pam_faillock.so preauth silent deny=5 unlock_time=900 auth required pam_faillock.so authfail deny=5 unlock_time=900 auth ...
user avatar
0 votes
0 answers
73 views

Modern alternative for pam_userdb (for use with vsftpd)

Quite some years ago, I setup a vsftpd server with virtual users, according to some howtos (still) to be found on the internet, using pam_userdb. Like this: A file called /etc/pam.d/vsftpd.virtual: #%...
user avatar
0 votes
0 answers
107 views

How do I allow any password for anonymous accounts on ProFTPD?

I want to allow any password (like any string) on my anonymous accounts, not just the e-mail address. How do I setup this up? USER anonymous 331 Anonymous login ok, send your complete email address as ...
user avatar
0 votes
0 answers
163 views

CentOS 7 PAM / LDAP SSH/LOGIN user does not start in his home directory

On a CentOS 7 machine, users can use their LDAP credentials to connect to my servers. The first time they do this, the pam_mkhomedir is doing its job well. The user's folder /home/jdoe is well created ...
user avatar
0 votes
0 answers
268 views

PAM authentication fails in OpenVPN

I am running openvpn-2.5.3-1.2.x86_64 on OpenSUSE Tumbleweed (20211111). I am currently unable to log into my openvpn server. The initialization and authorization seem to succeed but then I get the ...
user avatar
  • 53
0 votes
1 answer
125 views

CRON[83463]: Failure setting user credentials

I have a number of docker containers, all set up mostly identically, which successfully use cron to run nightly backup jobs. I have another container, set up mostly identically, which tries, and fails,...
user avatar
  • 328
0 votes
0 answers
346 views

How to configure jenkins-agent to allow ssh via password?

I am trying to add a jenkins agent running Rocky Linux 8. How do I configure an jenkins-agent to allow ssh connection from the jenkins-controller via password? I did the following steps on the new ...
user avatar
  • 115
0 votes
0 answers
15 views

enabling pam.d/google authenticator/2-factor authentication in sshd prevents EC2 Instance Connect from accessing instance

Question: is it possible to configure SSHD to enforce 2-factor for all users, but also allow AWS EC2 Instance Connect to continue working? AWS has this feature "EC2 Instance Connect" that ...
user avatar
  • 131
0 votes
0 answers
23 views

How to check for Sixel support in pam_motd on Ubuntu?

Ubuntu uses pam_motd to display the message of the day (motd) when logging in. This message is in turn generated from the scripts in /etc/update-motd.d. Inside one of those scripts I would like to ...
user avatar
  • 191
1 vote
0 answers
49 views

Authenticating ftp against multiple (postgres) databases

Current State Given is a host with a couple of IPv4 addresses and HTTP & FTP access for each address; each vhost has access to a PostgreSQL database. Web- and ftp-authentication is done against ...
user avatar
  • 11
0 votes
0 answers
184 views

Issues getting sssd, PAM, and faillock to play along on RHEL7

I am having an issue that I'm almost certainly is tied to how I have faillock configured in my PAM system-auth and password-auth on some RHEL7 servers. We are required to use STIGs, so I have to use ...
user avatar
0 votes
1 answer
263 views

How to give web server user read permission to /etc/shadow file?

I would like to have a local Linux user to be able to be authenticated (login) using the Nginx PAM module. I am using a CentOS 7 server. Specifically the below is what I am trying to do... The README ...
user avatar
  • 21
2 votes
1 answer
378 views

How to authenticate local Linux user with Nginx PAM module?

I would like to be able to have a local Linux user authenticate with their credentials when accessing a site. I am using the ngx_http_auth_pam_module. In the nginx.conf file I have the following ...
user avatar
  • 21
4 votes
2 answers
761 views

SSH public key authentication with google authenticator still asks for password

I'm trying to enable 2FA with ssh using libpam-google-authenticator. Not all users need authenticator enabled. Everybody uses ssh public keys, and nobody has a password. I'm running Debian buster, and ...
user avatar
1 vote
0 answers
22 views

SOCKS_dante(1.4.3)_Separate processing by port number

I have installed dante and it is working fine. In addition, I want to divide the process according to the port number of the client, but it doesn't work. I want to divide the processing as follows. ...
user avatar
  • 11
0 votes
1 answer
177 views

/etc/login.defs settings not taken into account: password aging

The following is done on a Ubuntu 20.04 system. This is the scenario where I am facing an issue: I edit the password aging settings in the login.defs file Then I change the password of the user with ...
user avatar
  • 148
0 votes
0 answers
250 views

New SSSD Active Directory install does not allow logins

Just instaled SSSD using this guide to get active directory authentication working on Ubuntu 18.04.5 LTS. It worked for our first server, but for whatever reason the one i'm trying to install on next ...
user avatar
  • 1
0 votes
1 answer
449 views

postfix/sasl/pam (mysql) auth error

I've followed tutorial on http://flurdy.com/docs/postfix/ to set up an email server, and most of it works (after switching from Courier to Dovecot). Just not sending email through SMTP. Sending with ...
user avatar
  • 335
0 votes
0 answers
651 views

How does the sudoers option 'pam_session' correspond to PAM's 'session' type?

On a CentOS 7 system, I want to prevent lines such as May 20 08:55:05 c090 sudo: pam_unix(sudo:session): session opened for user root by (uid=0) May 20 08:55:05 c090 sudo: pam_unix(sudo:session): ...
user avatar
  • 198
0 votes
0 answers
80 views

crond not loading /etc/pam.d/crond config

I have this PAM config in /etc/pam.d/crond: auth required pam_env.so user_readenv=1 And this .pam_environment file: _APP_PASSWORD DEFAULT=foo And this test cronjob: */1 * * * * root env 2&>1 |...
user avatar
  • 393
1 vote
0 answers
71 views

CentOS USER_CMD logs auditd

We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it? We already getting commands, starting with sudo, but not ...
user avatar
3 votes
0 answers
372 views

sshd on Fedora: Recent changes to UsePAM break existing security; PermitRootPassword & UsePAM no not honored, minimal PAM config doesn't work either

I did upgrade on a Fedora Server and was SHOCKED to discover thousands of root attacks on my publicly facing servers and I can't seem to figure out how to stop them! To be clear; It IS possible to log ...
user avatar
  • 1,128
2 votes
1 answer
434 views

What is the easiest way to set up composable POSIX groups for SSH & Samba authentication?

Background I'm putting together what I would consider to be a fairly ordinary chunk of infrastructure, but have been running into so many problems that I can't help but wonder if there's an easier way....
user avatar
0 votes
1 answer
544 views

What causes - Error: pam...Multiple password values not supported?

On a linux server a user is unable to collect email using Microsoft Office. in /var/log/maillog I see this Mar 1 20:49:48 nitrogen dovecot: auth-worker(15749): Error: pam(usern@example.com, 1.2.3.4,&...
user avatar
  • 126
1 vote
0 answers
53 views

How to customize NSS filters to match users against several attributes?

My context: I have a OpenSMTPD instance that uses PAM as its authentication backend. My PAM configuration use NSS to authenticate the users against a LDAP directory. I would like to make NSS match ...
user avatar
  • 145
3 votes
1 answer
1k views

configure saslauthd with PAM

I'm trying to configure saslauthd with PAM. I created a user test with password test using useradd and passwd and I checked that I can login with su - test. [arch@vps-5220ce87 ~]$ systemctl status ...
user avatar
  • 151
3 votes
0 answers
4k views

id: user: no such user

I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
user avatar
  • 31
0 votes
1 answer
167 views

PAM in Linux: any way to skip local auth if remote/external auth DB returns a negative response?

Dear fellow system tinkerers, an admin friend has asked me the following question: On a number of network elements and servers, he's using remote authentication against a TACACS+ server. On some such ...
user avatar
  • 241
0 votes
0 answers
46 views

Custom bash prompt failing when home directory is remote

0 I am trying to configure a custom prompt for RHEL 8 users. It works very nice when the users have local home directories. However, I'm mounting home directories via pam_mount (nfs4). When ssh'ing to ...
user avatar
1 vote
0 answers
25 views

HTTPD with SSL startup fails with missing PAM library error

I am configuring SSL to run with Apache 2.4 on RHEL7. As expected, httpd starts successfully before SSL configuration is added. After adding certificates and configuration files, startup fails with ...
user avatar
  • 11
0 votes
0 answers
297 views

pam_tty_audit collect only TTY events

I'm trying to put together a TTY logging feature under Ubuntu 18.04 server and created /etc/pam.d/tty-audit with the following content: session required pam_tty_audit.so enable=* and added that ...
user avatar
  • 3
0 votes
0 answers
445 views

LDAP, NSLCD, and PAM Auth; Debian 10

I may be looking in the wrong place, and if so let me know and I'll find the correct place. I've been struggling with the issue for the past week or so in my homelab set up. I followed the ...
user avatar
1 vote
2 answers
159 views

Why can users just not login with SSH while everything else seems to work?

I have set up a pair of OpenLDAP servers on Ubuntu 20 with directional failover using Syncrepl. Things that an LDAP user can successfully do include: login su - <uid> remote bind from ...
user avatar
0 votes
0 answers
40 views

Linux pam_time with groups

How do I allow /etc/security/time.conf to be able to restrict groups instead of users? It works flawlessly with users but not with groups. I need to have multiple groups in my case.
user avatar
0 votes
1 answer
344 views

PAM authentication - automatically create user?

I've finally got LDAP auth working on Ubuntu 18.04, however it only works if I first create the local user account (eg john.smith). If I don't create the account first, it fails to bind to the LDAP ...
user avatar

1
2 3 4 5
15