Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

1
vote
0answers
23 views

FreeIPA : new/existing accounts expired when ssh'ing into replica

I have two FreeIPA servers running on Centos 7 - one a master the other a replica. I can create a new user account on the master using e.g. the GUI and it appears on both servers, is active and not ...
1
vote
0answers
12 views

User Resource management: cgroups + systemd + ssh

I am trying to limit the memory of a single user that keeps crashing our OpenSuse Server. What I have done is as desribed here, to modify the limit of the user's slice via systemctl set-property ...
0
votes
0answers
40 views

Ubuntu 18.04 server - how to change or adjust operating system logging for a certain systemd service?

I've tried quite a bit of Googling on this but have not come up with much so I figured I'd ask here. Here's my current problem: I'm running Ubuntu 18.04 server pretty much stock. The purpose of the ...
2
votes
1answer
39 views

PAM with pam_krb5 to authenticate nginx requests

I am aware of the gazzilion pam / nginx questions here and on "Unix/Linux" but they are either unanswered or not related to my setup - so i try again :) TL;dr While the setup works perfectly with an ...
0
votes
1answer
60 views

SELinux: pam_systemd(sudo:session): Failed to connect to system bus: Permission denied

On one of CentOS 7 servers I cannot perform sudo from nrpe user (Nagios daemon remote monitoring). Error message: Dec 31 08:28:10 ip-172-31-36-176 sudo: pam_unix(sudo:session): session opened for ...
0
votes
0answers
34 views

vsftpd and PAM 500 error

I have a fresh install of VSFTPd and PAM setup, Account #1 connects i can read and write with www-data:customgroup files to /ect/www/$USER Account #2 cannot connect at all. Provides a 530 login ...
0
votes
0answers
22 views

TightVNC Server sometimes fail to start on RHEL7.4

I've a RHEL 7.4 box with TightVNC service enabled on boot and sometimes the service fails to start with a PAM permission denied error: systemd[2027]: pam_nologin(login:account): conversation failed ...
1
vote
0answers
20 views

pam_access using netgroup for host origin

I would like to be able to use: + : @user_netgroup : @host_netgroup in my access.conf, but this seems to fail due to pam_access not supporting host netgroups. If I substitute an IP or fully ...
0
votes
1answer
52 views

sshd: Disable PAM authentication for period of time after successful login

We're using public key authentication in combination with the Yubico pam for our servers. Is it possible to temporarily (e.g. 1 minute) skip the Yubico pam for subsequent authentications when a user ...
2
votes
1answer
49 views

AWS Amazon AMI - Restrict SFTP/SSH access

I have an AWS Amazon Linux EC2 instance running with sftp/ftp server (vsftp). For security purposes I want to protect the system with the best practise solution for AWS instances. My goal is to ...
1
vote
1answer
115 views

how to require publickey and otp, or password and otp when logging in with ssh?

I'm trying to get ssh to work in a way where password auth can be skipped with a key, and in addition every login would be followed up with totp using google's libpam on my new debian 9 installation. ...
0
votes
0answers
33 views

pam_ldap detecting expiring password on Active Directory

I am maintaining some code that uses: pam_ldap version 186 which compiles against openldap 2.4.40 We are using Active Directory on Windows 2012 for the LDAP backend. pam_ldap successfully ...
1
vote
1answer
64 views

pam_tally2 incrememts before password for su attempts

There is a similar behavior here but I believe this is a different underlying cause, or at least requires a different solution since this failure isn't due to SSH keys. Our company is undergoing a ...
0
votes
0answers
49 views

SSH Auth through sssh

i have openldap and rhel7.4. My problem is i would like ssh authentication through sssd. At this point : sssd.conf [sssd] config_file_version = 2 services = nss, pam domains = MYDOMAIN.FR [domain/...
1
vote
0answers
17 views

What pam.d file does HP iLO Text Console use?

We are in an environment where kerberos authentication is being enforced by our security team. We are deploying RHEL 7.4. In the event of authentication servers being unreachable (preventing ssh ...
-4
votes
1answer
168 views

Implementing Kerberos Authentication on Linux servers using script [closed]

My client wants to implement Kerberos Authentication on multiple Oracle Linux Boxes. Do they need to be done manually or can I implement on all of them using any script? Is there any way to script ...
0
votes
0answers
21 views

PAM: pam_nfc login lightdm

I want my users to be log into a workstation using their nfc-card. I have a test-setup with raspbian. I compiled and installed both libnfc pam_nfc. My reader is a 072f:2200 Advanced Card Systems, Ltd ...
0
votes
1answer
76 views

PAM deny rule not applied on Ubuntu in Google Cloud

I added auth requisite pam_deny.so as the first line of every file in /etc/pam.d/ (including sshd), but SSH connections still succeed without a problem. This is on a default Google Cloud Ubuntu ...
0
votes
0answers
13 views

proftpd UserAlias not working on Centos 7 - possibly pam related

I am unable to use UserAlias on my proftpd server on Centos7. The problem appears to be related to pam.d. I've been looking at this the whole day, so I am asking for help. I have followed this on an ...
0
votes
1answer
145 views

FTP PAM Setup for VSFTPD

OK. I know this is one of the most asked questions here. But most answers are either telling me to add nologin to allowed shells (nope... not doing that) or disabling SELinux (which i don't have - ...
0
votes
0answers
107 views

CentOS sudo fail when using pam_faillock.so

This refers to another question at sudo does not prompt for password and reports 3 incorrect password attempts The problem is, when the following line was added to /etc/pam.d/system-auth-ac to fix ...
0
votes
0answers
118 views

Issues with PAM and CRON

On domain joined ubuntu 16.04, I would like to restrict users to AD groups, so I have the following lines additionally in my /etc/pam.d/common-auth (before the default ones, via /usr/share/pam-configs/...
1
vote
0answers
427 views

OpenVPN 2.4 + Google Authenticator = authentication failure

We have a corporate VPN server running OpenVPN 2.3 on an AWS instance with Ubuntu 16.04 Xenial. The server has been configured using an Ansible playbook. I'm planning to upgrade to Ubuntu 18.04 ...
0
votes
1answer
508 views

pam_mount home directories over cifs, sssd and Bionic Beaver

I've configured a Ubuntu Bionic Beaver client to authenticate against a Samba ADS (Zentyal), using sssd. This guide was more or less all it took to get there. EDIT: see my answer to get a quote of the ...
0
votes
0answers
47 views

PAM config for privilege escalation GUI

In Unity when you make a change to something like the "Unlock" button in the Add Users GUI, a window pops up to login as a privileged user. What is the pam config in /etc/pam.d that this privilege ...
1
vote
1answer
24 views

Access of users using google-authenicator without token

I'm using google authenticator pam module on CentOS to create a 2FA authentication for my users, however, I want that only the users that have already registered with the authenticator are asked to ...
2
votes
1answer
90 views

Cannot login with account on RHEL 7.5 server with DISA STIG Profile enabled

This has happened several times now, and I am getting frustrated. I don't know how it happens, but sometimes a user account gets locked out. I change their passwd, either through passwd or chpasswd. ...
0
votes
0answers
171 views

What is wrong with this pam_ldap configuration?

I've set up LDAP auth for PAM on an Ubuntu 16.04 machine. I can't log in over SSH even though I know the password is correct. My goal is to have a list of local users, and anyone having an account on ...
1
vote
0answers
47 views

pam_winbind: unknown option require_membership_of

I'm trying to configure the VSFTPD with Winbind to restrict users authenticated by Active Directory, only to those that belong to specific group. I'm using a generic conf file for the vsftpd, with ...
0
votes
0answers
638 views

Connection closed by UNKNOWN port 65535 when SSH using AD Creds on RHEL Machine

Recently I installed PAM & all the necessary packages needed to enable ssh authentication via AD on my RHEL 7.5 machines. When I try to SSH using "ssh user@domainname@hostname" it asks for my ...
2
votes
1answer
418 views

Managing /etc/security/access.conf with ansible

New to Ansible and have several machines which make use of the pam_access module which is configured in /etc/security/access.conf. Multiple lines specifying ALLOW/DENY (+/-) and then either users or ...
0
votes
1answer
224 views

Authenticated with SSSD (LDAP) but use /etc/passwd after login

I have the following setting: I have users in two different domains from two different organizations (separated AD installations) with users user@DOMAIN and user@OTHERDOMAIN On the system, these ...
2
votes
1answer
166 views

Modifying pam with Ansible

As part of a new server setup, I provision /etc/security/access.conf with user/group and src IP addresses of allowed ssh logins. This requires enabling pam_access in the /etc/pam.d/login and /etc/pam....
1
vote
1answer
145 views

Linux Cluster with LDAP, automatically and simultaneously creating homedir on multiple machines

I'm setting up a computer cluster of (20+) machines, I have a working central ldap server for authenticating users and keeping GID and UID synced across the cluster. One machine acts as a head node, ...
1
vote
0answers
33 views

Sync users on Debian with Active Directory

I would like to be able to dynamically manage accounts on a Debian box that I am building. For this I think a possible solution is to have the box on our Windows domain and sync with a user group on ...
0
votes
0answers
20 views

NIS Server or Client Mandate Password Requrements

I have a few legacy Red Hat 6 installation that use NIS for user management. Due to some new requirements for these system I need to have the NIS users passwords be set to a minimum length and have ...
2
votes
1answer
171 views

Vsftpd/pam_userdb.so - auto-create virtual user home directories

Setup: Amazon Linux EC2 vsftpd PAM authentication with pam_userdb.so Usernames/passwords written to Berkeley user db from an external source (lsyncd). There are many 1000s of virtual users, to date ...
0
votes
0answers
88 views

Configuring PAM to access a Kerberized cluster

I have the following situation: I have a server running RHEL 7.4. This server's main purpose is to host an RStudio Server Pro instance, which allows users to connect to a kerberized Hadoop cluster in ...
1
vote
1answer
205 views

Cannot connect to Centos 7 server (PAM)

After attempting to install a PAM module (my first), i've been having this issue. I ended up removing it because the module was broken which resulted in users not being able to access the system. Now ...
0
votes
0answers
342 views

Login/permissions problems after installing Kerberos client

Login/permissions problems after installing Kerberos client After setting up a kerberos server (on a separate machine) and installing kerberos client on Ubuntu 16.04 desktop (and laptop), I have ...
1
vote
0answers
289 views

Roundcube IMAP log — NO [AUTHENTICATIONFAILED] Authentication failed

system: Ubuntu 17.10 This is the error I am getting when trying to log in log-file /var/lib/roundcube/logs/imap: [17-Apr-2018 22:03:13 -0700]: <3aedeusd> [1116] S: * OK [CAPABILITY IMAP4rev1 ...
0
votes
0answers
478 views

OpenVPN + Google Authenticator MFA

I'm currently using the following OpenVPN: https://github.com/Nyr/openvpn-install What's the best way to enable MFA with Google Authenticator? I'm currently using the following server config at /...
0
votes
1answer
199 views

Why am I not seeing the user lockout message?

When I try to login 3 times with the wrong password (locally), instead of seeing user locked out message: su - myuser Account locked due to 3 failed logins I see this: [myuser@ip-10-10-2-53 ~]$ su -...
2
votes
2answers
575 views

How to use PAM to manage lockout policy for ssh public key authentication methods

I have followed instructions on redhat on how to harden authentication on a linux server, but we only use SSH with public key auth. According to these instructions: https://access.redhat.com/...
0
votes
0answers
67 views

Ignore pam_authz_search for a specific service

It is possible to use pam_authz_search option in libpam-ldapd nslcd config file to filter authentication attempts based on a custom pattern. Is it possible to make specific service to be exempt from ...
0
votes
0answers
121 views

OpenLDAP 2.4.44 Authentication on CentOS/RHEL 7

I have OpenLDAP 2.4.44 running on CentOS 7.4 with a "tester" user added. I can query the user and change the password, but when authenticating with the GNOME login screen is always rejected. I used ...
0
votes
0answers
125 views

Authenticate and mount home using ssh and nfs

How would I go about trying to authenticate a user against a particular system and then mounting his tree using NFS. The user would have his own desktop and when the user goes to work on a separate ...
0
votes
0answers
33 views

PAM TTY does not work with LDAP users

We use IPA for central authentication and all the users are based via LDAP. PAM_TTY works generally fine for local users however for users which are based on LDAP, it does not seem to works and none ...
1
vote
0answers
30 views

Access to http restricted area using private key

In my Apache configuration (Ubuntu Server), i have the following settings: AddExternalAuth pwauth /usr/sbin/pwauth SetExternalAuthMethod pwauth pipe <Directory /secure> ...
0
votes
0answers
32 views

missing reverse resolution in ssh connection

i'm having an issue during the connection via ssh from a windows server to a linux server RH4 using ssh-key pair authentication because the reverse resolution doesn't run here although it runs using ...