Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

pam_unix logs: xrdp-sesman:session session opened for user USERNAME(uid) by (uid=0)

recently I found a lot of these type of logs: pam_unix(xrdp-sesman:session): session opened for user username(uid=some_uid) by (uid=0) From what I read is xrdp-sesmam-session that is "opening&...
18 votes
1 answer
87k views

Connection closed by UNKNOWN port 65535 when SSH using AD Creds on RHEL Machine

Recently I installed PAM & all the necessary packages needed to enable ssh authentication via AD on my RHEL 7.5 machines. When I try to SSH using "ssh user@domainname@hostname" it asks ...
3 votes
1 answer
9k views

id: user: no such user

I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
1 vote
2 answers
454 views

pam: reducing auth method timeout

I have set up user fingerprint auth on Fedora 37 laptops. With fingerprint auth as default auth choice, pam is waiting by default for 10 seconds for a valid fingerprint. Now, I would like to reduce ...
2 votes
3 answers
4k views

Google-authenticator with openvpn - AUTH: Received control message: AUTH_FAILED

I'm trying to set up MFA with Google authenticator for my OpenVPN setup on Ubuntu 16.04. Now OpenVPN works fine until I bring Google Authenticator into the mix. My server.conf file reads as follows: ...
2 votes
3 answers
6k views

Postfix smtpd won't talk to saslauthd

I have an saslauthd setup to authenticate against PAM. It seems to do its stuff: root@sasltest:~# testsaslauthd -u quest -p #### -s smtp 0: OK "Success." I have libsasl 2.1.23, postfix 2.7.1. I ...
0 votes
0 answers
109 views

Disabling Password Login for Root User via PAM on Ubuntu Server

I have a Ubuntu Server (Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-1049-oracle aarch64) specfically), Where I am hosting a few projects, I am somewhat novice in the sysadmin space, but know some basics for ...
2 votes
1 answer
7k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = email@...
1 vote
1 answer
4k views

libpam-ldapd not looking for secondary groups

I'm migrating from libpam-ldap to libpam-ldapd. I'm having some trouble gathering the secondary groups from LDAP. On libpam-ldap, I had this on the /etc/ldap.conf file: nss_schema rfc2307bis ...
0 votes
1 answer
437 views

Keycloak Integration with a Linux Server

I've set up a Keycloak server and I'm working on integrating it with a Linux server to allow users from Keycloak to authenticate into the Linux server using their Keycloak credentials. Ideally, I'd ...
0 votes
2 answers
6k views

openvpn pam authentication failure

I am trying to setup PAM authentication on my openVPN instance running on Ubuntu Server 15.04 but i keep getting an authentication failed error, am i missing anything? server.conf port 1194 proto ...
0 votes
1 answer
106 views

Postfix - SASL Cyrus saslauthd authentication failed

Goal: Configure smtpd to authenticate connections by using postfix, cyrus, saslauthd, pam and mysql. Investigation Authentication via courier-pop3 & courier-imap using mysql works saslauthd ...
0 votes
2 answers
564 views

OpenVPN + PAM + Freeradius

Situation: I have fully configured and working Freeradius server. Installed OVPN 2.6.4 on other server. And goal is auth through Radius. Installed pam-radius-auth. Configured (confs below). ...
0 votes
0 answers
142 views

Unable to connect via SSH or access NFS exports

This one has me puzzled, I've got a home server (Debian Bookworm) and several Raspberry Pi machines, also all running Raspbian Bookworm. Just for illustrative purposes ServerA Debian Bookworm PI1, ...
0 votes
0 answers
130 views

Debian 12 Use Yubikey OR Password for sudo authentication

Using Debian12 Hi I want to know if I can use Yubikey OR Password for sudo authentication. So basically if I do sudo date I want to immediately get a prompt for the password but at the same time be ...
0 votes
0 answers
27 views

Different results for NSS depending on where the user is logged in

When I call getpwuid it returns data from where NSS told it. In a PAM enabled system, we can authenticate a user logged in from console differently with a user logged in via ssh, but with NSS it is ...
1 vote
1 answer
5k views

pam_mount not working when logging in from ssh or console

okay so i configured pam_mount on my centos 6 machine as i did on my centos 7 and 5 machines. But when i login locally or via ssh, pam_mount can't mount my home dir. when i login with a local user, ...
2 votes
1 answer
4k views

Google Authenticator FreeRADIUS

I'm trying to implement google authenticator PAM module in FreeRADIUS on RHEL7. I've loosely followed this guide: http://www.supertechguy.com/help/security/freeradius-google-auth The reason I say ...
0 votes
0 answers
91 views

Multiuser SMB Mount on Red Hat: Users Seeing Each Other's Folders Despite Separate cifscreds

We are attempting to mount a Windows file system on a Red Hat 9 machine. This Windows file system contains hundreds of accounts with finely tuned access rights. We are trying to implement the ...
0 votes
0 answers
2k views

Unable to login via SSH to a Linux machine with my LDAP credentials

I am trying to setup LDAP for users to login to Linux machines. I can change the users to any given users in the LDAP list of users using the su command. A new directory is created as well. So I'm ...
0 votes
1 answer
71 views

Forbid characters in Ubuntu password

How can I forbid an user to set a password with e.g. the german Umlaut characters äöüÄÜÖß on a Ubuntu 22.04 ? Even the non-Ubuntu pam regex module can only regex on usernames and not on passwords.
0 votes
1 answer
238 views

Cannot passwd for root with nslcd and openldap on Debian 12

Fresh Debian 12 for lab (VM). I installed: slapd, phpldapadmin, nslcd, nscd and dependencies. I have two local accounts: root and user1. Also I have only user1 POSIX-account on local LDAP server. I ...
2 votes
1 answer
222 views

Access of users using google-authenicator without token

I'm using google authenticator pam module on CentOS to create a 2FA authentication for my users, however, I want that only the users that have already registered with the authenticator are asked to ...
2 votes
2 answers
20k views

How to configure PAM to authenticate SSH logins with (password & OTP) or (public key & OTP)

My goal is to develop an ansible playbook to deploy multifactor ssh logins of the type (public key and OTP) or (password and OTP) on Ubuntu Server 18.04 hosts. I followed the guide here and it ...
0 votes
0 answers
29 views

Different LDAP Filters for Separate Services in SSSD

I'd like to use LDAP in SSSD for two separate services on the same server. Specifically, I'd like to use one LDAP group for SSH access and a separate LDAP group for access to a web portal. It only ...
0 votes
1 answer
157 views

After run sudo and/or su or su - command, the command prompt not loaded, however the switch user is successful

I saw a maybe similar thread but not sure there the issue is the same: su command not responding? I have an Ubuntu 20.04 LTS baremetal server. After run sudo and/or su or su - command, the command ...
0 votes
0 answers
113 views

OpenVPN setup with MS authenticator

I have set up openvpn with active directory authentization in our company. Now I set up microsoft atuhenticator (in pam.d with pam_unix.so and pam_google_authenticator.so). It is working fine. Is some ...
12 votes
2 answers
9k views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
2 votes
1 answer
3k views

Postfix+saslauthd: pam_unix(smtp:auth): authentication failure

I'm run postfix 2.10 + Cyrus sasl 2.1 + Dovecot 2.2 on Oracle Linux 7. Dovecot works with saslauthd normally, but Postfix always failed on authentication, wish someone can help to check what problem ...
1 vote
2 answers
2k views

How can I change the directory in wich pam_mkhomedir creates the user's home directories?

I am using pam_mkhomedir to automatically create user's home directories when they first log in. However, the home directories are created inside the /home directory, while i need them to be created ...
0 votes
0 answers
181 views

sudo su - has a 5 minute delay should I pop back to original use

We are working with ROcky linux 8.6 - when we type sudo su - we are prompted for login and we get to root user no problem. if we type exit we go back to the original user as is expected. If we type ...
0 votes
1 answer
52 views

How change temporary primary group for user when user connect to samba?

I have samba connected via Winbind to AD. Historically, all unix enabled users has wrong primary group. May I change while user connected to samba primary group to one of the users secondary? It could ...
3 votes
3 answers
2k views

how to require publickey and otp, or password and otp when logging in with ssh?

I'm trying to get ssh to work in a way where password auth can be skipped with a key, and in addition every login would be followed up with totp using google's libpam on my new debian 9 installation. ...
5 votes
1 answer
1k views

Why can't I use pam_echo.so in the sudo pam stack?

I have a CentOS 7 machine where I'd like to display a message when authentication fails during sudo. I tried to do this by adding a pam_echo line in /etc/pam.d/sudo. For testing, I created a file, /...
0 votes
0 answers
30 views

avoid leaking info whether the user is denied access or typed the incorrect password

I am currently tinkering with the sshd_config and /etc/security/access.d for a large system with 10k+ users. There are so many different ways of restricting user access and it makes my head spin a bit ...
0 votes
1 answer
736 views

Refresh kerberos ticket instead of prompting for pam password

Using centralised auth against FreeIPA is working great. In order to use Kerberos SSO when using ssh, scp etc from jumphosts users must initiate their Kerberos tickets first with kinit. I've added ...
0 votes
0 answers
184 views

Using shadow password from LDAP while using SSSD for identity

I'd like to use SSSD ldap as a provider for shadow entries. It seems to be supported, given the default config with sssd installed adds sss to both passwd and shadow in nsswitch.conf, but I can't get ...
1 vote
1 answer
153 views

OpenLDAP ppolicy working with passwd, but not ldappasswd

I've been working on this for about a week, and can't seem to figure out why this is happening. I've got passwd working, letting users change their own ldap password from a client machine, and it ...
1 vote
0 answers
167 views

Can't authorise commands via tacacs+ server executed in shell by ssh

I've setup a tacacs+ server and a PAM tacacs client from here- https://github.com/kravietz/pam_tacplus/tree/main. When user ssh into the tacacs client machine, I want authentication from tacacs+ ...
7 votes
5 answers
64k views

PBIS Open AD authentication stops working on ubuntu with errors: "user accout has expired" and "is your account locked?"

We have been using PowerBroker Identity Services Open to authenticate active directory users from ubuntu hosts successfully for six months. Recently AD authentication stopped working on several ...
0 votes
1 answer
1k views

Trouble with password rules in Linux-PAM

Ubuntu 20.04. I've installed pam_pwquality.so. Here's the contents of /opt/pam.d/common-password: password required pam_pwquality.so retry=1 minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 ...
0 votes
0 answers
245 views

Redhat Linux 8.5: Upgrading to OpenSSH 9.2 sees '/bin/bash: Permission denied' with root login

After successfully make-installed OpenSSH from source followed detailed instructions from a post of online community (version checked ok), only to see /bin/bash: Permission denied at root login. ...
0 votes
0 answers
51 views

Caching sessions with pam_timestamp on ubuntu

I am trying to use PAM and the pam_timestamp module to reduce the number of passwords I need to enter. Test program via https://learning.oreilly.com/library/view/linux-security-cookbook/0596003919/...
1 vote
0 answers
287 views

How to setup pam on debian 11

I have installed debian 11 and pam-ldapd. Now, I want to setup authenticating for openvpn with pam. When I wanted to test it with 'getent passwd' command, I got only local users response. Can you help ...
0 votes
0 answers
129 views

vsftpd with MySQL 8 - login not working

I try to set up vsftpd using MySQL database for login users via pam.d I have this config in /etc/pam.d/vsftpd: # Standard behaviour for ftpd(8). auth required pam_listfile.so item=user sense=...
5 votes
1 answer
1k views

pam_tty_audit and non privileged users

I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file: session ...
0 votes
0 answers
139 views

Control sudoers using oidc user data

I am implementing a Linux host login using the OpenID Connect PAM module. I use Keycloak as OIDC Identity Provider. Googling, I didn't find a solution to control the sudoers file using OIDC data (like ...
0 votes
1 answer
641 views

Dovecot auth-worker logs fails but log in works

Everytime a log in occurs I get three log lines: Mar 19 15:29:05 auth-worker(6379): Info: pam([email protected],124.1.1.1,<AL/fkjf3yr98xTrl>): pam_authenticate() failed: Authentication failure (...
5 votes
2 answers
718 views

PAM vs /etc/shadow in Dovecot SASL configuration - Security differences?

I set up a server with Postfix SMTP auth through Dovecot SASL. However, it was not possible to get the PAM authentification working as standard out of the box. So more by chance, I changed it to ...
0 votes
1 answer
662 views

Best practices to completely disable LDAP users' access to mixed services with mixed authentication methods?

Background We use LDAP in our department to authenticate users to various services including web apps as well as Linux servers (via SSH).  When a user leaves the department, we should disable their ...

1
2 3 4 5
16