Questions tagged [pam]
Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
758
questions
0
votes
0
answers
6
views
pam_unix logs: xrdp-sesman:session session opened for user USERNAME(uid) by (uid=0)
recently I found a lot of these type of logs:
pam_unix(xrdp-sesman:session): session opened for user username(uid=some_uid) by (uid=0)
From what I read is xrdp-sesmam-session that is "opening&...
18
votes
1
answer
87k
views
Connection closed by UNKNOWN port 65535 when SSH using AD Creds on RHEL Machine
Recently I installed PAM & all the necessary packages needed to enable ssh authentication via AD on my RHEL 7.5 machines.
When I try to SSH using "ssh user@domainname@hostname" it asks ...
3
votes
1
answer
9k
views
id: user: no such user
I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
1
vote
2
answers
454
views
pam: reducing auth method timeout
I have set up user fingerprint auth on Fedora 37 laptops.
With fingerprint auth as default auth choice, pam is waiting by default for 10 seconds for a valid fingerprint. Now, I would like to reduce ...
2
votes
3
answers
4k
views
Google-authenticator with openvpn - AUTH: Received control message: AUTH_FAILED
I'm trying to set up MFA with Google authenticator for my OpenVPN setup on Ubuntu 16.04. Now OpenVPN works fine until I bring Google Authenticator into the mix.
My server.conf file reads as follows:
...
2
votes
3
answers
6k
views
Postfix smtpd won't talk to saslauthd
I have an saslauthd setup to authenticate against PAM. It seems to do its stuff:
root@sasltest:~# testsaslauthd -u quest -p #### -s smtp
0: OK "Success."
I have libsasl 2.1.23, postfix 2.7.1.
I ...
0
votes
0
answers
109
views
Disabling Password Login for Root User via PAM on Ubuntu Server
I have a Ubuntu Server (Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-1049-oracle aarch64) specfically), Where I am hosting a few projects, I am somewhat novice in the sysadmin space, but know some basics for ...
2
votes
1
answer
7k
views
How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?
Fail2Ban on Ubuntu 10.04
Configuration files
/etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1
bantime = 10 # made for test purposes
maxretry = 3
backend = polling
destemail = email@...
1
vote
1
answer
4k
views
libpam-ldapd not looking for secondary groups
I'm migrating from libpam-ldap to libpam-ldapd. I'm having some trouble gathering the secondary groups from LDAP.
On libpam-ldap, I had this on the /etc/ldap.conf file:
nss_schema rfc2307bis
...
0
votes
1
answer
437
views
Keycloak Integration with a Linux Server
I've set up a Keycloak server and I'm working on integrating it with a Linux server to allow users from Keycloak to authenticate into the Linux server using their Keycloak credentials.
Ideally, I'd ...
0
votes
2
answers
6k
views
openvpn pam authentication failure
I am trying to setup PAM authentication on my openVPN instance running on Ubuntu Server 15.04 but i keep getting an authentication failed error,
am i missing anything?
server.conf
port 1194
proto ...
0
votes
1
answer
106
views
Postfix - SASL Cyrus saslauthd authentication failed
Goal: Configure smtpd to authenticate connections by using postfix, cyrus, saslauthd, pam and mysql.
Investigation
Authentication via courier-pop3 & courier-imap using mysql works
saslauthd ...
0
votes
2
answers
564
views
OpenVPN + PAM + Freeradius
Situation:
I have fully configured and working Freeradius server.
Installed OVPN 2.6.4 on other server. And goal is auth through Radius.
Installed pam-radius-auth. Configured (confs below).
...
0
votes
0
answers
142
views
Unable to connect via SSH or access NFS exports
This one has me puzzled, I've got a home server (Debian Bookworm) and several Raspberry Pi machines, also all running Raspbian Bookworm. Just for illustrative purposes
ServerA Debian Bookworm
PI1, ...
0
votes
0
answers
130
views
Debian 12 Use Yubikey OR Password for sudo authentication
Using Debian12
Hi I want to know if I can use Yubikey OR Password for sudo authentication.
So basically if I do sudo date I want to immediately get a prompt for the password but at the same time be ...
0
votes
0
answers
27
views
Different results for NSS depending on where the user is logged in
When I call getpwuid it returns data from where NSS told it. In a PAM enabled system, we can authenticate a user logged in from console differently with a user logged in via ssh, but with NSS it is ...
1
vote
1
answer
5k
views
pam_mount not working when logging in from ssh or console
okay so i configured pam_mount on my centos 6 machine as i did on my centos 7 and 5 machines.
But when i login locally or via ssh, pam_mount can't mount my home dir. when i login with a local user, ...
2
votes
1
answer
4k
views
Google Authenticator FreeRADIUS
I'm trying to implement google authenticator PAM module in FreeRADIUS on RHEL7.
I've loosely followed this guide: http://www.supertechguy.com/help/security/freeradius-google-auth
The reason I say ...
0
votes
0
answers
91
views
Multiuser SMB Mount on Red Hat: Users Seeing Each Other's Folders Despite Separate cifscreds
We are attempting to mount a Windows file system on a Red Hat 9 machine. This Windows file system contains hundreds of accounts with finely tuned access rights.
We are trying to implement the ...
0
votes
0
answers
2k
views
Unable to login via SSH to a Linux machine with my LDAP credentials
I am trying to setup LDAP for users to login to Linux machines. I can change the users to any given users in the LDAP list of users using the su command. A new directory is created as well. So I'm ...
0
votes
1
answer
71
views
Forbid characters in Ubuntu password
How can I forbid an user to set a password with e.g. the german Umlaut characters äöüÄÜÖß on a Ubuntu 22.04 ?
Even the non-Ubuntu pam regex module can only regex on usernames and not on passwords.
0
votes
1
answer
238
views
Cannot passwd for root with nslcd and openldap on Debian 12
Fresh Debian 12 for lab (VM). I installed: slapd, phpldapadmin, nslcd, nscd and dependencies.
I have two local accounts: root and user1. Also I have only user1 POSIX-account on local LDAP server.
I ...
2
votes
1
answer
222
views
Access of users using google-authenicator without token
I'm using google authenticator pam module on CentOS to create a 2FA authentication for my users, however, I want that only the users that have already registered with the authenticator are asked to ...
2
votes
2
answers
20k
views
How to configure PAM to authenticate SSH logins with (password & OTP) or (public key & OTP)
My goal is to develop an ansible playbook to deploy multifactor ssh logins of the type (public key and OTP) or (password and OTP) on Ubuntu Server 18.04 hosts.
I followed the guide here and it ...
0
votes
0
answers
29
views
Different LDAP Filters for Separate Services in SSSD
I'd like to use LDAP in SSSD for two separate services on the same server. Specifically, I'd like to use one LDAP group for SSH access and a separate LDAP group for access to a web portal. It only ...
0
votes
1
answer
157
views
After run sudo and/or su or su - command, the command prompt not loaded, however the switch user is successful
I saw a maybe similar thread but not sure there the issue is the same:
su command not responding?
I have an Ubuntu 20.04 LTS baremetal server.
After run sudo and/or su or su - command, the command ...
0
votes
0
answers
113
views
OpenVPN setup with MS authenticator
I have set up openvpn with active directory authentization in our company.
Now I set up microsoft atuhenticator (in pam.d with pam_unix.so and pam_google_authenticator.so).
It is working fine.
Is some ...
12
votes
2
answers
9k
views
Adding local users / passwords on Kerberized Linux box
Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
2
votes
1
answer
3k
views
Postfix+saslauthd: pam_unix(smtp:auth): authentication failure
I'm run postfix 2.10 + Cyrus sasl 2.1 + Dovecot 2.2 on Oracle Linux 7.
Dovecot works with saslauthd normally, but Postfix always failed on authentication, wish someone can help to check what problem ...
1
vote
2
answers
2k
views
How can I change the directory in wich pam_mkhomedir creates the user's home directories?
I am using pam_mkhomedir to automatically create user's home directories when they first log in.
However, the home directories are created inside the /home directory, while i need them to be created ...
0
votes
0
answers
181
views
sudo su - has a 5 minute delay should I pop back to original use
We are working with ROcky linux 8.6 -
when we type sudo su - we are prompted for login and we get to root user no problem.
if we type exit we go back to the original user as is expected.
If we type ...
0
votes
1
answer
52
views
How change temporary primary group for user when user connect to samba?
I have samba connected via Winbind to AD. Historically, all unix enabled users has wrong primary group.
May I change while user connected to samba primary group to one of the users secondary? It could ...
3
votes
3
answers
2k
views
how to require publickey and otp, or password and otp when logging in with ssh?
I'm trying to get ssh to work in a way where password auth can be skipped with a key, and in addition every login would be followed up with totp using google's libpam on my new debian 9 installation.
...
5
votes
1
answer
1k
views
Why can't I use pam_echo.so in the sudo pam stack?
I have a CentOS 7 machine where I'd like to display a message when authentication fails during sudo. I tried to do this by adding a pam_echo line in /etc/pam.d/sudo.
For testing, I created a file, /...
0
votes
0
answers
30
views
avoid leaking info whether the user is denied access or typed the incorrect password
I am currently tinkering with the sshd_config and /etc/security/access.d for a large system with 10k+ users. There are so many different ways of restricting user access and it makes my head spin a bit ...
0
votes
1
answer
736
views
Refresh kerberos ticket instead of prompting for pam password
Using centralised auth against FreeIPA is working great. In order to use Kerberos SSO when using ssh, scp etc from jumphosts users must initiate their Kerberos tickets first with kinit. I've added ...
0
votes
0
answers
184
views
Using shadow password from LDAP while using SSSD for identity
I'd like to use SSSD ldap as a provider for shadow entries. It seems to be supported, given the default config with sssd installed adds sss to both passwd and shadow in nsswitch.conf, but I can't get ...
1
vote
1
answer
153
views
OpenLDAP ppolicy working with passwd, but not ldappasswd
I've been working on this for about a week, and can't seem to figure out why this is happening.
I've got passwd working, letting users change their own ldap password from a client machine, and it ...
1
vote
0
answers
167
views
Can't authorise commands via tacacs+ server executed in shell by ssh
I've setup a tacacs+ server and a PAM tacacs client from here- https://github.com/kravietz/pam_tacplus/tree/main.
When user ssh into the tacacs client machine, I want authentication from tacacs+ ...
7
votes
5
answers
64k
views
PBIS Open AD authentication stops working on ubuntu with errors: "user accout has expired" and "is your account locked?"
We have been using PowerBroker Identity Services Open to authenticate active directory users from ubuntu hosts successfully for six months.
Recently AD authentication stopped working on several ...
0
votes
1
answer
1k
views
Trouble with password rules in Linux-PAM
Ubuntu 20.04.
I've installed pam_pwquality.so.
Here's the contents of /opt/pam.d/common-password:
password required pam_pwquality.so retry=1 minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 ...
0
votes
0
answers
245
views
Redhat Linux 8.5: Upgrading to OpenSSH 9.2 sees '/bin/bash: Permission denied' with root login
After successfully make-installed OpenSSH from source followed detailed instructions from a post of online community (version checked ok), only to see /bin/bash: Permission denied at root login.
...
0
votes
0
answers
51
views
Caching sessions with pam_timestamp on ubuntu
I am trying to use PAM and the pam_timestamp module to reduce the number of passwords I need to enter.
Test program via https://learning.oreilly.com/library/view/linux-security-cookbook/0596003919/...
1
vote
0
answers
287
views
How to setup pam on debian 11
I have installed debian 11 and pam-ldapd.
Now, I want to setup authenticating for openvpn with pam. When I wanted to test it with 'getent passwd' command, I got only local users response.
Can you help ...
0
votes
0
answers
129
views
vsftpd with MySQL 8 - login not working
I try to set up vsftpd using MySQL database for login users via pam.d
I have this config in /etc/pam.d/vsftpd:
# Standard behaviour for ftpd(8).
auth required pam_listfile.so item=user sense=...
5
votes
1
answer
1k
views
pam_tty_audit and non privileged users
I'm working on a cents 6.3 box and am trying to log all commands executed from a bash shell and came across pam_tty_audit. I've added the appropriate line to my /etc/pam.d/system-auth file:
session ...
0
votes
0
answers
139
views
Control sudoers using oidc user data
I am implementing a Linux host login using the OpenID Connect PAM module. I use Keycloak as OIDC Identity Provider. Googling, I didn't find a solution to control the sudoers file using OIDC data (like ...
0
votes
1
answer
641
views
Dovecot auth-worker logs fails but log in works
Everytime a log in occurs I get three log lines:
Mar 19 15:29:05 auth-worker(6379): Info: pam([email protected],124.1.1.1,<AL/fkjf3yr98xTrl>): pam_authenticate() failed: Authentication failure (...
5
votes
2
answers
718
views
PAM vs /etc/shadow in Dovecot SASL configuration - Security differences?
I set up a server with Postfix SMTP auth through Dovecot SASL. However, it was not possible to get the PAM authentification working as standard out of the box.
So more by chance, I changed it to ...
0
votes
1
answer
662
views
Best practices to completely disable LDAP users' access to mixed services with mixed authentication methods?
Background
We use LDAP in our department to authenticate users to various services including web apps as well as Linux servers (via SSH). When a user leaves the department, we should disable their ...