Questions tagged [pam]
Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
69
questions
27
votes
2
answers
21k
views
Understand PAM and NSS
In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
5
votes
2
answers
20k
views
VsFTPd - LDAP - PAM
I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
5
votes
1
answer
715
views
Use more complex AND/OR structure with PAM
PAM allows to use sufficent and required for some logic, like
auth sufficient pam_a.so
auth required pam_b.so
auth required pam_c.so
which would mean "either a is true, or b must be true and then c ...
42
votes
7
answers
109k
views
Switch on PAM debugging to Syslog
How do I switch on PAM debugging in Debian Squeeze at the admin level?
I have checked every resource I was able to find. Google, manpages, whatever. The only thing I haven't tried yet (I simply not ...
18
votes
1
answer
39k
views
How to authenticate Linux accounts against an Active Directory and mount a Windows share on login?
I'm using Ubuntu 10.04 Server.
18
votes
2
answers
17k
views
open file descriptor limits.conf setting isn't read by ulimit even when pam_limits.so is required
I am trying to raise the open file descriptor maximum for all users on an ubuntu machine.
I've added the following lines to /etc/security/limits.conf:
* soft nofile 100000
...
10
votes
3
answers
20k
views
ldap force user to change password
I am using CentOS-ds (based off Redhat-DS and 389 directory servers).
I have LDAP setup, and working to authenticate users (and Sudo, thats a handy feature!). even passwd is working great to change ...
8
votes
3
answers
10k
views
Expired "authentication token" for user with deleted password
The Setup:
1) The user's password was deleted with "passwd -d " command
2) The user has cron jobs running
The Problem:
Once every 30 days (default password expiration policy) the cron fails with an ...
8
votes
3
answers
7k
views
PAM: Execute a command before pam_mkhomedir?
When a user logs into a system and there is no home directory, we would like to to create the user's home directory using pam_mkhomedir. This is a common practice. Here's a quick description of ...
7
votes
2
answers
22k
views
How to use nginx PAM module?
I would like to use nginx PAM module to authenticate a site with existing users on a FreeBSD system. I tried to use pam_unix.so, but no luck. It's just not let me in with my usr/psw pair. :(
nginx ...
7
votes
2
answers
24k
views
Account Lockout with pam_tally2 in RHEL6
I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.)
I expect to see on the ...
6
votes
5
answers
12k
views
Limiting Failed SSH Logins
I would like to limit failure retries on my Fedora machine to 5. I think I can accomplish it with PAM. But was unable to to do this.
I have referred to this article to do this
http://www.puschitz....
4
votes
1
answer
15k
views
Linux nested groups with winbind
We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
3
votes
1
answer
2k
views
SSH locale wrong
I have a debian server with locales set to hu_HU.UTF-8, and if i log in trough console it works perfectly in hungarian. It also worked with ssh logins until i disabled PAM in the sshd config. Since ...
2
votes
3
answers
7k
views
Samba File Server + PAM + Berkeley DB or Samba + PAM
I've set up VSFTPD with PAM and Berkeley DB before using this article. It's a great article and was really easy to walk through setting it up.
Now that I'm setting up Samba, I would like to do the ...
1
vote
1
answer
1k
views
Can I configure pam_ldap without configuring nss?
On my servers I have my system users provisioned with Chef and have no desire to expose any additional users to these machines. I would however like to utilize pam for the authentication backend for ...
45
votes
2
answers
38k
views
Slow ssh login - Activation of org.freedesktop.login1 timed out
On one of my servers I've noticed really delay on SSH logins.
Connecting using the ssh -vvv options the delay occurs at debug1: Entering interactive session.
extract of connection:
debug1: ...
33
votes
7
answers
134k
views
ssh: "Access denied by PAM account configuration" for one non-root user but not another
On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is
...
24
votes
5
answers
62k
views
ulimit -n not changing - values limits.conf has no effect
I am trying to raise the open file descriptor maximum for all users on an ubuntu machine.
This question is somewhat of a follow up to this question.
open file descriptor limits.conf setting isn'...
21
votes
2
answers
23k
views
"success=n" control syntax in pam.conf / pam.d/* files
After sucessfully configuring Kerberos, this is what I've found in /etc/pam.d/common-auth file:
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] ...
20
votes
2
answers
54k
views
How to use the ssh server with PAM but disallow password auth?
Many tutorials tell you to config your ssh server like this:
ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no
but with this setup you cannot use PAM, as i plan to use 2 Factor ...
12
votes
1
answer
50k
views
LDAP authentication on CentOS 7
After upgrading to CentOS 7 it's no longer possible to login via LDAP. With CentOS 6 I used the package pam_ldap which worked fine, but now pam_ldap is no longer available for the new version of ...
12
votes
2
answers
9k
views
Adding local users / passwords on Kerberized Linux box
Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
10
votes
3
answers
13k
views
vsftpd will not accept passwords encrypted with MD5
I am setting up an server with vsftpd to let virtual users access their space. Now it is fully working but only with CRYPT passwords. So
sudo htpasswd -c /etc/vsftpd/ftpd.passwd phpmyadmin
will not ...
7
votes
3
answers
13k
views
LDAP Users Home Directories
I'm trying to setup linux login via an LDAP server.
I have everything working except setting the user's home directory. There is no parameter in the LDAP database that I can map to the ...
7
votes
1
answer
4k
views
Combination of SSH key auth, and two-factor authentication
I was wondering if it is possible to accomplish the following, all at the same time:
Disable root logins
Enable SSH login for personal user, only via SSH keys
Enable SSH login for unprivileged user, ...
6
votes
3
answers
11k
views
Users cannot use crontab after password security upgrade
I have a box being upgraded from CentOS 5 to CentOS 6. On the original server, all users have MD5 passwords. The upgraded server is now using SHA-512 passwords.
Users who have changed their password ...
6
votes
3
answers
3k
views
OpenSSH use (public key or password) + google authenticator
I want to allow these two authentication types:
public key + google authenticator OR password + google authenticator.
I have the following in my sshd_config:
AuthenticationMethods publickey,keyboard-...
6
votes
3
answers
6k
views
LDAP and pam without binddn and anonymous access
I am working in a large company and can use its central read-only LDAP server remotely. The LDAP server does not allow anonymous binding. In order to use this server for authentication of the users on ...
6
votes
3
answers
7k
views
cron+pam heavily spamming my logs
Two times every minute I get this in auth.log:
May 12 15:21:01 ruptai CRON[25303]: pam_unix(cron:session): session opened for user root by (uid=0)
May 12 15:21:01 ruptai CRON[25303]: pam_unix(cron:...
5
votes
2
answers
5k
views
/etc/pam.d/login vs. /etc/pam.d/system-auth
I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this:
password required pam_cracklib.so dcredit=-1 ...
5
votes
3
answers
17k
views
sssd vs nslcd for RHEL-5/6
We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP:
nscd/nslcd for all RH-5/RH-6 servers
nscd/nslcd for RH-5 servers, sssd for RH-6 servers
sssd for all ...
5
votes
1
answer
1k
views
Why can't I use pam_echo.so in the sudo pam stack?
I have a CentOS 7 machine where I'd like to display a message when authentication fails during sudo. I tried to do this by adding a pam_echo line in /etc/pam.d/sudo.
For testing, I created a file, /...
5
votes
2
answers
1k
views
Samba: read-only LDAP + additional local users
My server has access to a read-only LDAP where information about 99% of user accounts will reside. On my server I want to configure Samba to use LDAP for authentication.
Now and then there will be ...
5
votes
2
answers
10k
views
How to display SSH banner at login, but only for password authentication
I have a warning message that is displayed to a user after they enter their username to log in to our Linux servers. I only want to display this message for password authentications, and not when ...
4
votes
1
answer
4k
views
Why is sshd engaging PAM still?
Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there.
But if you don't have a ...
4
votes
1
answer
16k
views
pam_unix generates a lot of open/close sessions for my domain user
I setup a new VPS with ubuntu 18.04, including virtualmin/usermin. In auth.log I see a lot of
su[12936]: Successful su for domain by root
su[12936]: + ??? root:domain
systemd-logind[148]: New ...
4
votes
1
answer
20k
views
Fedora 21 pam_sss authentication failure - permission denied
We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
4
votes
0
answers
2k
views
Ubuntu server + Samba + PAM + Apple OpenDirectory
Due to various reasons, we are looking to migrate our file servers from OS X Server 10.9 over to a true Samba implementation running on Ubuntu 14.04LTS. We have Ubuntu up and running with Samba ...
3
votes
1
answer
10k
views
Private key authentication with pam_ldap
I'd like to set up pam_ldap on some of our servers so that we can centrally manage who has access to which server, and easily revoke access if e.g. someone leaves the company.
I've done some research ...
3
votes
3
answers
2k
views
How to handle centralized user authentication without LDAP?
I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
3
votes
1
answer
8k
views
How to use SHA-256 hashed (and salted) passwords from OpenLDAP in pam_ldap?
I have hashed and salted passwords in OpenLDAP for login via PAM in Linux. The setup works when the hashes are of type SHA-1 (salted or unsalted) or plain text. In these cases everything works fine ...
3
votes
3
answers
2k
views
How to make dovecot not ask passwords from localhost?
I have set up dovecot server and I'm currently using offline imap to sync my gmail to the dovecot imap running on the localhost.
Currently I'm using plain text authentication, but this results in ...
3
votes
1
answer
10k
views
Account Lockout with pam_faillock in RHEL6
Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function;
What is ...
3
votes
1
answer
7k
views
vsftp login errors 530 login incorrect
Using Ubuntu 10.04 on an aws ec2 instance. I was happy just using ssh but then a wordpress plugin needs ftp access...I just need ftp access for one site www.sitebuilt.net which is in /home/sitebuil.
...
3
votes
2
answers
6k
views
changing shadow hash algorithm to bcrypt: how to rehash
I want to change my SHA512 shadow file to use bcrypt as shown in this question/answer: Enable blowfish-based hash support for crypt
The problem is that i run into a chicken and egg problem, because ...
3
votes
3
answers
2k
views
how to require publickey and otp, or password and otp when logging in with ssh?
I'm trying to get ssh to work in a way where password auth can be skipped with a key, and in addition every login would be followed up with totp using google's libpam on my new debian 9 installation.
...
3
votes
2
answers
7k
views
How to only allow users and/or groups access certain client machines that are connected to an openldap server?
I would really like to figure out how I can allow users and/or groups access to certain client machines that are all connected to an OpenLDAP server. I would like to do this whether the user is ...
3
votes
1
answer
3k
views
Can I use DenyHosts for a SMTP service
I would like to block some hosts that are brute forcing my SMTP server.
I'm currently using DenyHosts for SSHD and was wondering if I can add the SMTP service too.
It could be possible based on this ...
2
votes
3
answers
9k
views
How to use Linux username and password with Subversion?
I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it ...