Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

Filter by
Sorted by
Tagged with
27 votes
2 answers
21k views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
ColOfAbRiX's user avatar
  • 1,080
5 votes
2 answers
20k views

VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
Totor's user avatar
  • 95
5 votes
1 answer
715 views

Use more complex AND/OR structure with PAM

PAM allows to use sufficent and required for some logic, like auth sufficient pam_a.so auth required pam_b.so auth required pam_c.so which would mean "either a is true, or b must be true and then c ...
allo's user avatar
  • 1,713
42 votes
7 answers
109k views

Switch on PAM debugging to Syslog

How do I switch on PAM debugging in Debian Squeeze at the admin level? I have checked every resource I was able to find. Google, manpages, whatever. The only thing I haven't tried yet (I simply not ...
Tino's user avatar
  • 1,153
18 votes
1 answer
39k views

How to authenticate Linux accounts against an Active Directory and mount a Windows share on login?

I'm using Ubuntu 10.04 Server.
Jamie's user avatar
  • 1,314
18 votes
2 answers
17k views

open file descriptor limits.conf setting isn't read by ulimit even when pam_limits.so is required

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. I've added the following lines to /etc/security/limits.conf: * soft nofile 100000 ...
bantic's user avatar
  • 1,549
10 votes
3 answers
20k views

ldap force user to change password

I am using CentOS-ds (based off Redhat-DS and 389 directory servers). I have LDAP setup, and working to authenticate users (and Sudo, thats a handy feature!). even passwd is working great to change ...
Brian's user avatar
  • 1,253
8 votes
3 answers
10k views

Expired "authentication token" for user with deleted password

The Setup: 1) The user's password was deleted with "passwd -d " command 2) The user has cron jobs running The Problem: Once every 30 days (default password expiration policy) the cron fails with an ...
Aleksey Sanin's user avatar
8 votes
3 answers
7k views

PAM: Execute a command before pam_mkhomedir?

When a user logs into a system and there is no home directory, we would like to to create the user's home directory using pam_mkhomedir. This is a common practice. Here's a quick description of ...
Stefan Lasiewski's user avatar
7 votes
2 answers
22k views

How to use nginx PAM module?

I would like to use nginx PAM module to authenticate a site with existing users on a FreeBSD system. I tried to use pam_unix.so, but no luck. It's just not let me in with my usr/psw pair. :( nginx ...
noirello's user avatar
7 votes
2 answers
24k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
Aaron Copley's user avatar
  • 12.7k
6 votes
5 answers
12k views

Limiting Failed SSH Logins

I would like to limit failure retries on my Fedora machine to 5. I think I can accomplish it with PAM. But was unable to to do this. I have referred to this article to do this http://www.puschitz....
nitin's user avatar
  • 2,599
4 votes
1 answer
15k views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
Antitribu's user avatar
  • 1,749
3 votes
1 answer
2k views

SSH locale wrong

I have a debian server with locales set to hu_HU.UTF-8, and if i log in trough console it works perfectly in hungarian. It also worked with ssh logins until i disabled PAM in the sshd config. Since ...
hpeter94's user avatar
2 votes
3 answers
7k views

Samba File Server + PAM + Berkeley DB or Samba + PAM

I've set up VSFTPD with PAM and Berkeley DB before using this article. It's a great article and was really easy to walk through setting it up. Now that I'm setting up Samba, I would like to do the ...
user29600's user avatar
  • 429
1 vote
1 answer
1k views

Can I configure pam_ldap without configuring nss?

On my servers I have my system users provisioned with Chef and have no desire to expose any additional users to these machines. I would however like to utilize pam for the authentication backend for ...
Steve Buzonas's user avatar
45 votes
2 answers
38k views

Slow ssh login - Activation of org.freedesktop.login1 timed out

On one of my servers I've noticed really delay on SSH logins. Connecting using the ssh -vvv options the delay occurs at debug1: Entering interactive session. extract of connection: debug1: ...
Alasdair's user avatar
  • 571
33 votes
7 answers
134k views

ssh: "Access denied by PAM account configuration" for one non-root user but not another

On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is ...
zwol's user avatar
  • 1,365
24 votes
5 answers
62k views

ulimit -n not changing - values limits.conf has no effect

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. This question is somewhat of a follow up to this question. open file descriptor limits.conf setting isn'...
Abbas Gadhia's user avatar
21 votes
2 answers
23k views

"success=n" control syntax in pam.conf / pam.d/* files

After sucessfully configuring Kerberos, this is what I've found in /etc/pam.d/common-auth file: auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] ...
Jamie's user avatar
  • 1,314
20 votes
2 answers
54k views

How to use the ssh server with PAM but disallow password auth?

Many tutorials tell you to config your ssh server like this: ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no but with this setup you cannot use PAM, as i plan to use 2 Factor ...
c33s's user avatar
  • 1,535
12 votes
1 answer
50k views

LDAP authentication on CentOS 7

After upgrading to CentOS 7 it's no longer possible to login via LDAP. With CentOS 6 I used the package pam_ldap which worked fine, but now pam_ldap is no longer available for the new version of ...
lszrh's user avatar
  • 683
12 votes
2 answers
9k views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
Brian's user avatar
  • 333
10 votes
3 answers
13k views

vsftpd will not accept passwords encrypted with MD5

I am setting up an server with vsftpd to let virtual users access their space. Now it is fully working but only with CRYPT passwords. So sudo htpasswd -c /etc/vsftpd/ftpd.passwd phpmyadmin will not ...
Marco's user avatar
  • 307
7 votes
3 answers
13k views

LDAP Users Home Directories

I'm trying to setup linux login via an LDAP server. I have everything working except setting the user's home directory. There is no parameter in the LDAP database that I can map to the ...
Tom Kiley's user avatar
  • 111
7 votes
1 answer
4k views

Combination of SSH key auth, and two-factor authentication

I was wondering if it is possible to accomplish the following, all at the same time: Disable root logins Enable SSH login for personal user, only via SSH keys Enable SSH login for unprivileged user, ...
Brandon's user avatar
  • 191
6 votes
3 answers
11k views

Users cannot use crontab after password security upgrade

I have a box being upgraded from CentOS 5 to CentOS 6. On the original server, all users have MD5 passwords. The upgraded server is now using SHA-512 passwords. Users who have changed their password ...
Michael Hampton's user avatar
6 votes
3 answers
3k views

OpenSSH use (public key or password) + google authenticator

I want to allow these two authentication types: public key + google authenticator OR password + google authenticator. I have the following in my sshd_config: AuthenticationMethods publickey,keyboard-...
Timothy's user avatar
  • 161
6 votes
3 answers
6k views

LDAP and pam without binddn and anonymous access

I am working in a large company and can use its central read-only LDAP server remotely. The LDAP server does not allow anonymous binding. In order to use this server for authentication of the users on ...
Roman Byshko's user avatar
6 votes
3 answers
7k views

cron+pam heavily spamming my logs

Two times every minute I get this in auth.log: May 12 15:21:01 ruptai CRON[25303]: pam_unix(cron:session): session opened for user root by (uid=0) May 12 15:21:01 ruptai CRON[25303]: pam_unix(cron:...
o0'.'s user avatar
  • 411
5 votes
2 answers
5k views

/etc/pam.d/login vs. /etc/pam.d/system-auth

I want to enforce password complexity on my RH system (local authentication) and have discovered that I need a pam module line something similar to this: password required pam_cracklib.so dcredit=-1 ...
oneodd1's user avatar
  • 608
5 votes
3 answers
17k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for all ...
ujjain's user avatar
  • 4,033
5 votes
1 answer
1k views

Why can't I use pam_echo.so in the sudo pam stack?

I have a CentOS 7 machine where I'd like to display a message when authentication fails during sudo. I tried to do this by adding a pam_echo line in /etc/pam.d/sudo. For testing, I created a file, /...
Steve F's user avatar
  • 371
5 votes
2 answers
1k views

Samba: read-only LDAP + additional local users

My server has access to a read-only LDAP where information about 99% of user accounts will reside. On my server I want to configure Samba to use LDAP for authentication. Now and then there will be ...
Roman Byshko's user avatar
5 votes
2 answers
10k views

How to display SSH banner at login, but only for password authentication

I have a warning message that is displayed to a user after they enter their username to log in to our Linux servers. I only want to display this message for password authentications, and not when ...
Banjer's user avatar
  • 4,014
4 votes
1 answer
4k views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
jouell's user avatar
  • 621
4 votes
1 answer
16k views

pam_unix generates a lot of open/close sessions for my domain user

I setup a new VPS with ubuntu 18.04, including virtualmin/usermin. In auth.log I see a lot of su[12936]: Successful su for domain by root su[12936]: + ??? root:domain systemd-logind[148]: New ...
Amos's user avatar
  • 267
4 votes
1 answer
20k views

Fedora 21 pam_sss authentication failure - permission denied

We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
Joel May's user avatar
  • 189
4 votes
0 answers
2k views

Ubuntu server + Samba + PAM + Apple OpenDirectory

Due to various reasons, we are looking to migrate our file servers from OS X Server 10.9 over to a true Samba implementation running on Ubuntu 14.04LTS. We have Ubuntu up and running with Samba ...
quickthyme's user avatar
3 votes
1 answer
10k views

Private key authentication with pam_ldap

I'd like to set up pam_ldap on some of our servers so that we can centrally manage who has access to which server, and easily revoke access if e.g. someone leaves the company. I've done some research ...
Gareth's user avatar
  • 1,446
3 votes
3 answers
2k views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
josh's user avatar
  • 257
3 votes
1 answer
8k views

How to use SHA-256 hashed (and salted) passwords from OpenLDAP in pam_ldap?

I have hashed and salted passwords in OpenLDAP for login via PAM in Linux. The setup works when the hashes are of type SHA-1 (salted or unsalted) or plain text. In these cases everything works fine ...
mailq's user avatar
  • 17.1k
3 votes
3 answers
2k views

How to make dovecot not ask passwords from localhost?

I have set up dovecot server and I'm currently using offline imap to sync my gmail to the dovecot imap running on the localhost. Currently I'm using plain text authentication, but this results in ...
Dima's user avatar
  • 305
3 votes
1 answer
10k views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
Aaron Copley's user avatar
  • 12.7k
3 votes
1 answer
7k views

vsftp login errors 530 login incorrect

Using Ubuntu 10.04 on an aws ec2 instance. I was happy just using ssh but then a wordpress plugin needs ftp access...I just need ftp access for one site www.sitebuilt.net which is in /home/sitebuil. ...
mcktimo's user avatar
  • 131
3 votes
2 answers
6k views

changing shadow hash algorithm to bcrypt: how to rehash

I want to change my SHA512 shadow file to use bcrypt as shown in this question/answer: Enable blowfish-based hash support for crypt The problem is that i run into a chicken and egg problem, because ...
Fabian Zeindl's user avatar
3 votes
3 answers
2k views

how to require publickey and otp, or password and otp when logging in with ssh?

I'm trying to get ssh to work in a way where password auth can be skipped with a key, and in addition every login would be followed up with totp using google's libpam on my new debian 9 installation. ...
Noino's user avatar
  • 131
3 votes
2 answers
7k views

How to only allow users and/or groups access certain client machines that are connected to an openldap server?

I would really like to figure out how I can allow users and/or groups access to certain client machines that are all connected to an OpenLDAP server. I would like to do this whether the user is ...
Alex Lowe's user avatar
  • 153
3 votes
1 answer
3k views

Can I use DenyHosts for a SMTP service

I would like to block some hosts that are brute forcing my SMTP server. I'm currently using DenyHosts for SSHD and was wondering if I can add the SMTP service too. It could be possible based on this ...
Derick Schoonbee's user avatar
2 votes
3 answers
9k views

How to use Linux username and password with Subversion?

I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it ...
Harriv's user avatar
  • 173