Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
32 votes
Accepted

How to use the ssh server with PAM but disallow password auth?

maybe the exact question is how to configure pam to disallow passwords? Correct. You've already stumbled upon the fact that setting UsePAM no is generally bad advice. Not only does it prevent any ...
Andrew B's user avatar
  • 33.2k
27 votes
Accepted

What can be learned about a user from a failed SSH attempt?

Well, an item that you haven’t mentioned is the fingerprints of the private keys they tried before entering a password. With openssh, if you set LogLevel VERBOSE in /etc/sshd_config, you get them in ...
Dario's user avatar
  • 841
19 votes

Connection closed by UNKNOWN port 65535 when SSH using AD Creds on RHEL Machine

The super-unhelpful ssh error Connection closed by UNKNOWN port 65535 can be reported when your ssh client in a couple of different situations when the remote sshd cannot be reached at all because of ...
DouglasDD's user avatar
  • 552
18 votes
Accepted

PAM accepting any password for valid users

Let's analyze the authentication section of your PAM configuration in detail. auth sufficient pam_unix.so nullok try_first_pass The first line says: "If this test is successful, stop ...
telcoM's user avatar
  • 4,618
17 votes

What can be learned about a user from a failed SSH attempt?

Going little bit further into the LogLevel DEBUG, you can also find out the client software/version in format Client protocol version %d.%d; client software version %.100s It will also print the key ...
Jakuje's user avatar
  • 10.1k
12 votes

ulimit -n not changing - values limits.conf has no effect

I had a similar problem, but with SSH logins only. Local logins (via console) respected the /etc/security/limits.conf. As it turned out, when you set: UsePrivilegeSeparation yes in /etc/ssh/...
user418149's user avatar
11 votes

ssh: "Access denied by PAM account configuration" for one non-root user but not another

Thank you for posting your question. I was getting the same error, but my problem wasn't related to the shadow file. I found my fix and wanted to post an answer as well for anyone else Googling this ...
BoomShadow's user avatar
7 votes

How to use nginx PAM module?

Answer to a very old question, but I was able to confirm that this does work so this might help. This allows an nginx location to be authenticated against the local server account names. YMMV. ...
Guy's user avatar
  • 2,678
6 votes

Unable to login with SSH after configure LDAP authentication

According to this line: (Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0 There was no password passed from the PAM stack towards SSSD (authtok type 0 means no ...
jhrozek's user avatar
  • 1,390
6 votes

What can be learned about a user from a failed SSH attempt?

If the login attempts are very frequent or happen at all hours of the day, then you could suspect that the login is performed by a bot. You might be able to deduce the user's habits from the time of ...
dotancohen's user avatar
  • 2,620
6 votes
Accepted

Debugging sssd login: pam_sss [...] System error

You need to add debug_level=10 into all sections in the sssd.conf file, restart sssd and re-run the login. Then look into /var/log/sssd. Also please read https://docs.pagure.org/sssd.sssd/users/...
jhrozek's user avatar
  • 1,390
6 votes

Debugging sssd login: pam_sss [...] System error

Just wondered why some fresh Active Directory connected Linux (Debian 9) systems reported system error on su while some older did not show this behavior. Setting ad_gpo_access_control = permissive ...
Stephan's user avatar
  • 285
6 votes

Debugging sssd login: pam_sss [...] System error

same problem on Ubuntu 20.04, adding ad_gpo_ignore_unreadable = True ad_gpo_access_control = permissive solved issues that does not exist on Ubuntu 18.04 (same M$ AD and RFC_2307 attributes mapping) ...
Patrick Nomblot's user avatar
6 votes
Accepted

SSH choice of second factor on login

There is, as far as I know, no standard/method that allows a user to select which MFA they want to use to login with from the commandline prompt during login. (But you could always write your own PAM ...
HBruijn's user avatar
  • 80.6k
5 votes

ssh: "Access denied by PAM account configuration" for one non-root user but not another

Had the same error message. Shutted down the sshd and restarted it in debug mode /usr/sbin/sshd -ddd this indicated the reason: debug3: User autossh not allowed because account is locked ...
MarkHelms's user avatar
  • 181
5 votes

ssh: "Access denied by PAM account configuration" for one non-root user but not another

In my case I was renaming local CentOS 6 users, and forgot to rename them in /etc/shadow (who are password-less key-authenticated, didn't pop up in my mind), so the records for the new usernames were ...
kuz8's user avatar
  • 483
5 votes

sshd: How to enable PAM authentication for specific users under

Using the below solution, PAM Module(google authenticator) can be disable for specific users- 1) Create a user group on the Linux instance. MFA/PAM will be disabled for users present in this new ...
Abhimanyu Garg's user avatar
5 votes
Accepted

Conflicts with PAM configuration files when upgrading system

Because I did not want to alter the live configuration of PAM on the system, I ended up using a chroot jail to setup a default PAM configuration so I can view the differences: # lsb_release --...
piwi's user avatar
  • 336
5 votes

How to authenticate local Linux user with Nginx PAM module?

The README for this third party nginx module says: Note that the module runs as the web server user, so the PAM modules used must be able to authenticate the users without being root; that means that ...
Michael Hampton's user avatar
4 votes

Postfix/Dovecot don't use pam_mkhomedir

Just for the benefit of others who stumble upon this by googling the Dovecot issue like I just happened to: Dovecot can be made to use pam_mkhomedir if you set it up that way. The documentation is at ...
Josip Rodin's user avatar
  • 1,797
4 votes

Slow ssh login - Activation of org.freedesktop.login1 timed out

Using: systemctl restart systemd-logind solves the problem only temporarily. One workaround is to remove all the .scope files from a cron job, as stated here. * 2,14 * * * root /bin/rm -f /run/...
Ortomala Lokni's user avatar
4 votes
Accepted

what does "-session ..." mean in /etc/pam.d/system-session?

Citing man pam.conf: If the type value from the list above is prepended with a - character the PAM library will not log to the system log if it is not possible to load the module because it ...
Sven's user avatar
  • 99.6k
4 votes
Accepted

Google Authenticator PAM on SSH blocks root login without 2FA

This is the expected behavior. Assuming you had PermitRootLogin without-password, the man page for the PermitRootLogin says: If this option is set to prohibit-password or without-password, password ...
nullUser's user avatar
  • 236
4 votes
Accepted

Why can't I use pam_echo.so in the sudo pam stack?

I ran sudo and used GDB to do a back-trace. I followed the bread crumbs and found that preventing PAM output is hard coded into sudo. The backtrace: #13 0x00007f9879eba7e0 in pam_authenticate (pamh=...
Steve F's user avatar
  • 371
4 votes

Allow user to sudo as any user in group

James. I believe you can achieve the desired result by using this sudoers configuration line: taskrunner ALL = (%serviceusers) NOPASSWD: ALL The line above tells sudo to authorize taskrunner user ...
Anderson Medeiros Gomes's user avatar
4 votes

How to use PAM to manage lockout policy for ssh public key authentication methods

The problem is that you're trying to enforce these policies inside of the auth stack. auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth ...
Andrew B's user avatar
  • 33.2k
4 votes

Linux PAM: SSH key + 2FA (google authenticator) + password - Specify auth requirements per user

Let's break down these requirements a bit. Configuring SSH First, in order to require public keys and password to provide, you need to modify your /etc/ssh/sshd_config by adding this line: ...
Lacek's user avatar
  • 7,473
4 votes

UsePAM not supported anymore

Missed this alpine package: openssh-server-pam Installing it, works and PAM is now supported.
Mazzy's user avatar
  • 247
4 votes
Accepted

Why does Alpine-based sshd shut down when first session ends?

You're seeing this behaviour because of the -d flag. From the sshd's man page: -d' Debug mode. The server sends verbose debug output to the system log, and does not put itself in the background. The ...
Gustavo Kawamoto's user avatar
3 votes

pam service(sshd) ignoring max retries

The ssh client may attempt to authenticate with one or more keys. Any keys which are not listed in authorized_keys will fail, consuming one of sshd's retries. The client will try every ssh key it has ...
Bill's user avatar
  • 76

Only top scored, non community-wiki answers of a minimum length are eligible