32
votes
Accepted
How to use the ssh server with PAM but disallow password auth?
maybe the exact question is how to configure pam to disallow passwords?
Correct. You've already stumbled upon the fact that setting UsePAM no is generally bad advice. Not only does it prevent any ...
- 33.1k
27
votes
Accepted
What can be learned about a user from a failed SSH attempt?
Well, an item that you haven’t mentioned is the fingerprints of the private keys they tried before entering a password. With openssh, if you set LogLevel VERBOSE in /etc/sshd_config, you get them in ...
- 841
19
votes
Connection closed by UNKNOWN port 65535 when SSH using AD Creds on RHEL Machine
The super-unhelpful ssh error Connection closed by UNKNOWN port 65535 can be reported when your ssh client in a couple of different situations when the remote sshd cannot be reached at all because of ...
- 552
18
votes
Accepted
PAM accepting any password for valid users
Let's analyze the authentication section of your PAM configuration in detail.
auth sufficient pam_unix.so nullok try_first_pass
The first line says: "If this test is successful, stop ...
- 4,618
17
votes
What can be learned about a user from a failed SSH attempt?
Going little bit further into the LogLevel DEBUG, you can also find out the client software/version in format
Client protocol version %d.%d; client software version %.100s
It will also print the key ...
- 10.1k
12
votes
ulimit -n not changing - values limits.conf has no effect
I had a similar problem, but with SSH logins only. Local logins (via console) respected the /etc/security/limits.conf.
As it turned out, when you set:
UsePrivilegeSeparation yes
in /etc/ssh/...
- 121
11
votes
ssh: "Access denied by PAM account configuration" for one non-root user but not another
Thank you for posting your question. I was getting the same error, but my problem wasn't related to the shadow file. I found my fix and wanted to post an answer as well for anyone else Googling this ...
- 405
7
votes
sshd: How to enable PAM authentication for specific users under
In order to disable two-factor auth for users without Google Authenticator configured, add the nullok option in /etc/pam.d/sshd:
auth required pam_google_authenticator.so nullok
For more details ...
- 191
7
votes
How to use nginx PAM module?
Answer to a very old question, but I was able to confirm that this does work so this might help. This allows an nginx location to be authenticated against the local server account names. YMMV.
...
- 2,678
6
votes
Unable to login with SSH after configure LDAP authentication
According to this line:
(Sun Nov 13 15:07:51 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0
There was no password passed from the PAM stack towards SSSD (authtok type 0 means no ...
- 1,380
6
votes
What can be learned about a user from a failed SSH attempt?
If the login attempts are very frequent or happen at all hours of the day, then you could suspect that the login is performed by a bot.
You might be able to deduce the user's habits from the time of ...
- 2,610
6
votes
Accepted
Debugging sssd login: pam_sss [...] System error
You need to add debug_level=10 into all sections in the sssd.conf file, restart sssd and re-run the login. Then look into /var/log/sssd. Also please read https://docs.pagure.org/sssd.sssd/users/...
- 1,380
6
votes
Debugging sssd login: pam_sss [...] System error
Just wondered why some fresh Active Directory connected Linux (Debian 9) systems reported system error on su while some older did not show this behavior. Setting ad_gpo_access_control = permissive ...
- 285
6
votes
Debugging sssd login: pam_sss [...] System error
same problem on Ubuntu 20.04, adding
ad_gpo_ignore_unreadable = True
ad_gpo_access_control = permissive
solved issues that does not exist on Ubuntu 18.04 (same M$ AD and RFC_2307 attributes mapping)
...
6
votes
Accepted
SSH choice of second factor on login
There is, as far as I know, no standard/method that allows a user to select which MFA they want to use to login with from the commandline prompt during login. (But you could always write your own PAM ...
- 80.3k
5
votes
ssh: "Access denied by PAM account configuration" for one non-root user but not another
Had the same error message.
Shutted down the sshd and restarted it in debug mode
/usr/sbin/sshd -ddd
this indicated the reason:
debug3: User autossh not allowed because account is locked
...
- 181
5
votes
sshd: How to enable PAM authentication for specific users under
Using the below solution, PAM Module(google authenticator) can be disable for specific users-
1) Create a user group on the Linux instance. MFA/PAM will be disabled for users present in this new ...
- 151
5
votes
ssh: "Access denied by PAM account configuration" for one non-root user but not another
In my case I was renaming local CentOS 6 users, and forgot to rename them in /etc/shadow (who are password-less key-authenticated, didn't pop up in my mind), so the records for the new usernames were ...
- 483
5
votes
Accepted
Conflicts with PAM configuration files when upgrading system
Because I did not want to alter the live configuration of PAM on the system, I ended up using a chroot jail to setup a default PAM configuration so I can view the differences:
# lsb_release --...
- 336
4
votes
Postfix/Dovecot don't use pam_mkhomedir
Just for the benefit of others who stumble upon this by googling the Dovecot issue like I just happened to: Dovecot can be made to use pam_mkhomedir if you set it up that way. The documentation is at ...
- 1,777
4
votes
Slow ssh login - Activation of org.freedesktop.login1 timed out
Using:
systemctl restart systemd-logind
solves the problem only temporarily.
One workaround is to remove all the .scope files from a cron job, as stated here.
* 2,14 * * * root /bin/rm -f /run/...
4
votes
Accepted
what does "-session ..." mean in /etc/pam.d/system-session?
Citing man pam.conf:
If the type value from the list above is prepended with a -
character the PAM library will not log to the system log if it
is not possible to load the module because it ...
- 99.6k
4
votes
Accepted
Google Authenticator PAM on SSH blocks root login without 2FA
This is the expected behavior. Assuming you had PermitRootLogin without-password, the man page for the PermitRootLogin says:
If this option is set to prohibit-password or without-password, password ...
- 236
4
votes
Accepted
Why can't I use pam_echo.so in the sudo pam stack?
I ran sudo and used GDB to do a back-trace. I followed the bread crumbs and found that preventing PAM output is hard coded into sudo.
The backtrace:
#13 0x00007f9879eba7e0 in pam_authenticate (pamh=...
- 371
4
votes
Allow user to sudo as any user in group
James.
I believe you can achieve the desired result by using this sudoers configuration line:
taskrunner ALL = (%serviceusers) NOPASSWD: ALL
The line above tells sudo to authorize taskrunner user ...
- 2,497
4
votes
How to use PAM to manage lockout policy for ssh public key authentication methods
The problem is that you're trying to enforce these policies inside of the auth stack.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth ...
- 33.1k
4
votes
Linux PAM: SSH key + 2FA (google authenticator) + password - Specify auth requirements per user
Let's break down these requirements a bit.
Configuring SSH
First, in order to require public keys and password to provide, you need to modify your /etc/ssh/sshd_config by adding this line:
...
- 7,443
4
votes
UsePAM not supported anymore
Missed this alpine package:
openssh-server-pam
Installing it, works and PAM is now supported.
- 247
4
votes
Accepted
Why does Alpine-based sshd shut down when first session ends?
You're seeing this behaviour because of the -d flag. From the sshd's man page:
-d' Debug mode. The server sends verbose debug output to the system log, and does not put itself in the background. The ...
- 369
4
votes
How to authenticate local Linux user with Nginx PAM module?
The README for this third party nginx module says:
Note that the module runs as the web server user, so the PAM modules used must be able to authenticate the users without being root; that means that ...
- 248k
Only top scored, non community-wiki answers of a minimum length are eligible