Use this tag for questions relating to authentication mechanism (i.e. proving to the system that you are you, using passwords, keycards etc.). In general don't use this and the security tag on the same question, unless it is about the security of the authentication process.

learn more… | top users | synonyms

2
votes
5answers
4k views

How to securely automate running commands as root with “sudo su -”?

hint (on client side, how to encrypt files/pwd's): # encrypt pwd with ssh key: openssl rsa -in ~/.ssh/id_rsa -outform pem > ~/.ssh/TEMP-id_rsa.pem 2>/dev/null openssl rsa -in ~/.ssh/id_rsa -...
2
votes
3answers
2k views

Why does sudo su work, but su does not? [duplicate]

I have tried this on Fedora and on Ubuntu. kshitiz@kshitiz:~$su su: Authentication failure kshitiz@kshitiz:~$sudo su root@kshitiz:/home/kshitiz# I am entering the same password in both the cases.
2
votes
1answer
730 views

basic explanation on NSS , LDAP and PAM

can anyone give me a basic explanation on what are NSS , LDAP and PAM and what they used for and what is their relationship/differences ?
2
votes
5answers
299 views

Simulate the remote host identification warning

I need to simulate the warning: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING ...
2
votes
2answers
3k views

How to sign into an open Wireless Network?

I'm running Arch Linux on my netbook. My school have an open Access Point and we must sign into the network via a page which we are redirected to when we try to open whatever website if we are not ...
2
votes
2answers
149 views

Add a user wthout password but with SSH and public key

I want to add a user to Red Hat Linux that will not use a password for logging in, but instead use a public key for ssh. This would be on the command line.
2
votes
1answer
262 views

SSH Authentication Mechanism

Doing a personal research project and I'm wondering: Why does SSH do its own mechanism negotiation rather than use SASL? At first I thought it might be to ensure confidentiality of the whole session, ...
2
votes
2answers
2k views

Script to get file from SFTP and run it

We have 5 servers running our code: A, B , C, D and E. From a local machine, we sftp the file to A. Then ssh id@A su - applicationname sftp id@A get <file> bye tar -xzf <file> logout ...
2
votes
1answer
412 views

n-factor SSH authentication for CentOS 7

How can I enable (and require) n-factor authentication for all SSH connections to a CentOS 7 server? I have read about Google Authenticator, which provides two factor authentication. But that is ...
2
votes
2answers
424 views

temporarily disable login using one specific ssh key

On my server, I have several public SSH keys in ~/.ssh/authorized_keys. I would like to temporarily block/disallow/deactivate one key. I want to prevent the user to log in using this key now. but I ...
2
votes
1answer
880 views

How do I reset RHEL6 to autocreate home directory upon login?

I am using a RHEL6 host that is set up using LDAP for authenication. Upon first login it is supposed to create the home directory for the user (e.g. /home/gisle where gisle is my login username). I ...
2
votes
2answers
568 views

How do I switch from /etc/shadow back to /etc/passwd?

I'm playing with a rather old, heavily customized Linux installation (based on Debian etch, running on a Netgear ReadyNAS device). Recently I've switched from /etc/passwd to /etc/shadow via pwconv. ...
2
votes
1answer
5k views

Authenticating with x11vnc: what's the difference between -auth and -rfbauth?

I'm on xubuntu 11.10 trying to setup x11vnc server. I followed instructions here and I can connect to VNC server - but it never asks me for password! Is there a difference between these 2 options: -...
2
votes
1answer
8k views

How to setup proxy authentication in the Debian shell?

I think that once I used export http_proxy=http://user:password@address:port/ successfully. But now when I use wget it shows Error parsing proxy URL http://user:passwordaddress:port/: Bad port ...
2
votes
2answers
1k views

setting up ssh public key

Okay, so I'm trying to setup a login for logging in with ssh, using a public key. First, I am using puttygen to generate a rsa-ssh2 public key using a passphrase. I followed the directions and ...
2
votes
1answer
79 views

SSH: display warning when using (deprecated) ssh-dss key

With the 7.0 release, OpenSSH disabled ssh-dss keys. The not-so-recommended workaround is to explicitly re-add DSA key support to .ssh/config, which will eventually be dropped by a later OpenSSH ...
2
votes
1answer
51 views

Is it possible to have a daemon run a process as another user WITHOUT having a superuser daemon?

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out ...
2
votes
1answer
3k views

Setting up connection to WPA2 Enterprise (PEAP/MSCHAPv2) with two-level certificate

For a long time, I have been able to use NetworkManager + wpa_supplicant as configured in Debian 7 to connect to a secure wireless at work (which is WPA2 Enterprise, with PEAP + MSCHAPv2 ...
2
votes
1answer
2k views

how to pass a password with a cron job safely?

I have a site map generator script placed in this URL http://www.mydomain.com/admin/sitemapgen/ However this URL is protected with an username and a password in auth_type basic method. I need to ...
2
votes
1answer
379 views

What's the correct way to authenticate a user without PAM?

as my related question doesn't seem to get much love, here another one: What's the proper way to authenticate a user via username/password prompt in Linux nowadays? In principle, I suppose I would ...
2
votes
1answer
205 views

Apache authentication mutiple domain but same subdirectory

I've got several sites: example.com, example1.com, and example2.com in my wordpress. All of them point to my server's /public_html folder, which is my Apache root folder. What do I need to add to my ....
2
votes
2answers
200 views

Making su ask for password multiple times

Is there some way to make su ask for the password again in case of a wrong password (just as sudo does)? Initially I thought of this: while ! su -c foo; do read -n 1 -p "Retry(y/n)?" ch if [[ "$...
2
votes
1answer
655 views

login 'authentication failure' by non-root user, can login only by root [closed]

In my CentOS 6.0 system, working since months, suddenly stop authenticating non-root users, in graphical mode. I have checked necessary /etc/pam.d/* files, but those are unchanged. SELinux is ...
2
votes
1answer
831 views

Gnome-shell authentication dialogue fails, how to debug which app is using it?

I am using ubuntu 13.10 with gnome shell 3.8.4. I used to use gnome online accounts for empathy and other things, but then I stopped using them. And then gnome shell started to show authentication ...
2
votes
1answer
3k views

tinyproxy with user authentification

Does anybody have a solution that'll make tinyproxy work with user authentification like pam_auth at the squid proxy? I don't want to create a SSH-Tunnel and allow only localhost.
2
votes
2answers
1k views

SSH on my local network - problem with login

I'm having problem with logging into my local-network-linux (server) ssh with Putty (and with Linux terminal, too) When my server shows me request to insert username, I insert "root" and I do press ...
2
votes
1answer
95 views

How to allow unauthenticated logins over ssh on FreeBSD?

I created an account ckurs on my FreeBSD 10 workstation. This account uses a custom shell-script as a login-shell that attaches the user to a tmux-session in read-only mode. I have sufficiently ...
2
votes
1answer
57 views

Configure OpenSSH server not to require password *or* key for a particular user

For the purpose of a training session, I'd like to make it possible for a particular user to connect without requiring a password or key-based authentication. I do not know the IPs or other data of ...
2
votes
1answer
1k views

CUPS not working correctly after Debian Wheezy -> Jessie upgrade because of a faulty libpam

I just upgraded a Debian Wheezy to Jessie, by changing the /etc/apt/sources.lst. If important: I pinned systemd to stay with sysvinit, and after the upgrade I removed the pin. If I now do apt-get ...
2
votes
1answer
60 views

Directory Server doing lookups on one ldap server and authintication on another ldap server

I have an old Centos Directory Server and a new 389 Directory Server. I don't want to use sssd at the moment so lets keep that suggestion off the table. I do the following my RHEL 6.4 servers: ...
2
votes
1answer
195 views

iptables, what is truly open?

We have an RSA appliance, I've reviewed the firewall rules on this appliance to determine what ports are enabled. To me, it looks like its wide open; but the vendor states that I am wrong about this, ...
2
votes
1answer
94 views

Externally authenticate user within PAM session/PAM session within PAM session

Is there a way of properly authenticating a user from within a custom PAM session? I am currently writing my own PAM authentication module which allows the user to login via an external token. This ...
2
votes
1answer
386 views

public key authentication without authorized_keys file

I have a lot of ssh public key logins on a Linux server, e.g.: Jul 25 11:41:01 host sshd[24594]: Accepted publickey for root from xxx.xxx.xx.xx port 33374 ssh2 This is strange for me since there's ...
2
votes
1answer
184 views

Obtain pop-id or IP address when client logs into Dovecot server

Background I have been doing some research on the Dovecot mail server documentation on ways to get client information when a client connects to the server. I am interested in using these to program an ...
2
votes
1answer
416 views

Restrict two way SSH and Apache authentication to non-local networks

I am using Google's open-source PAM module for two-way authentication for SSH logins and certain Apache directives. It works great, however I would like to use this only when trying to log in from an ...
2
votes
1answer
3k views

User authentication over Dante proxy server

Below is my Dante SOCKS Proxy server configuration that I connect to without any authentication: internal: eth0 port = 53200 internal: 127.0.0.1 port = 53200 external: eth0 clientmethod: none method:...
2
votes
2answers
1k views

How to send mail from a remote SMTP host?

I have Postfix suite installed locally on Ubuntu 10.10. I can send/receive mail to my local address, e.g. user@local.com. I'm given credentials to a remote mail server mailbox, e.g. other@remote.com....
2
votes
0answers
17 views

Might any damage have been caused when cancelling the update manager in Linux Mint during an update?

My Linux Mint Update Manager was running an update - a very big one. It was in the middle of downloading package files, and it was taking way too long and I had to stop it, so I clicked Cancel. When I ...
2
votes
1answer
56 views

How to restrict su from root to nis clients

We are using NIS services for users login for Unix accounts. We have test machines where users themselves install OS and they get root access. Users are using su from root account to NIS user accounts ...
2
votes
0answers
119 views

Linux Authentication Flow (NSS -> PAM -> AD)

I am a new system administrator at an organization looking to understand the process flow of authentication in regards to how NSS, PAM and WINBIND work together. We've been having winbind related ...
2
votes
2answers
362 views

How can I set up centralized home directories and user authentication using LDAP and NFS?

I am trying to configure my server to authenticate users using LDAP and save their home directories on a NFS-Directory, also located on the server. i.e.: I share a directory on my server: /nfsexport ...
2
votes
4answers
200 views

Authentication failure on Amazon Linux

There is an authentication failure when I'm trying to enter password for any of my accounts. I am logged in using ssh to my AWS EC2 instance. After a while I checked the privileges to files that ...
2
votes
1answer
1k views

LDAP Authentication on OpenBSD

I'm trying to get an OpenBSD server to authenticate users using the same LDAP server the rest of my home network uses. While 'getent password' lists the users from the LDAP server as expected, I ...
2
votes
0answers
212 views

Login to Linux using a trusted Active Directory

I'm having trouble to log in to Linux using a trusted Active Directory. The machine is connected to an Active Directory that we are responsible for in the project, but most of the users who will use ...
2
votes
1answer
543 views

DSA/RSA keys work with Linux but not HP-UX

I have an NFS mount that I use to log into many Linux/Unix servers. I created a passphraseless RSA and DSA key from with I copied the id_rsa.pub and id_dsa.pub files over to authorized_keys. total 9 ...
2
votes
1answer
403 views

What prevents RHEL7 default PAM config's “nullok” option from allowing empty passwords?

The config /etc/pam.d/password-auth is included by several PAM services including sshd. This is its auth stanza: auth required pam_env.so auth sufficient pam_unix.so nullok ...
2
votes
0answers
1k views

Enter user authentication details for a printer?

I have a printer which is configured using the correct drivers. However, the printer requires user authentication (i.e. a username and password) to print. Where are authentication details usually ...
2
votes
0answers
323 views

SSH login from external authentication

Here is what I try to accomplish: I have a server with a git repository. I use ISPConfig as control panel for our websites and I want to integrate the ISPConfig API for email authentication as second ...
2
votes
3answers
673 views

OpenAM to OpenLDAP to SysAID (LDAP) Authentication

We just began using a new software called SysAid which uses LDAP to authenticate users. We have a client, which uses OpenAM to authenticate their users for a proprietary web application. Our goal, ...
2
votes
0answers
118 views

luks single signon

I've got LUKS (Linux Unified Key Setup) running on a couple of my Linux boxes. I've looked online but haven't seen anyone document how to make it work in a single signon option, but was hoping ...