Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

1
vote
0answers
7 views

Configure pam_mount to prompt for password

I have configured my Ubuntu system to mount a cifs share using pam_mount and a credentials file (the credentials to access the cifs share are different to those I use on my Linux machine). I'd like to ...
1
vote
0answers
13 views

With pam_script, how do I pass PAM_AUTHTOK and PAM_USER in all cases?

I need to run a script whenever a user enters a password; the script should be able to reject that password, but shouldn't be sufficient. I placed the script in /etc/pamunlockscript/pam_script_auth ...
2
votes
0answers
35 views

Is there way to print the entered password in PAM?

We are using CentOS 6.5. We have a perl script for our automation testing. One of the script login to the user as non-root user and test "su -" command. This test case passes most of the times but ...
9
votes
2answers
520 views

How do I force a user to change a password at the first time login using ssh?

I'm trying to force a newly created user to change a password at the first time login using ssh. For security reasons I want to give him a secure password until he logs in for the first time. I did ...
0
votes
0answers
25 views

Can't get OpenLDAP and Pam LDAP working at all

Yesterday, I set up an OpenLDAP server and tried to configure it to be useful for SSH. Followed these two guides from DigitalOcean: ...
2
votes
0answers
19 views

Why libpam-systemd run interactively on apt upgrade, even when specified force-confdef/force-confold

I upgrade my packages using aptitude, specifying the apt options --force-confdef and --force-confold. This generally works, but the package libpam-systemd (204-5ubuntu20.8, on Ubuntu 14.04) still ...
2
votes
1answer
40 views

What's the correct way to authenticate a user without PAM?

as my related question doesn't seem to get much love, here another one: What's the proper way to authenticate a user via username/password prompt in Linux nowadays? In principle, I suppose I would ...
1
vote
1answer
74 views

Can't Login to Debian 7.7 with Kerberos/NIS user

I have a Debian 7.7 system I am trying to configure to use Kerberos and NIS, both served from an Active Directory server. I have kerberos set up such that I can kinit a set of credentials from the AD ...
1
vote
1answer
50 views

basic explanation on NSS , LDAP and PAM

can anyone give me a basic explanation on what are NSS , LDAP and PAM and what they used for and what is their relationship/differences ?
6
votes
1answer
123 views

First sudo always slow

The first sudo I enter on my Ubuntu 14.04 server is always slow. The password prompt displays immediately, but after I press enter it takes about 10-15 seconds until the output is printed. All sudo ...
0
votes
0answers
78 views

While trying to ssh, pam_ldap always sends the password “INCORRECT” causing bind to fail

I installed ldap-auth-client nscd ldap-utils on lubuntu 14.04 running on a banana pi. I can successfully bind as the user using ldapwhoami, but I cannot log in via ssh: Auth.log: Oct 21 02:12:05 ...
2
votes
0answers
22 views

Integrate my own PAM module with the passwd command

I know that to integrate my module with the passwd command all I need to do is add the following line to the /etc/pam.d/passwd file: password sufficient mymodule.so My question is I want my module ...
2
votes
0answers
17 views

Externally authenticate user within PAM session/PAM session within PAM session

Is there a way of properly authenticating a user from within a custom PAM session? I am currently writing my own PAM authentication module which allows the user to login via an external token. This ...
1
vote
1answer
40 views

How to disallow usage of an LDAP root account

I am responsible for a couple of servers at my university. All of these machines are configured to talk to the LDAP server of my departement to allow centralised user logins. On this LDAP server there ...
2
votes
1answer
375 views

Expired password and SSH key based login with UsePAM yes

There is a SLES 11 machine. The users logs in via SSH and pubkey (mixed, some user uses password, some use ssh key) The sshd_config has: UsePAM yes PasswordAuthentication yes PubkeyAuthentication ...
1
vote
0answers
83 views

gksu -S ask for password only once even when set to three times in sudo configuration

I have a problem with gksu command. It always ask for password only once even when I set Defaults passwd_tries=3 in /etc/sudoers file. Command: $ gksu -S --debug ls No ask_pass set, using default! ...
0
votes
0answers
41 views

How to fix Module is Unknown error without logging in (PiLFS)

I've built a PiLFS distribution and was running it fine about a month ago. Now, when I turn on the Raspberry pi and attempt to login as root with the proper password, it gives the error Module is ...
1
vote
1answer
62 views

What prevents RHEL7 default PAM config's “nullok” option from allowing empty passwords?

The config /etc/pam.d/password-auth is included by several PAM services including sshd. This is its auth stanza: auth required pam_env.so auth sufficient pam_unix.so nullok ...
0
votes
1answer
24 views

Unable to login with password as well as otp in pam module

I have a query regarding PAM module on centos. That is, how can I login with user's one time password after user's password on a single screen? Like Username:rohit Password:.... OTP : .... on a ...
2
votes
0answers
43 views

ACL for a binddn user for PAM?

I've installed 389-ds and created a user and a couple groups. I then configured authconfig on a client to use the LDAP instance to authenticate the user. I've logged in successfully as that user. All ...
1
vote
1answer
74 views

How to allow pam radius module in centos for user's password as well as one time password

I have a problem with the PAM Radius module. Actually, I have it installed already under CentOS. I've inserted the line: auth required /lib/security/pam_radius_auth.so in /etc/pam.d/sshd and ...
1
vote
0answers
13 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
1
vote
0answers
10 views

skip pam_fprintd.so with closed lid

I really love fprintd and I really love having my laptop closed while in docking station. But I hate both together. This is my /etc/pam.d/system-auth: auth sufficient pam_fprintd.so ...
1
vote
0answers
53 views

PAM authentication program in C recognizes only the logged in user [closed]

I am trying to write a C program to authenticate users using PAM. Here is what I have at present: #include <security/pam_appl.h> #include <security/pam_misc.h> #include <stdio.h> ...
1
vote
1answer
49 views

Can't load my PAM module - how to diagnose?

I've written a PAM service module, and added it into lightdm by editing /etc/pam.d/lightdm. But lightdm complains (in /var/log/auth.log on Ubuntu 14.04): Sep 9 14:16:48 Ubuntu-build lightdm: PAM ...
2
votes
0answers
33 views

Is it possible to login to a Linux machine with AD credentials without the machine beeing member of the AD?

I'm asking because as far as I know this is not possible with Windows machines since it's mandatory that a Windows machine is known to the AD in order to login with AD credentials. Is it possible to ...
3
votes
1answer
157 views

Run Script at fail login attempt?

Lately, I've been trying to create a Bash script to capture a webcam photo when a fail attempt to login is registered. First of all, I found 2 guides related to this (links at the end), they explained ...
1
vote
0answers
66 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
1
vote
0answers
468 views

What does “Cannot make/remove an entry for the specified session” mean?

Instead of logging me in, PAM greets me with the message "Cannot make/remove an entry for the specified session" after I enter the password. What entry is it talking about (and what session)? The ...
1
vote
0answers
129 views

pam_tacplus.so and sshd: skip user validation?

I'm trying to implement tacacs authentication on a freebsd box as a client. The box is actually a network appliance that SHOULD have this config built into its cli/ui but doesn't. Since it's built ...
0
votes
0answers
48 views

pam.d password hardening: nullok

In most all pam.d documentation or linux distributions that I saw, the recommend "secure" configuration for password is the following: password required pam_unix.so sha512 shadow nullok ...
5
votes
2answers
110 views

Restrict the times a user is allowed to log in

We have several Backbox 3.13 systems built on Ubuntu 12.04. One of my teenagers does not understand the concept of this thing called "sleep" and tends to get up to play on the computer. I'm trying to ...
0
votes
1answer
39 views

Howto Tell if a System authenticate with password only or through PAM

If my computer has the pam package installed and has the directory /etc/pam.d/sshd, does it mean for sure when I ssh to my computer, I am authenticated through pam modules? The /etc/pam.d/sshd looks ...
3
votes
2answers
289 views

allow only specific users to login via sshd, but refuse connect to non-listed users

I'm running a CentOS server (7.0) and I'd like to login via sshd as a user, not root. So I set PermitRootLogin no in the config file and su - after login. I've received lots of hacking activities and ...
0
votes
0answers
116 views

What processes on CentOS6/RHEL regulates user login but not password itself?

I was doing some maintenance via root account over ssh after several months of inattention. I shutdown, after startup I can't log in to root account at tty or via ssh. Fortunately, sudo works to ...
2
votes
1answer
2k views

Centos 7 and VNC access right?

UPDATE: I posted on the Tiger VNC forum and someone suggested that this may be a result of PolicyKit (now called PolKit, I believe). Does anyone know how to change this policy? These are all ...
5
votes
1answer
415 views

2 Factor Authentication in SSH using public key and PAM

I'm trying to setup 2 Factor Authentication. I want the user to login successfully if: The public private/public key matches (authentication method: publickey) or the password is correct My pam ...
1
vote
1answer
269 views

mount luks volume through pam with gdm

I'm on debian testing. I encrypted my /home with dm-crypt (luks). Following various tutorials I setup pam_mount to open it at login time. However when I try to login using gdm, it fails. The login ...
0
votes
0answers
105 views

Root able to login but non root users are denied - PAM

One of our servers is not letting non-root users login, but root can login without any issues. The following are the messages from /var/log/secure: Jun 24 18:08:43 jonnserver sshd[14470]: debug1: ...
3
votes
0answers
124 views

How to make a PAM substack “requisite”?

For the auth section of my PAM configuration, login and mdm etc. call common-auth. I have common-auth calling the following as a substack (as auth substack krb5ldap-cache-auth): auth optional ...
1
vote
1answer
242 views

Is PAM a user authentication method?

If someone asks that PAM is a user authentication method? Then can we say yes? Or no?
6
votes
3answers
57 views

different passwords depending on plugged-in devices

I would like to have different passwords for my account(s): When (e.g.) a certain USB stick is plugged in then an easy password is to be used. The idea is: If I leave my computer then I take the stick ...
2
votes
1answer
813 views

Home Directories and pam.d using LDAP

Background: I'm not too familiar with the ins and outs of pam and LDAP authentication on a configuration side. I've used systems that use pam but I've only worked on applications, not systems ...
0
votes
1answer
255 views

Why does PAM prevent root from using useradd?

I'm using Arch Linux on a single-user workstation with LXDE and lxde-session autologin to the regular user. I then "su" or "sudo" to root privileges, and try to run "useradd." useradd fails on my ...
1
vote
0answers
300 views

Unmounting shares on logout with pam_mount

I am using pam_mount to mount cifs and sshfs shares for users when they log in to an Arch Linux workstation. I have the a volume line in /etc/security/pam_mount.conf.xml: <volume user="strongbad" ...
1
vote
2answers
144 views

Reset password for regular user who is locked out

I'm a complete noob in Linux and I'm stuck in a situation where I'm logged in an Linux box from putty but on of my colleague, who was trying to login on same machine from his machine blocked my user ...
1
vote
1answer
154 views

pam-auth-update does not display prompt screen or log any failure

~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 12.04.4 LTS Release: 12.04 Codename: precise ~# dpkg -l \*pam\* | grep ii ii libpam-krb5 ...
6
votes
1answer
112 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at ...
2
votes
1answer
99 views

How does `shutdown -k` disable logins?

This is the -k option's documentation in man shutdown (at least on Ubuntu): -k Only send out the warning messages and disable logins, do not actually bring the system down. I initially ...
1
vote
0answers
44 views

How to get the authentication status from the last PAM module run

If I have the following PAM stack: auth required default_pam.so auth requisite my_custom_pam.so .... How do you obtain the authentication status from the last/previous PAM module run for use in ...