Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

3
votes
1answer
48 views

PAM failing to authenticate sudo, after successfully contacting ssh-agent

Setting up PAM sudo authentication, using ssh-agent, on 14.04.1-Ubuntu server LTS. I'm still unable to successfully authenticate sudo, via the ssh-agent, using PAM. Here are my relevant /var/log/...
3
votes
1answer
40 views

Force login through ssh only

I have a small problem. I have two accounts on a PC. One is used for "normal" operations, usually through the graphical interface, the other is only used for remote management (upload files through ...
0
votes
0answers
19 views

PAM: make dbus listen to some address

I'm new with PAM and have some questions about it. Is possible to make PAM configure dbus, and make dbus listen to some address?
1
vote
1answer
24 views

Installing pam_radius through package manager

So instead of following the manual installation of pam_radius I installed EPEL and then got to install pam_radius using package manager : yum --enablerepo=epel info pam_radius Loaded plugins: ...
1
vote
0answers
36 views

pam su authentication with RSA token [closed]

We are implementing RSA token authentication in our company and management decide su - should ask for RSA token passcode for individual (listed users) user. So no-one is going to get root password: it'...
0
votes
0answers
21 views

authenticate commands using pam module

This is weird requirement i am not sure possible or not but we have Centrify running in our environment which use dzdo instead of sudo Now i have requirement to ask password for specific command, do ...
1
vote
2answers
84 views

“SSH Virtual Kiosk”. Does “PermitEmptyPasswords yes” work? - How to make ssh user with empty password, so random users can use it?

How to make properly secure ssh account with empty password for running trusted binary? I'd like to make a kind of "virtual ssh Kiosk" for random users, while limiting "demo app" behind ssh "pseudo-...
1
vote
0answers
32 views

Mounting samba directory changes all file permissions to user who mounted it

I have a xubuntu 14.04 client, a debian 8 Samba File server and an external Active Directory service. I log in as user1 on the client authenticating against the ADS with winbind. My home directory /...
1
vote
0answers
29 views

Strange X11 forwarding issue [closed]

I have a strange issue regarding ssh x11 forwarding. Assume I have an host named node71. Firstly, I start Cygwin/X and mintty in Windows, now the local DISPLAY=0.0 Next, I can do ssh root@node71 -Y, ...
1
vote
1answer
47 views

authentication failure on new arch install

Disclaimer: I'm pretty new to this, but I would say I'm very capable. I'm setting up a new machine running Arch and after going through the beginner's guide I rebooted into the machine and when ...
0
votes
0answers
34 views

Mount network share at user logon Red Hat

I'm looking to mount a network share on Red Hat at the time the user logs on with their credentials. The user authenticates through LDAP using Kerberos and we have a network share that holds their ...
1
vote
1answer
24 views

Set user-specific password hashing rounds in PAM

In /etc/pam.d/common-password we have a line such as: password [success=1 default=ignore] pam_unix.so sha512 rounds=200000 Meaning, whenever anyone sets their password, hash it with 200,000 rounds ...
0
votes
1answer
74 views

Allow multiple users to “su” to multiple other users without password

This is similar to this question: Allow user1 to "su - user2" without password However, the solution only work for multiple users accessing "su"ing ONE user. #works fine :) 2 or more ...
1
vote
1answer
94 views

Restrict login via user group in access.conf

I have been working on getting /etc/security/access.conf to work as expected and so far every user can still login. Details are below. I added the following line to /etc/pam.d/login account ...
1
vote
1answer
26 views

How can I set kerberos principal in environment automatically on the remote host?

I use both legacy krsh and ssh to login to a variety of boxes for root administration, as do several colleagues of mine. We all keep different history files by use of a variable calculated by running ...
0
votes
1answer
19 views

2 Factor Authentication in SSH using public key and yubikey

I'm trying to setup 2 Factor Authentication. I want to login via 2 methods: Public Key > YubiKey Password > YubiKey And now I have this done, but I want to specify what users can login via ...
1
vote
0answers
120 views

Freeradius PAM create user and home on login

At this moment i have installed freeradius and PAM radius properly. When i create an account on the system and set a password in /etc/raddb/users.conf the user can login. Sudo also works great with ...
1
vote
0answers
44 views

SLES 11SP4 LDAP - error trying to bind as user - (Invalid credentials)

I have LDAP server configured (with YaST) on SLES 11SP4 and I've created 3 users. I can su (from root) to any of the user but I cannot login as any of them or change their passwords. When I tried to ...
0
votes
2answers
260 views

Permission denied after changing password (password is correct)

I'm currently trying to configure a system where the initial install was done by someone else. I could ssh into the box, and while on it, added some groups to me account and changed my password (I ...
2
votes
0answers
119 views

Linux Authentication Flow (NSS -> PAM -> AD)

I am a new system administrator at an organization looking to understand the process flow of authentication in regards to how NSS, PAM and WINBIND work together. We've been having winbind related ...
2
votes
0answers
31 views

Active Directory UID Mapping to Specific Unix UIDs

I need a bit of help here. I'm a junior systems admin who's sort of been thrown into the deep end with everything! I really don't understand the translation of Active Directory UIDs Mapping to Unix ...
0
votes
1answer
51 views

pam_mount changes owner of mountpoint to root

On Debian 8.3 I want to mount an encrypted container /usr/local/share/test.img with pam_mount at login at the mountpoint /home/test (which is owned by test, of course). The LUKS encrypted disk image ...
2
votes
0answers
48 views

ldap 389 server with sssd client, cannot modify password

I setup the 389 ldap server on a fedora system. I can authenticate against the system, but I cannot update/modify a password neither as root nor as user. user root gets a "Password reset by root is ...
0
votes
0answers
24 views

Async or Parallel PAM Authentication

I did a long google search on PAM authentication. From various sources what i learned is There is a PAM Call stack, which loads config files from different sources. Based on order of modules,its ...
2
votes
2answers
61 views

Why does .pam_environment not include $HOME in my new path?

I created a /home/myname/.pam_environment file containing PATH DEFAULT=${PATH}:${HOME}/apps/flyway But my new path doesn't end with /home/myname/apps/flyway. Why not? $ echo $PATH /usr/local/sbin:/...
0
votes
0answers
16 views

Can Linux ldap users still available if ldap server is unlinked?

I have a Linux with some users have their password in /etc/shadow and other authenticate through LDAP. Is there a way to make user that have their password stored on ldap continuing to be available (...
0
votes
0answers
406 views

pam_pkcs11 - Peer's certificate issuer has been marked as not trusted by the user

Whenever I try to use PAM with a smart card via pam_pkcs11.so I get the following error: DEBUG:cert_vfy.c:38: Couldn't verify Cert: Peer's ceritifacte issuer has been marked as not trusted by the ...
2
votes
1answer
32 views

pam_unix delay every 5 attempts

On linux whenever I provide the wrong password, I have to wait 3 seconds. I find this quite annoying and prefer the windows default: no delay until the fifth fail, then it delays for 15 seconds or ...
1
vote
1answer
90 views

Disable null password for root user on Sunsolaris machine?

Currently i am using a SunSolaris machine: bash-3.00# uname -a SunOS labxxxx 5.10 Generic_144488-17 sun4u sparc SUNW,Netra-240 bash-3.00# When i try to set null(blank) password for root, it let me ...
-1
votes
1answer
41 views

Linux + LDAP/ActiveDirectory: Can't create a private group for the user like “username:username”

My apologies first for not phrasing this question very well, because it's difficult to Google. (Try finding a Google answer with the terms "self user group" in it.) Normally, with PAM in Linux, when ...
2
votes
1answer
51 views

Is it possible to have a daemon run a process as another user WITHOUT having a superuser daemon?

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out ...
0
votes
1answer
42 views

PAM filtering via IP for SSH

I know this is probably a bit of a nube question, but I need some input. So if I use last I can see my IP, and it's also in my auth log whether failed or accepted, eg. Dec 9 19:30:16 wilhelm sshd[...
2
votes
1answer
94 views

How to allow unauthenticated logins over ssh on FreeBSD?

I created an account ckurs on my FreeBSD 10 workstation. This account uses a custom shell-script as a login-shell that attaches the user to a tmux-session in read-only mode. I have sufficiently ...
1
vote
0answers
13 views

don't jump to same user-defined chain twice

In my /etc/pam.d/sshd I have a line: session optional pam_exec.so /usr/local/bin/pam_exec_sshd It calls my script whenever I do ssh login or logout. Script contents: #!/bin/bash IPTABLES=/usr/sbin/...
2
votes
2answers
360 views

How can I set up centralized home directories and user authentication using LDAP and NFS?

I am trying to configure my server to authenticate users using LDAP and save their home directories on a NFS-Directory, also located on the server. i.e.: I share a directory on my server: /nfsexport ...
0
votes
0answers
272 views

How do I enable GDM login for root on Debian?

I want the root user to be able to log in via GDM on Debian Wheezy. I have read about modifying GDM and/or PAM configuration files but the instructions I have found describe specific file layouts ...
0
votes
0answers
53 views

try_first_pass in module cracklib

I'm a bit confused about the actual meaning of option try_first_pass of module pam_cracklib, I've found that: try_first_pass: This option is not supported by cracklib in the default PAM ...
1
vote
0answers
216 views

How to configure pam.d config files in CentOS

I am hardening a CentOS 6.7 VM to CIS standards. https://benchmarks.cisecurity.org/tools2/linux/CIS_CentOS_Linux_6_Benchmark_v1.1.0.pdf The above is the document I am using to harden the image. I am ...
4
votes
1answer
214 views

How to achieve conditional PAM authentication?

I am currently using auth required pam_unix.so try_first_pass nullok auth optional pam_ssh.so use_first_pass (plus some other, probably irrelevant entries Arch Linux added by default), which means ...
3
votes
2answers
228 views

Physically override linux credentials

Say someone gains physical access to my computer, and they want to login to my account and see everything I have. Is it possible that they take the hard-drive out of my computer, modify the file /etc/...
0
votes
0answers
64 views

Doesn't these program respect nsswitch?

I've set up LDAP and nsswitch on ubuntu and to some extent it seem to work. For example getent passwd lists accounts from both /etc/passwd and LDAP server. However for example id <user>, sudo -...
3
votes
1answer
87 views

How to log messages from a pam module?

The problem I am trying to solve is that I want to know if a certain PAM config file is being used or not. The latest version of IBM MQ (V8) provides a PAM file /etc/pam.d/ibmmq. We're ...
1
vote
0answers
79 views

pam sshd: run as root but get user ip

I am trying to make a little script run by pam sshd session optional pam_exec.so /foo/myscript that would want to check the ip of the connecting user and if already in my database, do nothing, if ...
2
votes
1answer
46 views

lost ability to sudo after modifying pam module

On one of our RHEL6 servers I made a change to /etc/pam/d/system-auth and password-auth then after rebooting lost the ability to sudo and su. Specifically I changed this line: auth sufficient ...
3
votes
0answers
198 views

Unable to log into Cockpit server - could not set limit for 'nofile'

I have Cockpit installed on a Fedora 22 VPS that I use for educational purposes. I tried logging into Cockpit from my browser, but I was given a "Permission denied" message, despite using the correct ...
0
votes
1answer
28 views

Will `sufficient` override `requisite`?

I just read the pam.d man page. It states: required: failure of such a PAM will ultimately lead to the PAM-API returning failure [...] and requisite: like required, [...] and ...
1
vote
0answers
51 views

Linux PAM: add specific lib to Makefile and compile a single module

I am dealing with the development of a custom PAM module for a CentOS7 system. As starting point, I'd like to use the project linux-pam, specifically: compiling only the pam_permit module; adding as ...
0
votes
0answers
138 views

Calling a password checking command from PHP using exec() - how to escape user input?

I am working on a PHP-based website where the login form needs to authenticate against local users on the system via PAM - in other words, they should be able to login successfully if they enter a ...
2
votes
2answers
108 views

Using PAM, how is minimum number of days between password changes set?

On my Amazon Linux (RHEL-derived) system, within /etc/login.defs, I've set the minimum number of days between password changes to 1 day: PASS_MIN_DAYS 1. I thought I should be doing that with PAM ...
2
votes
0answers
52 views

Why is my traffic not encrypted when using pam_radius_auth?

I'm experimenting with Freeradius and have configured an ssh gateway to use pam_radius_auth to my ldap servers. In /etc/pam_radius_auth.conf I have: 10.1.1.21 ny3fa4bu7my6ku7 3 10.1.1.22 ...