Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

0
votes
1answer
34 views

PAM timestamp - how to inspecting the /var/run/sudo/<user> file?

The centos documentation stated that: ... In the PAM timestamp scheme, the graphical administrative application prompts the user for the root password when it is launched. When the user has ...
0
votes
0answers
26 views

lightdm: (pam_mount.c:477): warning: could not obtain password interactively either

Ubuntu 14.04 does not mount folders, libpam-pkcs11 with ldap mapper $ sudo tail -f /var/log/auth.log May 7 12:58:06 my-company-ub14 lightdm: pam_unix(lightdm-greeter:session): session closed for ...
0
votes
1answer
18 views

what does pam_env.so really do?

Having the following line: auth required pam_env.so Documentation happily says "This module is required—it must run successfully for authentication to proceed." ...
1
vote
2answers
140 views

CUPS not working correctly after Debian Wheezy -> Jessie upgrade because of a faulty libpam

I just upgraded a Debian Wheezy to Jessie, by changing the /etc/apt/sources.lst. If important: I pinned systemd to stay with sysvinit, and after the upgrade I removed the pin. If I now do apt-get ...
2
votes
0answers
73 views

Force OpenSSH / pam / pam_ldapd to do pam_ldapd(sshd:auth) with public-key authentication

I have working pam_ldap authentication using libpam_ldapd. I'm using slapo-nssov and want to use loginStatus attribute which is added to users ldap entry after opening pam session and deleted when its ...
1
vote
1answer
34 views

Password policy on existing accounts not updated after making changes to login.defs

I have two old accounts that were previously set to defaults (no password expiration). I updated login.defs and /etc/pam.d/system-auth for stricter password policy. New accounts added to the system ...
2
votes
2answers
55 views

check “newness” / “is-read” of /var/spool/mail/$USER like pam_mail for custom motd script

How can I check with bash or python (preferred) if there are some unread mails in /var/spool/mail/$USER like pam_mail does? I'd like to use this for my own custom motd script, motd.dynamic
1
vote
0answers
36 views

Using pam_listfile.so with radius authentication

I have set up radius authentication on my machine (as a client - untested yet). The pam radius conf file has the shared secret etc. The radius authentication can potentially authenticate every single ...
1
vote
1answer
18 views

common-account line read order

My authentication is centralized in a LDAP. I've one login system who is working without any ldap so it's present in my /etc/passwd file. This my common-account file in pam.d directory. account ...
1
vote
0answers
32 views

PAM and fprintd

Occasionally I get an error on the login screen of Ubuntu 14.04 under unity. The problem occurs after waking up from suspend after closing the lid. Essentially instead of asking me first for ...
0
votes
1answer
110 views

dyanamically creating directories with pam_mkhomedir and mysql for vsftpd

I'm a Linux noob, so hopefully someone will be able to help me to get this up and running. I've installed vsftpd using the following instructions ...
0
votes
2answers
88 views

Setting up a script on an AMI box to create directories - vsftpd, pam, mysql

I'd like to first say I'm a noob when it comes to linux, so please excuse my confusion. I'm trying to setup vsftpd on a amazon ami 64 bit box, free tier micro. Following these instructions, ...
1
vote
2answers
260 views

Unable to determine your tty name on Debian Wheezy on ARM

while trying to create my Debian Wheezy image for a FriendlyARM mini210s ARM single board computer, I am bumping into this issue. I have opened a terminal via serial sudo screen /dev/cu.usbserial ...
6
votes
1answer
143 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
0
votes
1answer
79 views

useradd PAM authentication failed

I needed to customize useradd command so i downloaded shadow-utils source package. Using configure-make i was able to compile the source , binary was generated (configure prefix) at custom location ...
1
vote
0answers
132 views

removing `nullok` from system-auth prevents any root password

[ this is a follow-up on my post on ServerFault : http://serverfault.com/questions/661136/root-accepts-any-password-how-to-change-to-a-real-password ] On an old system the root account accepts any ...
2
votes
0answers
129 views

Debian ignores PAM env variables (while Arch doesn't)

I have a weird issue with my Debian Sid system. I want to set a global environment variable in /etc/environment, which is supposed to be read by the pam_env module. Unfortunately, after having relogin ...
2
votes
2answers
162 views

Warn about password expiration without forcing change

It's pretty simple. I would like to figure out what combination of changes in /etc/login.defs and/or /etc/pam.d/system-auth-ac I would need to perform to allow the following behavior: I want a ...
0
votes
1answer
228 views

Password fail delay is too long - Linux Mint 17

As per the title, the delay after a failed password is very long. In /etc/pam.d/login, FAIL_DELAY is configured as auth optional pam_faildelay.so delay=3000000 however, actual delay is ...
1
vote
0answers
56 views

Configure pam_mount to prompt for password

I have configured my Ubuntu system to mount a cifs share using pam_mount and a credentials file (the credentials to access the cifs share are different to those I use on my Linux machine). I'd like to ...
1
vote
0answers
142 views

With pam_script, how do I pass PAM_AUTHTOK and PAM_USER in all cases?

I need to run a script whenever a user enters a password; the script should be able to reject that password, but shouldn't be sufficient. I placed the script in /etc/pamunlockscript/pam_script_auth ...
2
votes
0answers
84 views

Is there way to print the entered password in PAM?

We are using CentOS 6.5. We have a perl script for our automation testing. One of the script login to the user as non-root user and test "su -" command. This test case passes most of the times but ...
11
votes
2answers
2k views

How do I force a user to change a password at the first time login using ssh?

I'm trying to force a newly created user to change a password at the first time login using ssh. For security reasons I want to give him a secure password until he logs in for the first time. I did ...
0
votes
1answer
90 views

Can't get OpenLDAP and Pam LDAP working at all

Yesterday, I set up an OpenLDAP server and tried to configure it to be useful for SSH. Followed these two guides from DigitalOcean: ...
3
votes
0answers
92 views

Why libpam-systemd run interactively on apt upgrade, even when specified force-confdef/force-confold

I upgrade my packages using aptitude, specifying the apt options --force-confdef and --force-confold. This generally works, but the package libpam-systemd (204-5ubuntu20.8, on Ubuntu 14.04) still ...
2
votes
1answer
90 views

What's the correct way to authenticate a user without PAM?

as my related question doesn't seem to get much love, here another one: What's the proper way to authenticate a user via username/password prompt in Linux nowadays? In principle, I suppose I would ...
1
vote
1answer
289 views

Can't Login to Debian 7.7 with Kerberos/NIS user

I have a Debian 7.7 system I am trying to configure to use Kerberos and NIS, both served from an Active Directory server. I have kerberos set up such that I can kinit a set of credentials from the AD ...
1
vote
1answer
115 views

basic explanation on NSS , LDAP and PAM

can anyone give me a basic explanation on what are NSS , LDAP and PAM and what they used for and what is their relationship/differences ?
6
votes
1answer
281 views

First sudo always slow

The first sudo I enter on my Ubuntu 14.04 server is always slow. The password prompt displays immediately, but after I press enter it takes about 10-15 seconds until the output is printed. All sudo ...
0
votes
0answers
456 views

While trying to ssh, pam_ldap always sends the password “INCORRECT” causing bind to fail

I installed ldap-auth-client nscd ldap-utils on lubuntu 14.04 running on a banana pi. I can successfully bind as the user using ldapwhoami, but I cannot log in via ssh: Auth.log: Oct 21 02:12:05 ...
2
votes
0answers
42 views

Integrate my own PAM module with the passwd command

I know that to integrate my module with the passwd command all I need to do is add the following line to the /etc/pam.d/passwd file: password sufficient mymodule.so My question is I want my module ...
2
votes
1answer
31 views

Externally authenticate user within PAM session/PAM session within PAM session

Is there a way of properly authenticating a user from within a custom PAM session? I am currently writing my own PAM authentication module which allows the user to login via an external token. This ...
1
vote
1answer
163 views

How to disallow usage of an LDAP root account

I am responsible for a couple of servers at my university. All of these machines are configured to talk to the LDAP server of my departement to allow centralised user logins. On this LDAP server there ...
2
votes
1answer
2k views

Expired password and SSH key based login with UsePAM yes

There is a SLES 11 machine. The users logs in via SSH and pubkey (mixed, some user uses password, some use ssh key) The sshd_config has: UsePAM yes PasswordAuthentication yes PubkeyAuthentication ...
1
vote
0answers
170 views

gksu -S ask for password only once even when set to three times in sudo configuration

I have a problem with gksu command. It always ask for password only once even when I set Defaults passwd_tries=3 in /etc/sudoers file. Command: $ gksu -S --debug ls No ask_pass set, using default! ...
0
votes
0answers
84 views

How to fix Module is Unknown error without logging in (PiLFS)

I've built a PiLFS distribution and was running it fine about a month ago. Now, when I turn on the Raspberry pi and attempt to login as root with the proper password, it gives the error Module is ...
1
vote
1answer
166 views

What prevents RHEL7 default PAM config's “nullok” option from allowing empty passwords?

The config /etc/pam.d/password-auth is included by several PAM services including sshd. This is its auth stanza: auth required pam_env.so auth sufficient pam_unix.so nullok ...
0
votes
1answer
32 views

Unable to login with password as well as otp in pam module

I have a query regarding PAM module on centos. That is, how can I login with user's one time password after user's password on a single screen? Like Username:rohit Password:.... OTP : .... on a ...
2
votes
0answers
103 views

ACL for a binddn user for PAM?

I've installed 389-ds and created a user and a couple groups. I then configured authconfig on a client to use the LDAP instance to authenticate the user. I've logged in successfully as that user. All ...
1
vote
1answer
296 views

How to allow pam radius module in centos for user's password as well as one time password

I have a problem with the PAM Radius module. Actually, I have it installed already under CentOS. I've inserted the line: auth required /lib/security/pam_radius_auth.so in /etc/pam.d/sshd and ...
1
vote
0answers
25 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
1
vote
0answers
16 views

skip pam_fprintd.so with closed lid

I really love fprintd and I really love having my laptop closed while in docking station. But I hate both together. This is my /etc/pam.d/system-auth: auth sufficient pam_fprintd.so ...
1
vote
1answer
132 views

Can't load my PAM module - how to diagnose?

I've written a PAM service module, and added it into lightdm by editing /etc/pam.d/lightdm. But lightdm complains (in /var/log/auth.log on Ubuntu 14.04): Sep 9 14:16:48 Ubuntu-build lightdm: PAM ...
2
votes
0answers
38 views

Is it possible to login to a Linux machine with AD credentials without the machine beeing member of the AD?

I'm asking because as far as I know this is not possible with Windows machines since it's mandatory that a Windows machine is known to the AD in order to login with AD credentials. Is it possible to ...
3
votes
1answer
267 views

Run Script at fail login attempt?

Lately, I've been trying to create a Bash script to capture a webcam photo when a fail attempt to login is registered. First of all, I found 2 guides related to this (links at the end), they explained ...
2
votes
0answers
144 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
1
vote
0answers
1k views

What does “Cannot make/remove an entry for the specified session” mean?

Instead of logging me in, PAM greets me with the message "Cannot make/remove an entry for the specified session" after I enter the password. What entry is it talking about (and what session)? The ...
1
vote
0answers
287 views

pam_tacplus.so and sshd: skip user validation?

I'm trying to implement tacacs authentication on a freebsd box as a client. The box is actually a network appliance that SHOULD have this config built into its cli/ui but doesn't. Since it's built ...
0
votes
0answers
99 views

pam.d password hardening: nullok

In most all pam.d documentation or linux distributions that I saw, the recommend "secure" configuration for password is the following: password required pam_unix.so sha512 shadow nullok ...
7
votes
3answers
158 views

Restrict the times a user is allowed to log in

We have several Backbox 3.13 systems built on Ubuntu 12.04. One of my teenagers does not understand the concept of this thing called "sleep" and tends to get up to play on the computer. I'm trying to ...