Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

2
votes
0answers
9 views

ldap 389 server with sssd client, cannot modify password

I setup the 389 ldap server on a fedora system. I can authenticate against the system, but I cannot update/modify a password neither as root nor as user. user root gets a "Password reset by root is ...
0
votes
0answers
12 views

Async or Parallel PAM Authentication

I did a long google search on PAM authentication. From various sources what i learned is There is a PAM Call stack, which loads config files from different sources. Based on order of modules,its ...
2
votes
2answers
26 views

Why does .pam_environment not include $HOME in my new path?

I created a /home/myname/.pam_environment file containing PATH DEFAULT=${PATH}:${HOME}/apps/flyway But my new path doesn't end with /home/myname/apps/flyway. Why not? $ echo $PATH ...
0
votes
0answers
12 views

Can Linux ldap users still available if ldap server is unlinked?

I have a Linux with some users have their password in /etc/shadow and other authenticate through LDAP. Is there a way to make user that have their password stored on ldap continuing to be available ...
0
votes
0answers
30 views

pam_pkcs11 - Peer's certificate issuer has been marked as not trusted by the user

Whenever I try to use PAM with a smart card via pam_pkcs11.so I get the following error: DEBUG:cert_vfy.c:38: Couldn't verify Cert: Peer's ceritifacte issuer has been marked as not trusted by the ...
2
votes
1answer
9 views

pam_unix delay every 5 attempts

On linux whenever I provide the wrong password, I have to wait 3 seconds. I find this quite annoying and prefer the windows default: no delay until the fifth fail, then it delays for 15 seconds or ...
1
vote
1answer
45 views

Disable null password for root user on Sunsolaris machine?

Currently i am using a SunSolaris machine: bash-3.00# uname -a SunOS labxxxx 5.10 Generic_144488-17 sun4u sparc SUNW,Netra-240 bash-3.00# When i try to set null(blank) password for root, it let me ...
-1
votes
1answer
25 views

Linux + LDAP/ActiveDirectory: Can't create a private group for the user like “username:username”

My apologies first for not phrasing this question very well, because it's difficult to Google. (Try finding a Google answer with the terms "self user group" in it.) Normally, with PAM in Linux, when ...
2
votes
1answer
34 views

Is it possible to have a daemon run a process as another user WITHOUT having a superuser daemon?

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out ...
0
votes
1answer
19 views

PAM filtering via IP for SSH

I know this is probably a bit of a nube question, but I need some input. So if I use last I can see my IP, and it's also in my auth log whether failed or accepted, eg. Dec 9 19:30:16 wilhelm ...
2
votes
1answer
54 views

How to allow unauthenticated logins over ssh on FreeBSD?

I created an account ckurs on my FreeBSD 10 workstation. This account uses a custom shell-script as a login-shell that attaches the user to a tmux-session in read-only mode. I have sufficiently ...
1
vote
0answers
8 views

don't jump to same user-defined chain twice

In my /etc/pam.d/sshd I have a line: session optional pam_exec.so /usr/local/bin/pam_exec_sshd It calls my script whenever I do ssh login or logout. Script contents: #!/bin/bash ...
0
votes
2answers
121 views

How can I set up centralized home directories and user authentication using LDAP and NFS?

I am trying to configure my server to authenticate users using LDAP and save their home directories on a NFS-Directory, also located on the server. i.e.: I share a directory on my server: /nfsexport ...
0
votes
0answers
115 views

How do I enable GDM login for root on Debian?

I want the root user to be able to log in via GDM on Debian Wheezy. I have read about modifying GDM and/or PAM configuration files but the instructions I have found describe specific file layouts ...
0
votes
0answers
17 views

try_first_pass in module cracklib

I'm a bit confused about the actual meaning of option try_first_pass of module pam_cracklib, I've found that: try_first_pass: This option is not supported by cracklib in the default PAM ...
1
vote
0answers
75 views

How to configure pam.d config files in CentOS

I am hardening a CentOS 6.7 VM to CIS standards. https://benchmarks.cisecurity.org/tools2/linux/CIS_CentOS_Linux_6_Benchmark_v1.1.0.pdf The above is the document I am using to harden the image. I am ...
4
votes
1answer
85 views

How to achieve conditional PAM authentication?

I am currently using auth required pam_unix.so try_first_pass nullok auth optional pam_ssh.so use_first_pass (plus some other, probably irrelevant entries Arch Linux added by default), which means ...
3
votes
2answers
220 views

Physically override linux credentials

Say someone gains physical access to my computer, and they want to login to my account and see everything I have. Is it possible that they take the hard-drive out of my computer, modify the file ...
0
votes
0answers
39 views

Doesn't these program respect nsswitch?

I've set up LDAP and nsswitch on ubuntu and to some extent it seem to work. For example getent passwd lists accounts from both /etc/passwd and LDAP server. However for example id <user>, sudo ...
3
votes
1answer
35 views

How to log messages from a pam module?

The problem I am trying to solve is that I want to know if a certain PAM config file is being used or not. The latest version of IBM MQ (V8) provides a PAM file /etc/pam.d/ibmmq. We're ...
1
vote
0answers
64 views

pam sshd: run as root but get user ip

I am trying to make a little script run by pam sshd session optional pam_exec.so /foo/myscript that would want to check the ip of the connecting user and if already in my database, do nothing, if ...
2
votes
1answer
39 views

lost ability to sudo after modifying pam module

On one of our RHEL6 servers I made a change to /etc/pam/d/system-auth and password-auth then after rebooting lost the ability to sudo and su. Specifically I changed this line: auth sufficient ...
1
vote
0answers
114 views

Unable to log into Cockpit server - could not set limit for 'nofile'

I have Cockpit installed on a Fedora 22 VPS that I use for educational purposes. I tried logging into Cockpit from my browser, but I was given a "Permission denied" message, despite using the correct ...
0
votes
1answer
20 views

Will `sufficient` override `requisite`?

I just read the pam.d man page. It states: required: failure of such a PAM will ultimately lead to the PAM-API returning failure [...] and requisite: like required, [...] and ...
1
vote
0answers
39 views

Linux PAM: add specific lib to Makefile and compile a single module

I am dealing with the development of a custom PAM module for a CentOS7 system. As starting point, I'd like to use the project linux-pam, specifically: compiling only the pam_permit module; adding as ...
0
votes
0answers
82 views

Calling a password checking command from PHP using exec() - how to escape user input?

I am working on a PHP-based website where the login form needs to authenticate against local users on the system via PAM - in other words, they should be able to login successfully if they enter a ...
2
votes
2answers
73 views

Using PAM, how is minimum number of days between password changes set?

On my Amazon Linux (RHEL-derived) system, within /etc/login.defs, I've set the minimum number of days between password changes to 1 day: PASS_MIN_DAYS 1. I thought I should be doing that with PAM ...
2
votes
0answers
35 views

Why is my traffic not encrypted when using pam_radius_auth?

I'm experimenting with Freeradius and have configured an ssh gateway to use pam_radius_auth to my ldap servers. In /etc/pam_radius_auth.conf I have: 10.1.1.21 ny3fa4bu7my6ku7 3 10.1.1.22 ...
2
votes
3answers
192 views

Allow SSH access but restrict root's access to a given set of IPs

I want to allow SSH for all users as normal except that I want to restrict root's access based on a set of IP addresses. So, users peter, paul, lary can login from anywhere, but root may login only ...
1
vote
1answer
29 views

persisting multi-factor user data for custom pam authentication in CentOS 7

I am designing n-factor authentication for CentOS 7 using a custom PAM module. When the user tries to SSH, they will be texted a pin code, and be prompted to enter the pin. Where should I store the ...
3
votes
1answer
560 views

How to stop sudo PAM messages in auth.log for a specific user?

I am using Zabbix for monitoring my environment and zabbix_agentd executes as user zabbix one custom script every 60 seconds; it uses sudo to run this script as root. In /var/log/auth.log I see every ...
8
votes
1answer
120 views

How to add additional steps to login?

What I would like to achieve is an interactive program that runs either before or after asking the user for the password, but won't handle over the access to the computer unless it exited with ...
1
vote
0answers
59 views

Can't setup mount of EncFS on user login

I've tried to setup EncFS to be mounted on user login as described in this guide excluding the Password Utility section, however it works with little success. The EncFS works properly ...
2
votes
1answer
167 views

How can I use different kerberos principals for sudo than for system-auth?

At my organization, we're required to use different kerberos principals when authenticating for sudo than for other types of auth, such as logging in. For instance, my regular (login) principal might ...
2
votes
1answer
166 views

Replacement for php5-auth-pam to authenticate website login against local users

I am working on a login for a PHP-based website where users should be successfully logged in if they enter a valid username and password for a local account on the system. Looking around, it seems ...
2
votes
1answer
318 views

How do you get `pam_succeed_if.so` to recognize `service` user?

I have a Linux system with a user named service. I'm using the pam_succeed_if.so module to match this username. For example: auth required pam_succeed_if.so user = service But it won't ...
1
vote
1answer
109 views

Why root is not constrained by pam

I have the following settings in file /etc/pam.d/common-password. password requisite pam_cracklib.so retry=3 lcredit=-1 ucredit=-1 dcredit=-1 password [success=1 ...
1
vote
0answers
61 views

ConsoleKit reports active/is-local only on the second+ login

Running KDE Frameworks 5, Plasma 5, using sddm as a display manager. ConsoleKit and PAM-linux are both installed. Upon login (using the sddm login screen), ck-list-sessions returns FALSE for both ...
3
votes
0answers
138 views

What SELinux context shall the script have to be ran by pam_exec?

I just installed Fedora 22 on my VPS and tried to make trivial thing -- run my informer script on every ssh login via pam_exec. But I was confronted with unexpected difficulties: pam_exec failed with ...
1
vote
1answer
348 views

What is pam_unix2 / why doesn't it exist on some distributions?

Some documentations, blogs and forums and other examples on the web use pam_unix2 in /etc/pam.d/ configurations. An example taken from pam_winbind manpage: auth required pam_env.so auth ...
2
votes
1answer
186 views

Use multiple PAM login methods at once?

I'm using pam-fprintd as a login method. Currently it works perfectly for logging into the cinnamon screensaver and sudo. Unfortunately you have to fail the fingerprint login a certain number of times ...
0
votes
1answer
207 views

Disable PAM login but keeping landscape-sysinfo y motd

Running Ubuntu Server, I have no need for PAM login, and thus disabled this service in the sshd_config file. However, oddly, there is some login info that is only displayed if you enable PAM logins ...
0
votes
1answer
188 views

PAM timestamp - how to inspecting the /var/run/sudo/<user> file?

The centos documentation stated that: ... In the PAM timestamp scheme, the graphical administrative application prompts the user for the root password when it is launched. When the user has ...
0
votes
0answers
307 views

lightdm: (pam_mount.c:477): warning: could not obtain password interactively either

Ubuntu 14.04 does not mount folders, libpam-pkcs11 with ldap mapper $ sudo tail -f /var/log/auth.log May 7 12:58:06 my-company-ub14 lightdm: pam_unix(lightdm-greeter:session): session closed for ...
0
votes
1answer
434 views

what does pam_env.so really do?

Having the following line: auth required pam_env.so Documentation happily says "This module is required—it must run successfully for authentication to proceed." ...
2
votes
1answer
847 views

CUPS not working correctly after Debian Wheezy -> Jessie upgrade because of a faulty libpam

I just upgraded a Debian Wheezy to Jessie, by changing the /etc/apt/sources.lst. If important: I pinned systemd to stay with sysvinit, and after the upgrade I removed the pin. If I now do apt-get ...
2
votes
0answers
334 views

Force OpenSSH / pam / pam_ldapd to do pam_ldapd(sshd:auth) with public-key authentication

I have working pam_ldap authentication using libpam_ldapd. I'm using slapo-nssov and want to use loginStatus attribute which is added to users ldap entry after opening pam session and deleted when its ...
1
vote
1answer
370 views

Password policy on existing accounts not updated after making changes to login.defs

I have two old accounts that were previously set to defaults (no password expiration). I updated login.defs and /etc/pam.d/system-auth for stricter password policy. New accounts added to the system ...
2
votes
2answers
195 views

check “newness” / “is-read” of /var/spool/mail/$USER like pam_mail for custom motd script

How can I check with bash or python (preferred) if there are some unread mails in /var/spool/mail/$USER like pam_mail does? I'd like to use this for my own custom motd script, motd.dynamic
1
vote
0answers
113 views

Using pam_listfile.so with radius authentication

I have set up radius authentication on my machine (as a client - untested yet). The pam radius conf file has the shared secret etc. The radius authentication can potentially authenticate every single ...