Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

1
vote
0answers
7 views

pam_tacplus.so and sshd: skip user validation?

I'm trying to implement tacacs authentication on a freebsd box as a client. The box is actually a network appliance that SHOULD have this config built into its cli/ui but doesn't. Since it's built ...
0
votes
0answers
19 views

pam.d password hardening: nullok

In most all pam.d documentation or linux distributions that I saw, the recommend "secure" configuration for password is the following: password required pam_unix.so sha512 shadow nullok ...
5
votes
1answer
55 views

Restrict the times a user is allowed to log in

We have several Backbox 3.13 systems built on Ubuntu 12.04. One of my teenagers does not understand the concept of this thing called "sleep" and tends to get up to play on the computer. I'm trying to ...
0
votes
1answer
19 views

Howto Judge if a System authenticate with password only or through PAM

If my computer has the pam package installed and has the directory /etc/pam.d/sshd, does it mean for sure when I ssh to my computer, I am authenticated through pam modules? The /etc/pam.d/sshd looks ...
3
votes
2answers
48 views

allow only specific users to login via sshd, but refuse connect to non-listed users

I'm running a CentOS server (7.0) and I'd like to login via sshd as a user, not root. So I set PermitRootLogin no in the config file and su - after login. I've received lots of hacking activities and ...
0
votes
0answers
49 views

What processes on CentOS6/RHEL regulates user login but not password itself?

I was doing some maintenance via root account over ssh after several months of inattention. I shutdown, after startup I can't log in to root account at tty or via ssh. Fortunately, sudo works to ...
2
votes
1answer
1k views

Centos 7 and VNC access right?

UPDATE: I posted on the Tiger VNC forum and someone suggested that this may be a result of PolicyKit (now called PolKit, I believe). Does anyone know how to change this policy? These are all ...
5
votes
1answer
127 views

2 Factor Authentication in SSH using public key and PAM

I'm trying to setup 2 Factor Authentication. I want the user to login successfully if: The public private/public key matches (authentication method: publickey) or the password is correct My pam ...
1
vote
1answer
74 views

mount luks volume through pam with gdm

I'm on debian testing. I encrypted my /home with dm-crypt (luks). Following various tutorials I setup pam_mount to open it at login time. However when I try to login using gdm, it fails. The login ...
0
votes
0answers
47 views

Root able to login but non root users are denied - PAM

One of our servers is not letting non-root users login, but root can login without any issues. The following are the messages from /var/log/secure: Jun 24 18:08:43 jonnserver sshd[14470]: debug1: ...
3
votes
0answers
48 views

How to make a PAM substack “requisite”?

For the auth section of my PAM configuration, login and mdm etc. call common-auth. I have common-auth calling the following as a substack (as auth substack krb5ldap-cache-auth): auth optional ...
1
vote
1answer
159 views

Is PAM a user authentication method?

If someone asks that PAM is a user authentication method? Then can we say yes? Or no?
5
votes
3answers
48 views

different passwords depending on plugged-in devices

I would like to have different passwords for my account(s): When (e.g.) a certain USB stick is plugged in then an easy password is to be used. The idea is: If I leave my computer then I take the stick ...
1
vote
1answer
129 views

Home Directories and pam.d using LDAP

Background: I'm not too familiar with the ins and outs of pam and LDAP authentication on a configuration side. I've used systems that use pam but I've only worked on applications, not systems ...
0
votes
1answer
110 views

Why does PAM prevent root from using useradd?

I'm using Arch Linux on a single-user workstation with LXDE and lxde-session autologin to the regular user. I then "su" or "sudo" to root privileges, and try to run "useradd." useradd fails on my ...
1
vote
0answers
114 views

Unmounting shares on logout with pam_mount

I am using pam_mount to mount cifs and sshfs shares for users when they log in to an Arch Linux workstation. I have the a volume line in /etc/security/pam_mount.conf.xml: <volume user="strongbad" ...
1
vote
2answers
68 views

Reset password for regular user who is locked out

I'm a complete noob in Linux and I'm stuck in a situation where I'm logged in an Linux box from putty but on of my colleague, who was trying to login on same machine from his machine blocked my user ...
1
vote
1answer
61 views

pam-auth-update does not display prompt screen or log any failure

~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 12.04.4 LTS Release: 12.04 Codename: precise ~# dpkg -l \*pam\* | grep ii ii libpam-krb5 ...
6
votes
1answer
93 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at ...
2
votes
1answer
68 views

How does `shutdown -k` disable logins?

This is the -k option's documentation in man shutdown (at least on Ubuntu): -k Only send out the warning messages and disable logins, do not actually bring the system down. I initially ...
1
vote
0answers
37 views

How to get the authentication status from the last PAM module run

If I have the following PAM stack: auth required default_pam.so auth requisite my_custom_pam.so .... How do you obtain the authentication status from the last/previous PAM module run for use in ...
0
votes
0answers
86 views

sshd without pam slower

I am running OpenSSH_6.5 with UsePAM yes in my board. I have observed that with UsePAM no in /etc/ssh/sshd_config, sshd runs slower than previous case. How is this possible? My understanding is ...
1
vote
0answers
29 views

libpam load pam modules at every connection

I want to reduce ssh connection time, by debugging sshd have found that libpam is loading all pam modules specified in /etc/pam.d/sshd file at every connection. How to configure/modifiy libpam such ...
3
votes
1answer
387 views

Why does pam_mount ask for password?

I used the pam-auth-update tool in order to enable some pam configuration profiles: PAM configuration PAM profiles to enable: [*] encfs encrypted home directories [*] Unix ...
1
vote
0answers
352 views

PAM's passwd retry prompt fail

I am trying to use PAM to stop password reuse. Adding 'remember=24' to pam_unix stores the old passwords hashed with MD5 which I find unnerving. I was recommended 'pam_pwhistory' instead. Here is the ...
1
vote
1answer
47 views

Pass login messages to tmux

When I login, I connect to a tmux session (either by exec'ing tmux if there is no current session, or exec'ing tmux attach if there is). However this means I don't see the login messages (/etc/issue, ...
1
vote
1answer
95 views

How can I retrieve screen unlock times in Gnome on later Red Hat variants?

The last command only retrieves the login times. I'm interested in the times that the screen was unlocked. Any indirect means of getting this are also welcome.
1
vote
0answers
62 views

Ulimits and pam modules

Can you explain me the relation of ulimit setting on a proccess and line session required pam_limits.so in pam module. In wich modules i really require this line? I have this line in pam.d/su ...
2
votes
1answer
198 views

PAM Authentication and SSH access based on user info stored in sqlite3

I have an application that runs on a Linux box. The application stores all its user information (like - username, password, ssh-allowed, etc) in an sqlite3 database as follows. username ...
4
votes
2answers
269 views

Allow user1 to “su - user2” without password

I need to allow user martin to switch to user martin-test without password su - martin-test I think this can be configured in /etc/pam.d/su. There are already some lines in that file which can be ...
2
votes
1answer
113 views

Problem with log in after change locale, maybe relate to PAM

System information: Debian Wheezy CPU: intel core i7 3770 I initially only had en_US.UTF-8 as the default language. This morning, I changed the /etc/local.gen file and un-comment the zh_CN.UTF-8 and ...
2
votes
0answers
171 views

SSH login from external authentication

Here is what I try to accomplish: I have a server with a git repository. I use ISPConfig as control panel for our websites and I want to integrate the ISPConfig API for email authentication as second ...
2
votes
1answer
624 views

tinyproxy with user authentification

Does anybody have a solution that'll make tinyproxy work with user authentification like pam_auth at the squid proxy? I don't want to create a SSH-Tunnel and allow only localhost.
5
votes
2answers
118 views

PAM - required and sufficient control flag

I'm studying PAM, and I'm a bit clueless about the meaning of some combination of control flags. From the Red Hat documentation we have: *required failure of such a PAM will ultimately lead to the ...
4
votes
4answers
173 views

Howto find and move a text line inside a file?

I need to change a text line position inside a file; from one line position to another one, underneath a defined text. For example, I have the following text block (on /etc/pam.d/system-auth file) ...
2
votes
1answer
570 views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
1
vote
0answers
230 views

VSFTP local user works, but PAM users Permission Denied

I am attempting to configure vsftp to use PAM to authenticate virtual users on my Arch server. It seems so straight forward, I must be missing something simple. Configuration local user virtualftp ...
0
votes
1answer
276 views

How does Linux system synchronize wtmp and /var/run/utmp?

Linux system normally stores current user login information in /var/run/utmp, and stores historical information in /var/log/wtmp. So, how does it synchronize information between them, When a login ...
1
vote
3answers
55 views

What is the exact definition for “logging in”

Radu's answer is extremely informative here http://askubuntu.com/questions/376932/why-who-command-does-not-shows-root-as-a-logged-in-user However this makes me wonder "what is the exact definition for ...
2
votes
0answers
627 views

Changing Samba/LDAP password with passwd

We've installed CentOS Directory Server (389 DS) and have Samba using it as a backend. This works great except that when enabling password syncing in the smb.conf it is only synced one way. I could ...
1
vote
0answers
52 views

How to obtain current user environment in pam_script?

I'm running pam_script after pam_krb5 with a session open script. In my script, I need to use the ticket cache generated by krb5 to do something. Well, the script was actually run as root, and ...
2
votes
0answers
347 views

PAM debugging “check pass; user unknown”

I am attempting to get Prosody authenticating with its auth_pam module. It is configured to use the PAM service name xmpp. The pam.d/xmpp file is copied straight from the one configured for dovecot ...
4
votes
1answer
386 views

Escape hash mark (#) in /etc/environment

I am adding an env variable to /etc/environment but because the variable value contains # sign, string is striped. MYSQL_PWD="something#no" Now if I do env above code yields MYSQL_PWD=something. ...
1
vote
2answers
128 views

How to control authentication attempts in PAM?

I would like to configure the no. of times user will be prompted for password(authentication attempts) for login, before dropping the session. Does PAM support this case, if so can you help me out ...
9
votes
2answers
150 views

How to automatically enter sudo's grace period upon CLI login?

What I would like to do is be able to login and sudo commands immediately without entering a password again. It is very redundant to type my password twice in a row when I need to login and run a ...
2
votes
3answers
610 views

How to make RHEL look at access.conf for su -?

I use the file /etc/security/access.conf to dictate what users have access to the server: + : root : LOCAL + : user1 : ALL + : user2 : ALL + : user3 : ALL - : ALL : ALL This works fine for new SSH ...
1
vote
1answer
72 views

Pamtester automate password testing

We have a system image which uses a default password for root. This should be changed, though I have a feeling not all users do this. I know I can test login with pamtester: # pamtester system-auth ...
2
votes
0answers
165 views

Wrong PAM settings: successful login logged as failure

SERVER:/etc/pam.d # head -1 /etc/issue SUSE LINUX Enterprise Server 9.4 SERVER:/etc/pam.d # cat login #%PAM-1.0 auth requisite pam_unix2.so nullok #set_secrpc auth required ...
3
votes
1answer
201 views

pam: action on (unsuccessful) login

I know how to execute an action on login, by adding a line to /etc/profile. But that only gets executed, if the login was successful. I would like to have action executed even when login fails. For ...
3
votes
2answers
224 views

Change password through linux PAM without running application as root

An application I'm writing will have some password change functionality. However I'm wondering if it is possible to not run the account management part of it as root. Right now I'm running into the ...