Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

2
votes
0answers
181 views

SSH login from external authentication

Here is what I try to accomplish: I have a server with a git repository. I use ISPConfig as control panel for our websites and I want to integrate the ISPConfig API for email authentication as second ...
2
votes
1answer
816 views

tinyproxy with user authentification

Does anybody have a solution that'll make tinyproxy work with user authentification like pam_auth at the squid proxy? I don't want to create a SSH-Tunnel and allow only localhost.
5
votes
2answers
141 views

PAM - required and sufficient control flag

I'm studying PAM, and I'm a bit clueless about the meaning of some combination of control flags. From the Red Hat documentation we have: *required failure of such a PAM will ultimately lead to the ...
4
votes
4answers
203 views

Howto find and move a text line inside a file?

I need to change a text line position inside a file; from one line position to another one, underneath a defined text. For example, I have the following text block (on /etc/pam.d/system-auth file) ...
2
votes
1answer
787 views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
1
vote
0answers
282 views

VSFTP local user works, but PAM users Permission Denied

I am attempting to configure vsftp to use PAM to authenticate virtual users on my Arch server. It seems so straight forward, I must be missing something simple. Configuration local user virtualftp ...
0
votes
1answer
365 views

How does Linux system synchronize wtmp and /var/run/utmp?

Linux system normally stores current user login information in /var/run/utmp, and stores historical information in /var/log/wtmp. So, how does it synchronize information between them, When a login ...
1
vote
3answers
57 views

What is the exact definition for “logging in”

Radu's answer is extremely informative here http://askubuntu.com/questions/376932/why-who-command-does-not-shows-root-as-a-logged-in-user However this makes me wonder "what is the exact definition for ...
2
votes
0answers
823 views

Changing Samba/LDAP password with passwd

We've installed CentOS Directory Server (389 DS) and have Samba using it as a backend. This works great except that when enabling password syncing in the smb.conf it is only synced one way. I could ...
1
vote
0answers
57 views

How to obtain current user environment in pam_script?

I'm running pam_script after pam_krb5 with a session open script. In my script, I need to use the ticket cache generated by krb5 to do something. Well, the script was actually run as root, and ...
2
votes
0answers
432 views

PAM debugging “check pass; user unknown”

I am attempting to get Prosody authenticating with its auth_pam module. It is configured to use the PAM service name xmpp. The pam.d/xmpp file is copied straight from the one configured for dovecot ...
4
votes
1answer
600 views

Escape hash mark (#) in /etc/environment

I am adding an env variable to /etc/environment but because the variable value contains # sign, string is striped. MYSQL_PWD="something#no" Now if I do env above code yields MYSQL_PWD=something. ...
1
vote
2answers
141 views

How to control authentication attempts in PAM?

I would like to configure the no. of times user will be prompted for password(authentication attempts) for login, before dropping the session. Does PAM support this case, if so can you help me out ...
9
votes
2answers
166 views

How to automatically enter sudo's grace period upon CLI login?

What I would like to do is be able to login and sudo commands immediately without entering a password again. It is very redundant to type my password twice in a row when I need to login and run a ...
2
votes
3answers
936 views

How to make RHEL look at access.conf for su -?

I use the file /etc/security/access.conf to dictate what users have access to the server: + : root : LOCAL + : user1 : ALL + : user2 : ALL + : user3 : ALL - : ALL : ALL This works fine for new SSH ...
1
vote
1answer
87 views

Pamtester automate password testing

We have a system image which uses a default password for root. This should be changed, though I have a feeling not all users do this. I know I can test login with pamtester: # pamtester system-auth ...
2
votes
0answers
185 views

Wrong PAM settings: successful login logged as failure

SERVER:/etc/pam.d # head -1 /etc/issue SUSE LINUX Enterprise Server 9.4 SERVER:/etc/pam.d # cat login #%PAM-1.0 auth requisite pam_unix2.so nullok #set_secrpc auth required ...
2
votes
1answer
239 views

pam: action on (unsuccessful) login

I know how to execute an action on login, by adding a line to /etc/profile. But that only gets executed, if the login was successful. I would like to have action executed even when login fails. For ...
3
votes
2answers
259 views

Change password through linux PAM without running application as root

An application I'm writing will have some password change functionality. However I'm wondering if it is possible to not run the account management part of it as root. Right now I'm running into the ...
1
vote
3answers
2k views

PAM login permission denied

I have an OpenSuSE 12.3 machine and can't login to the box either on tty or via ssh. As soon as the user logs in the session terminates and in the message "login [1234] permission denied" is printed. ...
4
votes
2answers
6k views

Avoid “Authentication token manipulation error” on password change

I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own: The /etc/pam.d/passwd configuration file is: #%PAM-1.0 auth include ...
2
votes
1answer
53 views

Is there a PAM Standard?

Related to a StackOverflow question I have. Since it's more or less really a SO question through and through, I won't go into the whole spiel. My platform question is this: Is there an industry ...
3
votes
1answer
52 views

How to lock users with PAM in Scientific Linux 5.5? [duplicate]

I need to lock the users that are trying to log in via SSHD after 5 unsuccessful login tries. I already googled for it, but I just can see it working: root@server:~# faillog -u testuser Login ...
1
vote
2answers
522 views

Prevent root password change in ldap - debian

After setting up ldap authentication with pam in debian, evertything works fine. Using the passwd command change the ldap password of the current user. The problem is my ldap has been set up with an ...
2
votes
1answer
13k views

How to lock users after 5 unsuccessful login tries?

How to lock users after 5 unsuccessful login tries? I gathered a few distributions/versions to how to do it, but I can't test it. RHEL4: by adding the: auth required ...
0
votes
5answers
3k views

SSH login attempts per minute per IP

How can i limit SSH login attempts per minute per IP ? I want to disable login attempts during 5 seconds after a failure. Is this possible ? I'm not talking about ban a user after parsing logs like ...
3
votes
0answers
103 views

Restrict usage of the same password during a time period

I need to configure a server with some requisites on the password changing: in addition to other requisites, I need to ensure that, on a password change, it is not repeated (last 5 passwords) and ...
1
vote
2answers
422 views

Show “last login” information when “su”

I'm trying to configure the PAM modules working with su command. I want to su shows the "last login" information, as ssh or login do. I find, on /etc/pam.d/login a PAM module called pam_lastlog that ...
0
votes
1answer
51 views

Let pam module use hostname -s

Our hostname command gives back the servername.domain. This is in conflict with our authentication mechanism with our Active Directory. Is it possible to let the pam module use hostname -s (the ...
3
votes
1answer
793 views

sudo: unable to initialize PAM: No such file or directory

While trying to build the NumPy Python math module with Intel's Math Kernel Library (MKL) on OSX 10.8.3, I was running into some problems with the Accelerate and vecLib frameworks overriding the MKL. ...
2
votes
0answers
199 views

Including pending update list in motd

How would you include the list and / or count of pending updates in the welcome banner? Eg. username: User password: ***** Hi 'User', welcome on 'localhost' There are 8 pending updates, you need to ...
1
vote
0answers
789 views

pam ldap authentication an AWS EC2 ami (Amazon's ami)

I have some custom built instances running in AWS EC2 that are configured with ldap authentication. I have now brought up one of the AWS-provided EC2 AMIs, and am trying to configure it to work with ...
0
votes
0answers
56 views

How can I add PAM functionality in netkit-rsh-0.17

I am using CentOS. In my project, that is working on a network, I need an rsh utility. I downloaded netkit-rsh-0.17 for that and until recently all worked fine. But now I found that this utility ...
5
votes
1answer
534 views

Default umask 077 not applied at session start

I cannot get the default umask for a session to be 0077. I have edited /etc/login.defs and set the value to 077 there: UMASK 077 Also I've made sure the following entry exists in ...
2
votes
1answer
245 views

Restrict two way SSH and Apache authentication to non-local networks

I am using Google's open-source PAM module for two-way authentication for SSH logins and certain Apache directives. It works great, however I would like to use this only when trying to log in from an ...
-1
votes
2answers
105 views

Why rsh not opens and reads PAM modules and limits.conf?

I am working on a project, that uses rsh utility for remote connection. But my project needs some extra features for that, so I add that features. Till now, all the things are going fine. But when I ...
1
vote
1answer
966 views

Rehashing /etc/shadow. Can I force NIS users to change password?

I'm currently migrating a CentOS environment to a Debian one. The users log in over the network using NIS. I was hoping to copy /etc/shadow from my old server to my new one so that we can offer ...
4
votes
3answers
1k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
0
votes
1answer
3k views

rsh shows “poll: protocol failure in circuit setup”, why?

In the starting rsh worked properly, but after making some changes it shows some error [changes are shown in the end of this question, see that], I am sharing the same. Command $ /usr/bin/rsh ...
16
votes
3answers
1k views

How to prevent shutdown when an SSH user is logged in?

I'm administrating a networked environment and I had an interesting situation arise yesterday. When a host is required to shutdown by a regular user, it refuses to do so if other users are logged in ...
1
vote
1answer
2k views

How to authenticate a user with PAM, that is not the user that started the application

I'm currently developing an authentication module for an application. The decision was made to do this by using PAM. I have made this work but it can only authenticate the user that started the ...
1
vote
2answers
317 views

At login, take picture of user at Login window(loginGUI promt window)

I have code to take a picture in a script. I don't understand how to run this script at the time of login. I would like to modify the login process so that: The user gets 3 login attempts. After 3 ...
1
vote
1answer
449 views

Display dialog from pam_exec environment at login?

I'm using pam_exec to do some root tasks. They take some time, and I'd like to tell the user to wait a moment. I'm doing the tasks there, and not later, because I need: Root permissions To rsync ...
1
vote
1answer
774 views

How do I write a login daemon?

There are many guides to the steps for correctly launching a daemon process, such as Stevens' chapter in Advanced Programming in the UNIX Environment. There is less agreement on what steps should be ...
11
votes
4answers
646 views

Groups differ from the local ones when logging in remotely

We store our users in LDAP, alongside some groups that have meaning across different systems (organizational roles including wheel). There are also groups local to workstations, e.g. audio or video ...
1
vote
1answer
42 views

Find out which program is asking for privilege escalation?

I have a finger print reader on my laptop, and I configured PAM with fprintd, sometimes when it lights up, I want to find out which program is asking for a privilege escalation. Any ideas?
1
vote
1answer
335 views

Unable to log in to Ubuntu server 10.04 after trying to join Windows domain

I was trying to join our Ubuntu 10.04 server to the Windows domain and I ended up editing the pam.d configuration files. My aim was to have domain users log into the Ubuntu server with their domain ...
2
votes
2answers
203 views

Allow 1 hour only in day with PAM

How to allow user to access system only 1 hour in day using PAM? For example I wish to give access to a user only for 1hr on a workstation in 24hrs. First the 24hr time period needs to be defined, as ...
3
votes
1answer
753 views

Setting ulimits without PAM

How to do that? Without PAM on my GNU/Linux OS the number of open files is 1024 by default and cannot be raised above 4096 (via ulimit -n NNNN command) despiting what is written in ...
4
votes
1answer
2k views

How to have pam_exec run the script as the current user?

I need to run a script, when the session is opened, as the user who's opening the session. I have added in /etc/pam.d/common-session : session optional pam_exec.so ...