Tagged Questions

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

1
vote
0answers
97 views

Ulimits and pam modules

Can you explain me the relation of ulimit setting on a proccess and line session required pam_limits.so in pam module. In wich modules i really require this line? I have this line in pam.d/su ...
2
votes
1answer
274 views

PAM Authentication and SSH access based on user info stored in sqlite3

I have an application that runs on a Linux box. The application stores all its user information (like - username, password, ssh-allowed, etc) in an sqlite3 database as follows. username ...
3
votes
2answers
910 views

Allow user1 to “su - user2” without password

I need to allow user martin to switch to user martin-test without password su - martin-test I think this can be configured in /etc/pam.d/su. There are already some lines in that file which can be ...
2
votes
1answer
151 views

Problem with log in after change locale, maybe relate to PAM

System information: Debian Wheezy CPU: intel core i7 3770 I initially only had en_US.UTF-8 as the default language. This morning, I changed the /etc/local.gen file and un-comment the zh_CN.UTF-8 and ...
2
votes
0answers
183 views

SSH login from external authentication

Here is what I try to accomplish: I have a server with a git repository. I use ISPConfig as control panel for our websites and I want to integrate the ISPConfig API for email authentication as second ...
2
votes
1answer
904 views

tinyproxy with user authentification

Does anybody have a solution that'll make tinyproxy work with user authentification like pam_auth at the squid proxy? I don't want to create a SSH-Tunnel and allow only localhost.
5
votes
2answers
149 views

PAM - required and sufficient control flag

I'm studying PAM, and I'm a bit clueless about the meaning of some combination of control flags. From the Red Hat documentation we have: *required failure of such a PAM will ultimately lead to the ...
4
votes
4answers
219 views

Howto find and move a text line inside a file?

I need to change a text line position inside a file; from one line position to another one, underneath a defined text. For example, I have the following text block (on /etc/pam.d/system-auth file) ...
2
votes
1answer
909 views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
1
vote
0answers
309 views

VSFTP local user works, but PAM users Permission Denied

I am attempting to configure vsftp to use PAM to authenticate virtual users on my Arch server. It seems so straight forward, I must be missing something simple. Configuration local user virtualftp ...
0
votes
1answer
409 views

How does Linux system synchronize wtmp and /var/run/utmp?

Linux system normally stores current user login information in /var/run/utmp, and stores historical information in /var/log/wtmp. So, how does it synchronize information between them, When a login ...
1
vote
3answers
60 views

What is the exact definition for “logging in”

Radu's answer is extremely informative here http://askubuntu.com/questions/376932/why-who-command-does-not-shows-root-as-a-logged-in-user However this makes me wonder "what is the exact definition for ...
2
votes
0answers
894 views

Changing Samba/LDAP password with passwd

We've installed CentOS Directory Server (389 DS) and have Samba using it as a backend. This works great except that when enabling password syncing in the smb.conf it is only synced one way. I could ...
1
vote
0answers
59 views

How to obtain current user environment in pam_script?

I'm running pam_script after pam_krb5 with a session open script. In my script, I need to use the ticket cache generated by krb5 to do something. Well, the script was actually run as root, and ...
2
votes
0answers
466 views

PAM debugging “check pass; user unknown”

I am attempting to get Prosody authenticating with its auth_pam module. It is configured to use the PAM service name xmpp. The pam.d/xmpp file is copied straight from the one configured for dovecot ...
4
votes
1answer
670 views

Escape hash mark (#) in /etc/environment

I am adding an env variable to /etc/environment but because the variable value contains # sign, string is striped. MYSQL_PWD="something#no" Now if I do env above code yields MYSQL_PWD=something. ...
1
vote
2answers
143 views

How to control authentication attempts in PAM?

I would like to configure the no. of times user will be prompted for password(authentication attempts) for login, before dropping the session. Does PAM support this case, if so can you help me out ...
9
votes
2answers
171 views

How to automatically enter sudo's grace period upon CLI login?

What I would like to do is be able to login and sudo commands immediately without entering a password again. It is very redundant to type my password twice in a row when I need to login and run a ...
2
votes
3answers
1k views

How to make RHEL look at access.conf for su -?

I use the file /etc/security/access.conf to dictate what users have access to the server: + : root : LOCAL + : user1 : ALL + : user2 : ALL + : user3 : ALL - : ALL : ALL This works fine for new SSH ...
1
vote
1answer
103 views

Pamtester automate password testing

We have a system image which uses a default password for root. This should be changed, though I have a feeling not all users do this. I know I can test login with pamtester: # pamtester system-auth ...
2
votes
0answers
188 views

Wrong PAM settings: successful login logged as failure

SERVER:/etc/pam.d # head -1 /etc/issue SUSE LINUX Enterprise Server 9.4 SERVER:/etc/pam.d # cat login #%PAM-1.0 auth requisite pam_unix2.so nullok #set_secrpc auth required ...
2
votes
1answer
259 views

pam: action on (unsuccessful) login

I know how to execute an action on login, by adding a line to /etc/profile. But that only gets executed, if the login was successful. I would like to have action executed even when login fails. For ...
3
votes
2answers
277 views

Change password through linux PAM without running application as root

An application I'm writing will have some password change functionality. However I'm wondering if it is possible to not run the account management part of it as root. Right now I'm running into the ...
1
vote
3answers
2k views

PAM login permission denied

I have an OpenSuSE 12.3 machine and can't login to the box either on tty or via ssh. As soon as the user logs in the session terminates and in the message "login [1234] permission denied" is printed. ...
4
votes
2answers
6k views

Avoid “Authentication token manipulation error” on password change

I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own: The /etc/pam.d/passwd configuration file is: #%PAM-1.0 auth include ...
2
votes
1answer
53 views

Is there a PAM Standard?

Related to a StackOverflow question I have. Since it's more or less really a SO question through and through, I won't go into the whole spiel. My platform question is this: Is there an industry ...
3
votes
1answer
54 views

How to lock users with PAM in Scientific Linux 5.5? [duplicate]

I need to lock the users that are trying to log in via SSHD after 5 unsuccessful login tries. I already googled for it, but I just can see it working: root@server:~# faillog -u testuser Login ...
1
vote
2answers
536 views

Prevent root password change in ldap - debian

After setting up ldap authentication with pam in debian, evertything works fine. Using the passwd command change the ldap password of the current user. The problem is my ldap has been set up with an ...
2
votes
1answer
14k views

How to lock users after 5 unsuccessful login tries?

How to lock users after 5 unsuccessful login tries? I gathered a few distributions/versions to how to do it, but I can't test it. RHEL4: by adding the: auth required ...
0
votes
5answers
3k views

SSH login attempts per minute per IP

How can i limit SSH login attempts per minute per IP ? I want to disable login attempts during 5 seconds after a failure. Is this possible ? I'm not talking about ban a user after parsing logs like ...
3
votes
0answers
103 views

Restrict usage of the same password during a time period

I need to configure a server with some requisites on the password changing: in addition to other requisites, I need to ensure that, on a password change, it is not repeated (last 5 passwords) and ...
1
vote
2answers
453 views

Show “last login” information when “su”

I'm trying to configure the PAM modules working with su command. I want to su shows the "last login" information, as ssh or login do. I find, on /etc/pam.d/login a PAM module called pam_lastlog that ...
0
votes
1answer
51 views

Let pam module use hostname -s

Our hostname command gives back the servername.domain. This is in conflict with our authentication mechanism with our Active Directory. Is it possible to let the pam module use hostname -s (the ...
3
votes
1answer
865 views

sudo: unable to initialize PAM: No such file or directory

While trying to build the NumPy Python math module with Intel's Math Kernel Library (MKL) on OSX 10.8.3, I was running into some problems with the Accelerate and vecLib frameworks overriding the MKL. ...
2
votes
0answers
213 views

Including pending update list in motd

How would you include the list and / or count of pending updates in the welcome banner? Eg. username: User password: ***** Hi 'User', welcome on 'localhost' There are 8 pending updates, you need to ...
1
vote
0answers
840 views

pam ldap authentication an AWS EC2 ami (Amazon's ami)

I have some custom built instances running in AWS EC2 that are configured with ldap authentication. I have now brought up one of the AWS-provided EC2 AMIs, and am trying to configure it to work with ...
0
votes
0answers
56 views

How can I add PAM functionality in netkit-rsh-0.17

I am using CentOS. In my project, that is working on a network, I need an rsh utility. I downloaded netkit-rsh-0.17 for that and until recently all worked fine. But now I found that this utility ...
5
votes
1answer
562 views

Default umask 077 not applied at session start

I cannot get the default umask for a session to be 0077. I have edited /etc/login.defs and set the value to 077 there: UMASK 077 Also I've made sure the following entry exists in ...
2
votes
1answer
247 views

Restrict two way SSH and Apache authentication to non-local networks

I am using Google's open-source PAM module for two-way authentication for SSH logins and certain Apache directives. It works great, however I would like to use this only when trying to log in from an ...
-1
votes
2answers
107 views

Why rsh not opens and reads PAM modules and limits.conf?

I am working on a project, that uses rsh utility for remote connection. But my project needs some extra features for that, so I add that features. Till now, all the things are going fine. But when I ...
1
vote
1answer
998 views

Rehashing /etc/shadow. Can I force NIS users to change password?

I'm currently migrating a CentOS environment to a Debian one. The users log in over the network using NIS. I was hoping to copy /etc/shadow from my old server to my new one so that we can offer ...
4
votes
3answers
1k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
0
votes
1answer
3k views

rsh shows “poll: protocol failure in circuit setup”, why?

In the starting rsh worked properly, but after making some changes it shows some error [changes are shown in the end of this question, see that], I am sharing the same. Command $ /usr/bin/rsh ...
16
votes
3answers
1k views

How to prevent shutdown when an SSH user is logged in?

I'm administrating a networked environment and I had an interesting situation arise yesterday. When a host is required to shutdown by a regular user, it refuses to do so if other users are logged in ...
1
vote
1answer
3k views

How to authenticate a user with PAM, that is not the user that started the application

I'm currently developing an authentication module for an application. The decision was made to do this by using PAM. I have made this work but it can only authenticate the user that started the ...
1
vote
2answers
324 views

At login, take picture of user at Login window(loginGUI promt window)

I have code to take a picture in a script. I don't understand how to run this script at the time of login. I would like to modify the login process so that: The user gets 3 login attempts. After 3 ...
1
vote
1answer
461 views

Display dialog from pam_exec environment at login?

I'm using pam_exec to do some root tasks. They take some time, and I'd like to tell the user to wait a moment. I'm doing the tasks there, and not later, because I need: Root permissions To rsync ...
1
vote
1answer
799 views

How do I write a login daemon?

There are many guides to the steps for correctly launching a daemon process, such as Stevens' chapter in Advanced Programming in the UNIX Environment. There is less agreement on what steps should be ...
11
votes
4answers
658 views

Groups differ from the local ones when logging in remotely

We store our users in LDAP, alongside some groups that have meaning across different systems (organizational roles including wheel). There are also groups local to workstations, e.g. audio or video ...
1
vote
1answer
43 views

Find out which program is asking for privilege escalation?

I have a finger print reader on my laptop, and I configured PAM with fprintd, sometimes when it lights up, I want to find out which program is asking for a privilege escalation. Any ideas?