Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

2
votes
1answer
59 views

Is there a PAM Standard?

Related to a StackOverflow question I have. Since it's more or less really a SO question through and through, I won't go into the whole spiel. My platform question is this: Is there an industry ...
3
votes
1answer
63 views

How to lock users with PAM in Scientific Linux 5.5? [duplicate]

I need to lock the users that are trying to log in via SSHD after 5 unsuccessful login tries. I already googled for it, but I just can see it working: root@server:~# faillog -u testuser Login ...
1
vote
2answers
652 views

Prevent root password change in ldap - debian

After setting up ldap authentication with pam in debian, evertything works fine. Using the passwd command change the ldap password of the current user. The problem is my ldap has been set up with an ...
3
votes
1answer
24k views

How to lock users after 5 unsuccessful login tries?

How to lock users after 5 unsuccessful login tries? I gathered a few distributions/versions to how to do it, but I can't test it. RHEL4: by adding the: auth required ...
0
votes
5answers
5k views

SSH login attempts per minute per IP

How can i limit SSH login attempts per minute per IP ? I want to disable login attempts during 5 seconds after a failure. Is this possible ? I'm not talking about ban a user after parsing logs like ...
3
votes
0answers
111 views

Restrict usage of the same password during a time period

I need to configure a server with some requisites on the password changing: in addition to other requisites, I need to ensure that, on a password change, it is not repeated (last 5 passwords) and ...
1
vote
2answers
648 views

Show “last login” information when “su”

I'm trying to configure the PAM modules working with su command. I want to su shows the "last login" information, as ssh or login do. I find, on /etc/pam.d/login a PAM module called pam_lastlog that ...
0
votes
1answer
57 views

Let pam module use hostname -s

Our hostname command gives back the servername.domain. This is in conflict with our authentication mechanism with our Active Directory. Is it possible to let the pam module use hostname -s (the ...
3
votes
1answer
1k views

sudo: unable to initialize PAM: No such file or directory

While trying to build the NumPy Python math module with Intel's Math Kernel Library (MKL) on OSX 10.8.3, I was running into some problems with the Accelerate and vecLib frameworks overriding the MKL. ...
2
votes
0answers
323 views

Including pending update list in motd

How would you include the list and / or count of pending updates in the welcome banner? Eg. username: User password: ***** Hi 'User', welcome on 'localhost' There are 8 pending updates, you need to ...
1
vote
0answers
1k views

pam ldap authentication an AWS EC2 ami (Amazon's ami)

I have some custom built instances running in AWS EC2 that are configured with ldap authentication. I have now brought up one of the AWS-provided EC2 AMIs, and am trying to configure it to work with ...
0
votes
0answers
64 views

How can I add PAM functionality in netkit-rsh-0.17

I am using CentOS. In my project, that is working on a network, I need an rsh utility. I downloaded netkit-rsh-0.17 for that and until recently all worked fine. But now I found that this utility ...
6
votes
1answer
689 views

Default umask 077 not applied at session start

I cannot get the default umask for a session to be 0077. I have edited /etc/login.defs and set the value to 077 there: UMASK 077 Also I've made sure the following entry exists in ...
2
votes
1answer
283 views

Restrict two way SSH and Apache authentication to non-local networks

I am using Google's open-source PAM module for two-way authentication for SSH logins and certain Apache directives. It works great, however I would like to use this only when trying to log in from an ...
-1
votes
2answers
120 views

Why rsh not opens and reads PAM modules and limits.conf?

I am working on a project, that uses rsh utility for remote connection. But my project needs some extra features for that, so I add that features. Till now, all the things are going fine. But when I ...
1
vote
1answer
1k views

Rehashing /etc/shadow. Can I force NIS users to change password?

I'm currently migrating a CentOS environment to a Debian one. The users log in over the network using NIS. I was hoping to copy /etc/shadow from my old server to my new one so that we can offer ...
4
votes
3answers
1k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
0
votes
1answer
4k views

rsh shows “poll: protocol failure in circuit setup”, why?

In the starting rsh worked properly, but after making some changes it shows some error [changes are shown in the end of this question, see that], I am sharing the same. Command $ /usr/bin/rsh ...
16
votes
3answers
1k views

How to prevent shutdown when an SSH user is logged in?

I'm administrating a networked environment and I had an interesting situation arise yesterday. When a host is required to shutdown by a regular user, it refuses to do so if other users are logged in ...
1
vote
1answer
3k views

How to authenticate a user with PAM, that is not the user that started the application

I'm currently developing an authentication module for an application. The decision was made to do this by using PAM. I have made this work but it can only authenticate the user that started the ...
1
vote
2answers
374 views

At login, take picture of user at Login window(loginGUI promt window)

I have code to take a picture in a script. I don't understand how to run this script at the time of login. I would like to modify the login process so that: The user gets 3 login attempts. After 3 ...
1
vote
1answer
549 views

Display dialog from pam_exec environment at login?

I'm using pam_exec to do some root tasks. They take some time, and I'd like to tell the user to wait a moment. I'm doing the tasks there, and not later, because I need: Root permissions To rsync ...
1
vote
1answer
904 views

How do I write a login daemon?

There are many guides to the steps for correctly launching a daemon process, such as Stevens' chapter in Advanced Programming in the UNIX Environment. There is less agreement on what steps should be ...
11
votes
4answers
765 views

Groups differ from the local ones when logging in remotely

We store our users in LDAP, alongside some groups that have meaning across different systems (organizational roles including wheel). There are also groups local to workstations, e.g. audio or video ...
1
vote
1answer
45 views

Find out which program is asking for privilege escalation?

I have a finger print reader on my laptop, and I configured PAM with fprintd, sometimes when it lights up, I want to find out which program is asking for a privilege escalation. Any ideas?
1
vote
1answer
436 views

Unable to log in to Ubuntu server 10.04 after trying to join Windows domain

I was trying to join our Ubuntu 10.04 server to the Windows domain and I ended up editing the pam.d configuration files. My aim was to have domain users log into the Ubuntu server with their domain ...
2
votes
2answers
221 views

Allow 1 hour only in day with PAM

How to allow user to access system only 1 hour in day using PAM? For example I wish to give access to a user only for 1hr on a workstation in 24hrs. First the 24hr time period needs to be defined, as ...
3
votes
1answer
918 views

Setting ulimits without PAM

How to do that? Without PAM on my GNU/Linux OS the number of open files is 1024 by default and cannot be raised above 4096 (via ulimit -n NNNN command) despiting what is written in ...
4
votes
1answer
2k views

How to have pam_exec run the script as the current user?

I need to run a script, when the session is opened, as the user who's opening the session. I have added in /etc/pam.d/common-session : session optional pam_exec.so ...
0
votes
2answers
6k views

Avoid asking password if `su -m user command` is used under `user`?

If I run the script containing su -m user service userservice start under root user, I do not need to enter the password. But when I run it under user user, it asks passwords all the time. That really ...
3
votes
1answer
357 views

Configure SCP access for login without a local account

Can I set up accounts that can do SCP that are NOT local users (i.e. users with an entry in /etc/passwd)? I've tried googling for SCP "without PAM authentication" or alternative authenication for sshd ...
3
votes
2answers
3k views

Ubuntu password policy

I want to set the system-wide password policy on an Ubuntu 12.04 LTS server. Googling around, a lot of people point to this (very old) document: ...
0
votes
2answers
3k views

Winbind PAM.D AD Groups, CentOS 5, Allow Only?

I'm attempting to create a configuration, where users in specified AD groups can log in. I'm having trouble stopping every AD user from logging in. I've been doing this though /etc/pam.d/sshd/ but ...
6
votes
4answers
2k views

Is it possible to change password database file(/etc/passwd) in linux?

Is it possible to change password database file(/etc/passwd) to some other file. How does this authentication mechanism work internally ? Does it depend on pam ?
8
votes
2answers
16k views

Effect of entries in /etc/securetty

By default on RHEL 5.5 I have [deuberger@saleen trunk]$ sudo cat /etc/securetty console vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 vc/7 vc/8 vc/9 vc/10 vc/11 tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 ...
16
votes
2answers
4k views

How does one change the delay that occurs after entering an incorrect password?

After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?
2
votes
1answer
339 views

Locked out by pamd. Help!

I recently changed some pamd settings because I wanted my ssh keys unlocked at login. I followed the instructions at this wiki page. Ignoring the warning, I have become locked out (cannot log in ...
2
votes
1answer
574 views

Pamd not mounting ecryptfs disk anymore since upgrade

I have encrypted my home disk a long time ago and I configured pam to mount it automatically on login. However after update to version 1.1.5-3 pam is not mounting the disk anymore. Here are the logs ...
3
votes
5answers
19k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
2
votes
1answer
1k views

Problem with pam_mount and sshfs

I'm trying to configure automounting of users home directories using pam_mount and sshfs (users are LDAP users on remote machine). I configured pam_mount: <?xml version="1.0" encoding="utf-8" ...
4
votes
2answers
1k views

What are the reasons Slackware still refuses to include PAM?

I know that Pat Volkerding didn't include PAM back in the day when it was considered by some to be messy or inconsistent, although that doesn't really seem to be the case today with PAM being ...
3
votes
1answer
776 views

Is /sbin/sulogin safe?

Lately my machine's authentication system broke twice: once because I messed up with PAM/LDAP and the other one because I messed up with /etc/passwd or /etc/shadow. In order to recover things I had ...
6
votes
1answer
1k views

How to make a system lock when the USB pendrive with authentication key is removed?

Say, I have USB drive authentication up and working. So far, so hoopy. But now I want to take the next step, which is locking the machine when I eject the medium. I know there is udev I can script, ...
1
vote
1answer
383 views

Can't su root after editing PAM confiugration on Rackspace Linux box

I've just hosed a system. Working on pam-ldap on an Ubuntu box, I've run pam-auth-update and told it to override local modifications (which had previously allowed for sudo su, but I was having issues ...
1
vote
1answer
1k views

python-pam not working… How to dig for the error?

I have a django application where users should be able to login according to the system's shadow database. I found this login backend which uses python-pam, as far as I can tell. While installing the ...
6
votes
4answers
3k views

SSH authentication: either SSH keys or one time password

I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
5
votes
1answer
3k views

Preventing `passwd` for asking for the local password

I have setup the sever to only use LDAP for authentication by using authconfig-tui. Everything works well but, when I run passwd, I get two prompts for a password: [beamin@rhel6-test-server1 ~]$ ...
4
votes
1answer
269 views

Confused about PAM configuration stanza and the roles of the control-flag parameters

I just begun studying for the RHCE. While on the topic of PAM configuration, I was a little perplexed with this stanza from /etc/pam.d/system-auth: auth required pam_env.so auth ...
6
votes
1answer
528 views

Backing up and restoring a system user account

How would I go about completely backing up a user account and restoring it on a new system? The Home directory is just 'copy-and-paste'. But then what about things like the account password; and its ...
2
votes
1answer
197 views

Why can I still log in via SSH (PAM Auth) while `shutdown -k` is active?

Pretty straight-forward. Does SSH ignore the nologin file created by shutdown -k TIME? Using PAM Auth to sync password database to users; if that makes a difference.