Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

3
votes
1answer
2k views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
1
vote
0answers
14 views

Can't setup mount of EncFS on user login

I've tried to setup EncFS to be mounted on user login as described in this guide excluding the Password Utility section, however it works with little success. The EncFS works properly ...
2
votes
1answer
19 views

How can I use different kerberos principals for sudo than for system-auth?

At my organization, we're required to use different kerberos principals when authenticating for sudo than for other types of auth, such as logging in. For instance, my regular (login) principal might ...
3
votes
2answers
600 views

Change password through linux PAM without running application as root

An application I'm writing will have some password change functionality. However I'm wondering if it is possible to not run the account management part of it as root. Right now I'm running into the ...
2
votes
1answer
15 views

Replacement for php5-auth-pam to authenticate website login against local users

I am working on a login for a PHP-based website where users should be successfully logged in if they enter a valid username and password for a local account on the system. Looking around, it seems ...
2
votes
1answer
165 views

dyanamically creating directories with pam_mkhomedir and mysql for vsftpd

I'm a Linux noob, so hopefully someone will be able to help me to get this up and running. I've installed vsftpd using the following instructions ...
0
votes
1answer
5k views

rsh shows “poll: protocol failure in circuit setup”, why?

In the starting rsh worked properly, but after making some changes it shows some error [changes are shown in the end of this question, see that], I am sharing the same. Command $ /usr/bin/rsh ...
3
votes
1answer
2k views

Why does pam_mount ask for password?

I used the pam-auth-update tool in order to enable some pam configuration profiles: PAM configuration PAM profiles to enable: [*] encfs encrypted home directories [*] Unix ...
52
votes
3answers
13k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
1
vote
0answers
25 views

ConsoleKit reports active/is-local only on the second+ login

Running KDE Frameworks 5, Plasma 5, using sddm as a display manager. ConsoleKit and PAM-linux are both installed. Upon login (using the sddm login screen), ck-list-sessions returns FALSE for both ...
2
votes
1answer
36 views

How do you get `pam_succeed_if.so` to recognize `service` user?

I have a Linux system with a user named service. I'm using the pam_succeed_if.so module to match this username. For example: auth required pam_succeed_if.so user = service But it won't ...
1
vote
2answers
189 views

Pamtester automate password testing

We have a system image which uses a default password for root. This should be changed, though I have a feeling not all users do this. I know I can test login with pamtester: # pamtester system-auth ...
0
votes
2answers
811 views

Why does PAM prevent root from using useradd?

I'm using Arch Linux on a single-user workstation with LXDE and lxde-session autologin to the regular user. I then "su" or "sudo" to root privileges, and try to run "useradd." useradd fails on my ...
4
votes
5answers
20k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
2
votes
1answer
42 views

Use multiple PAM login methods at once?

I'm using pam-fprintd as a login method. Currently it works perfectly for logging into the cinnamon screensaver and sudo. Unfortunately you have to fail the fingerprint login a certain number of times ...
1
vote
1answer
33 views

Why root is not constrained by pam

I have the following settings in file /etc/pam.d/common-password. password requisite pam_cracklib.so retry=3 lcredit=-1 ucredit=-1 dcredit=-1 password [success=1 ...
3
votes
0answers
62 views

What SELinux context shall the script have to be ran by pam_exec?

I just installed Fedora 22 on my VPS and tried to make trivial thing -- run my informer script on every ssh login via pam_exec. But I was confronted with unexpected difficulties: pam_exec failed with ...
1
vote
1answer
46 views

What is pam_unix2 / why doesn't it exist on some distributions?

Some documentations, blogs and forums and other examples on the web use pam_unix2 in /etc/pam.d/ configurations. An example taken from pam_winbind manpage: auth required pam_env.so auth ...
0
votes
1answer
61 views

Disable PAM login but keeping landscape-sysinfo y motd

Running Ubuntu Server, I have no need for PAM login, and thus disabled this service in the sshd_config file. However, oddly, there is some login info that is only displayed if you enable PAM logins ...
0
votes
1answer
72 views

PAM timestamp - how to inspecting the /var/run/sudo/<user> file?

The centos documentation stated that: ... In the PAM timestamp scheme, the graphical administrative application prompts the user for the root password when it is launched. When the user has ...
0
votes
0answers
107 views

lightdm: (pam_mount.c:477): warning: could not obtain password interactively either

Ubuntu 14.04 does not mount folders, libpam-pkcs11 with ldap mapper $ sudo tail -f /var/log/auth.log May 7 12:58:06 my-company-ub14 lightdm: pam_unix(lightdm-greeter:session): session closed for ...
0
votes
1answer
84 views

what does pam_env.so really do?

Having the following line: auth required pam_env.so Documentation happily says "This module is required—it must run successfully for authentication to proceed." ...
1
vote
1answer
22 views

common-account line read order

My authentication is centralized in a LDAP. I've one login system who is working without any ldap so it's present in my /etc/passwd file. This my common-account file in pam.d directory. account ...
2
votes
1answer
44 views

Externally authenticate user within PAM session/PAM session within PAM session

Is there a way of properly authenticating a user from within a custom PAM session? I am currently writing my own PAM authentication module which allows the user to login via an external token. This ...
3
votes
1answer
285 views

How to make a PAM substack “requisite”?

For the auth section of my PAM configuration, login and mdm etc. call common-auth. I have common-auth calling the following as a substack (as auth substack krb5ldap-cache-auth): auth optional ...
1
vote
1answer
73 views

How to get the authentication status from the last PAM module run

If I have the following PAM stack: auth required default_pam.so auth requisite my_custom_pam.so .... How do you obtain the authentication status from the last/previous PAM module run for use in ...
1
vote
4answers
4k views

PAM login permission denied

I have an OpenSuSE 12.3 machine and can't login to the box either on tty or via ssh. As soon as the user logs in the session terminates and in the message "login [1234] permission denied" is printed. ...
1
vote
1answer
374 views

CUPS not working correctly after Debian Wheezy -> Jessie upgrade because of a faulty libpam

I just upgraded a Debian Wheezy to Jessie, by changing the /etc/apt/sources.lst. If important: I pinned systemd to stay with sysvinit, and after the upgrade I removed the pin. If I now do apt-get ...
6
votes
1answer
254 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
2
votes
0answers
152 views

Force OpenSSH / pam / pam_ldapd to do pam_ldapd(sshd:auth) with public-key authentication

I have working pam_ldap authentication using libpam_ldapd. I'm using slapo-nssov and want to use loginStatus attribute which is added to users ldap entry after opening pam session and deleted when its ...
1
vote
1answer
91 views

Password policy on existing accounts not updated after making changes to login.defs

I have two old accounts that were previously set to defaults (no password expiration). I updated login.defs and /etc/pam.d/system-auth for stricter password policy. New accounts added to the system ...
7
votes
3answers
8k views

Allow user1 to “su - user2” without password

I need to allow user martin to switch to user martin-test without password su - martin-test I think this can be configured in /etc/pam.d/su. There are already some lines in that file which can be ...
6
votes
1answer
4k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
2
votes
2answers
86 views

check “newness” / “is-read” of /var/spool/mail/$USER like pam_mail for custom motd script

How can I check with bash or python (preferred) if there are some unread mails in /var/spool/mail/$USER like pam_mail does? I'd like to use this for my own custom motd script, motd.dynamic
1
vote
0answers
68 views

Using pam_listfile.so with radius authentication

I have set up radius authentication on my machine (as a client - untested yet). The pam radius conf file has the shared secret etc. The radius authentication can potentially authenticate every single ...
3
votes
0answers
177 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
1
vote
0answers
49 views

PAM and fprintd

Occasionally I get an error on the login screen of Ubuntu 14.04 under unity. The problem occurs after waking up from suspend after closing the lid. Essentially instead of asking me first for ...
7
votes
3answers
181 views

Restrict the times a user is allowed to log in

We have several Backbox 3.13 systems built on Ubuntu 12.04. One of my teenagers does not understand the concept of this thing called "sleep" and tends to get up to play on the computer. I'm trying to ...
0
votes
2answers
132 views

Setting up a script on an AMI box to create directories - vsftpd, pam, mysql

I'd like to first say I'm a noob when it comes to linux, so please excuse my confusion. I'm trying to setup vsftpd on a amazon ami 64 bit box, free tier micro. Following these instructions, ...
1
vote
2answers
366 views

Unable to determine your tty name on Debian Wheezy on ARM

while trying to create my Debian Wheezy image for a FriendlyARM mini210s ARM single board computer, I am bumping into this issue. I have opened a terminal via serial sudo screen /dev/cu.usbserial ...
0
votes
1answer
116 views

useradd PAM authentication failed

I needed to customize useradd command so i downloaded shadow-utils source package. Using configure-make i was able to compile the source , binary was generated (configure prefix) at custom location ...
1
vote
0answers
251 views

removing `nullok` from system-auth prevents any root password

[ this is a follow-up on my post on ServerFault : http://serverfault.com/questions/661136/root-accepts-any-password-how-to-change-to-a-real-password ] On an old system the root account accepts any ...
1
vote
0answers
77 views

Configure pam_mount to prompt for password

I have configured my Ubuntu system to mount a cifs share using pam_mount and a credentials file (the credentials to access the cifs share are different to those I use on my Linux machine). I'd like to ...
1
vote
1answer
457 views

VSFTP local user works, but PAM users Permission Denied

I am attempting to configure vsftp to use PAM to authenticate virtual users on my Arch server. It seems so straight forward, I must be missing something simple. Configuration local user virtualftp ...
2
votes
0answers
181 views

Debian ignores PAM env variables (while Arch doesn't)

I have a weird issue with my Debian Sid system. I want to set a global environment variable in /etc/environment, which is supposed to be read by the pam_env module. Unfortunately, after having relogin ...
2
votes
2answers
264 views

Warn about password expiration without forcing change

It's pretty simple. I would like to figure out what combination of changes in /etc/login.defs and/or /etc/pam.d/system-auth-ac I would need to perform to allow the following behavior: I want a ...
0
votes
1answer
279 views

Password fail delay is too long - Linux Mint 17

As per the title, the delay after a failed password is very long. In /etc/pam.d/login, FAIL_DELAY is configured as auth optional pam_faildelay.so delay=3000000 however, actual delay is ...
6
votes
1answer
718 views

Default umask 077 not applied at session start

I cannot get the default umask for a session to be 0077. I have edited /etc/login.defs and set the value to 077 there: UMASK 077 Also I've made sure the following entry exists in ...
0
votes
1answer
130 views

Can't get OpenLDAP and Pam LDAP working at all

Yesterday, I set up an OpenLDAP server and tried to configure it to be useful for SSH. Followed these two guides from DigitalOcean: ...
12
votes
2answers
3k views

How do I force a user to change a password at the first time login using ssh?

I'm trying to force a newly created user to change a password at the first time login using ssh. For security reasons I want to give him a secure password until he logs in for the first time. I did ...