Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

11
votes
4answers
605 views

Groups differ from the local ones when logging in remotely

We store our users in LDAP, alongside some groups that have meaning across different systems (organizational roles including wheel). There are also groups local to workstations, e.g. audio or video ...
1
vote
3answers
1k views

PAM login permission denied

I have an OpenSuSE 12.3 machine and can't login to the box either on tty or via ssh. As soon as the user logs in the session terminates and in the message "login [1234] permission denied" is printed. ...
1
vote
0answers
25 views

What does “Cannot make/remove an entry for the specified session” mean?

Instead of logging me in, PAM greets me with the message "Cannot make/remove an entry for the specified session" after I enter the password. What entry is it talking about (and what session)? The ...
1
vote
0answers
11 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
5
votes
1answer
71 views

Restrict the times a user is allowed to log in

We have several Backbox 3.13 systems built on Ubuntu 12.04. One of my teenagers does not understand the concept of this thing called "sleep" and tends to get up to play on the computer. I'm trying to ...
0
votes
0answers
22 views

pam.d password hardening: nullok

In most all pam.d documentation or linux distributions that I saw, the recommend "secure" configuration for password is the following: password required pam_unix.so sha512 shadow nullok ...
1
vote
0answers
9 views

pam_tacplus.so and sshd: skip user validation?

I'm trying to implement tacacs authentication on a freebsd box as a client. The box is actually a network appliance that SHOULD have this config built into its cli/ui but doesn't. Since it's built ...
0
votes
1answer
3k views

rsh shows “poll: protocol failure in circuit setup”, why?

In the starting rsh worked properly, but after making some changes it shows some error [changes are shown in the end of this question, see that], I am sharing the same. Command $ /usr/bin/rsh ...
0
votes
1answer
19 views

Howto Judge if a System authenticate with password only or through PAM

If my computer has the pam package installed and has the directory /etc/pam.d/sshd, does it mean for sure when I ssh to my computer, I am authenticated through pam modules? The /etc/pam.d/sshd looks ...
3
votes
2answers
51 views

allow only specific users to login via sshd, but refuse connect to non-listed users

I'm running a CentOS server (7.0) and I'd like to login via sshd as a user, not root. So I set PermitRootLogin no in the config file and su - after login. I've received lots of hacking activities and ...
5
votes
1answer
488 views

Default umask 077 not applied at session start

I cannot get the default umask for a session to be 0077. I have edited /etc/login.defs and set the value to 077 there: UMASK 077 Also I've made sure the following entry exists in ...
6
votes
1answer
94 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at ...
2
votes
1answer
1k views

Centos 7 and VNC access right?

UPDATE: I posted on the Tiger VNC forum and someone suggested that this may be a result of PolicyKit (now called PolKit, I believe). Does anyone know how to change this policy? These are all ...
3
votes
1answer
399 views

Why does pam_mount ask for password?

I used the pam-auth-update tool in order to enable some pam configuration profiles: PAM configuration PAM profiles to enable: [*] encfs encrypted home directories [*] Unix ...
0
votes
0answers
49 views

What processes on CentOS6/RHEL regulates user login but not password itself?

I was doing some maintenance via root account over ssh after several months of inattention. I shutdown, after startup I can't log in to root account at tty or via ssh. Fortunately, sudo works to ...
5
votes
1answer
129 views

2 Factor Authentication in SSH using public key and PAM

I'm trying to setup 2 Factor Authentication. I want the user to login successfully if: The public private/public key matches (authentication method: publickey) or the password is correct My pam ...
1
vote
1answer
82 views

mount luks volume through pam with gdm

I'm on debian testing. I encrypted my /home with dm-crypt (luks). Following various tutorials I setup pam_mount to open it at login time. However when I try to login using gdm, it fails. The login ...
0
votes
0answers
50 views

Root able to login but non root users are denied - PAM

One of our servers is not letting non-root users login, but root can login without any issues. The following are the messages from /var/log/secure: Jun 24 18:08:43 jonnserver sshd[14470]: debug1: ...
3
votes
0answers
49 views

How to make a PAM substack “requisite”?

For the auth section of my PAM configuration, login and mdm etc. call common-auth. I have common-auth calling the following as a substack (as auth substack krb5ldap-cache-auth): auth optional ...
1
vote
1answer
166 views

Is PAM a user authentication method?

If someone asks that PAM is a user authentication method? Then can we say yes? Or no?
5
votes
3answers
48 views

different passwords depending on plugged-in devices

I would like to have different passwords for my account(s): When (e.g.) a certain USB stick is plugged in then an easy password is to be used. The idea is: If I leave my computer then I take the stick ...
44
votes
2answers
11k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
6
votes
4answers
2k views

SSH authentication: either SSH keys or one time password

I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
1
vote
1answer
142 views

Home Directories and pam.d using LDAP

Background: I'm not too familiar with the ins and outs of pam and LDAP authentication on a configuration side. I've used systems that use pam but I've only worked on applications, not systems ...
0
votes
1answer
114 views

Why does PAM prevent root from using useradd?

I'm using Arch Linux on a single-user workstation with LXDE and lxde-session autologin to the regular user. I then "su" or "sudo" to root privileges, and try to run "useradd." useradd fails on my ...
1
vote
0answers
123 views

Unmounting shares on logout with pam_mount

I am using pam_mount to mount cifs and sshfs shares for users when they log in to an Arch Linux workstation. I have the a volume line in /etc/security/pam_mount.conf.xml: <volume user="strongbad" ...
3
votes
2answers
225 views

Change password through linux PAM without running application as root

An application I'm writing will have some password change functionality. However I'm wondering if it is possible to not run the account management part of it as root. Right now I'm running into the ...
1
vote
2answers
71 views

Reset password for regular user who is locked out

I'm a complete noob in Linux and I'm stuck in a situation where I'm logged in an Linux box from putty but on of my colleague, who was trying to login on same machine from his machine blocked my user ...
1
vote
1answer
66 views

pam-auth-update does not display prompt screen or log any failure

~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 12.04.4 LTS Release: 12.04 Codename: precise ~# dpkg -l \*pam\* | grep ii ii libpam-krb5 ...
2
votes
1answer
71 views

How does `shutdown -k` disable logins?

This is the -k option's documentation in man shutdown (at least on Ubuntu): -k Only send out the warning messages and disable logins, do not actually bring the system down. I initially ...
1
vote
0answers
37 views

How to get the authentication status from the last PAM module run

If I have the following PAM stack: auth required default_pam.so auth requisite my_custom_pam.so .... How do you obtain the authentication status from the last/previous PAM module run for use in ...
0
votes
0answers
86 views

sshd without pam slower

I am running OpenSSH_6.5 with UsePAM yes in my board. I have observed that with UsePAM no in /etc/ssh/sshd_config, sshd runs slower than previous case. How is this possible? My understanding is ...
1
vote
0answers
29 views

libpam load pam modules at every connection

I want to reduce ssh connection time, by debugging sshd have found that libpam is loading all pam modules specified in /etc/pam.d/sshd file at every connection. How to configure/modifiy libpam such ...
2
votes
4answers
13k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
1
vote
0answers
376 views

PAM's passwd retry prompt fail

I am trying to use PAM to stop password reuse. Adding 'remember=24' to pam_unix stores the old passwords hashed with MD5 which I find unnerving. I was recommended 'pam_pwhistory' instead. Here is the ...
2
votes
0answers
642 views

Changing Samba/LDAP password with passwd

We've installed CentOS Directory Server (389 DS) and have Samba using it as a backend. This works great except that when enabling password syncing in the smb.conf it is only synced one way. I could ...
1
vote
1answer
48 views

Pass login messages to tmux

When I login, I connect to a tmux session (either by exec'ing tmux if there is no current session, or exec'ing tmux attach if there is). However this means I don't see the login messages (/etc/issue, ...
1
vote
1answer
97 views

How can I retrieve screen unlock times in Gnome on later Red Hat variants?

The last command only retrieves the login times. I'm interested in the times that the screen was unlocked. Any indirect means of getting this are also welcome.
1
vote
0answers
62 views

Ulimits and pam modules

Can you explain me the relation of ulimit setting on a proccess and line session required pam_limits.so in pam module. In wich modules i really require this line? I have this line in pam.d/su ...
4
votes
2answers
273 views

Allow user1 to “su - user2” without password

I need to allow user martin to switch to user martin-test without password su - martin-test I think this can be configured in /etc/pam.d/su. There are already some lines in that file which can be ...
2
votes
1answer
202 views

PAM Authentication and SSH access based on user info stored in sqlite3

I have an application that runs on a Linux box. The application stores all its user information (like - username, password, ssh-allowed, etc) in an sqlite3 database as follows. username ...
7
votes
4answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password ...
2
votes
1answer
115 views

Problem with log in after change locale, maybe relate to PAM

System information: Debian Wheezy CPU: intel core i7 3770 I initially only had en_US.UTF-8 as the default language. This morning, I changed the /etc/local.gen file and un-comment the zh_CN.UTF-8 and ...
2
votes
0answers
174 views

SSH login from external authentication

Here is what I try to accomplish: I have a server with a git repository. I use ISPConfig as control panel for our websites and I want to integrate the ISPConfig API for email authentication as second ...
2
votes
1answer
641 views

tinyproxy with user authentification

Does anybody have a solution that'll make tinyproxy work with user authentification like pam_auth at the squid proxy? I don't want to create a SSH-Tunnel and allow only localhost.
5
votes
2answers
120 views

PAM - required and sufficient control flag

I'm studying PAM, and I'm a bit clueless about the meaning of some combination of control flags. From the Red Hat documentation we have: *required failure of such a PAM will ultimately lead to the ...
4
votes
4answers
177 views

Howto find and move a text line inside a file?

I need to change a text line position inside a file; from one line position to another one, underneath a defined text. For example, I have the following text block (on /etc/pam.d/system-auth file) ...
2
votes
1answer
586 views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
1
vote
0answers
235 views

VSFTP local user works, but PAM users Permission Denied

I am attempting to configure vsftp to use PAM to authenticate virtual users on my Arch server. It seems so straight forward, I must be missing something simple. Configuration local user virtualftp ...
2
votes
0answers
357 views

PAM debugging “check pass; user unknown”

I am attempting to get Prosody authenticating with its auth_pam module. It is configured to use the PAM service name xmpp. The pam.d/xmpp file is copied straight from the one configured for dovecot ...