Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

2
votes
2answers
55 views

Allow SSH access but restrict root's access to a given set of IPs

I want to allow SSH for all users as normal except that I want to restrict root's access based on a set of IP addresses. So, users peter, paul, lary can login from anywhere, but root may login only ...
0
votes
1answer
17 views

persisting multi-factor user data for custom pam authentication in CentOS 7

I am designing n-factor authentication for CentOS 7 using a custom PAM module. When the user tries to SSH, they will be texted a pin code, and be prompted to enter the pin. Where should I store the ...
3
votes
2answers
45 views

How to stop sudo PAM messages in auth.log for a specific user?

I am using Zabbix for monitoring my environment and zabbix_agentd executes as user zabbix one custom script every 60 seconds; it uses sudo to run this script as root. In /var/log/auth.log I see every ...
3
votes
1answer
2k views

Why does pam_mount ask for password?

I used the pam-auth-update tool in order to enable some pam configuration profiles: PAM configuration PAM profiles to enable: [*] encfs encrypted home directories [*] Unix ...
8
votes
1answer
104 views

How to add additional steps to login?

What I would like to achieve is an interactive program that runs either before or after asking the user for the password, but won't handle over the access to the computer unless it exited with ...
4
votes
1answer
145 views

Why libpam-systemd run interactively on apt upgrade, even when specified force-confdef/force-confold

I upgrade my packages using aptitude, specifying the apt options --force-confdef and --force-confold. This generally works, but the package libpam-systemd (204-5ubuntu20.8, on Ubuntu 14.04) still ...
0
votes
1answer
5k views

rsh shows “poll: protocol failure in circuit setup”, why?

In the starting rsh worked properly, but after making some changes it shows some error [changes are shown in the end of this question, see that], I am sharing the same. Command $ /usr/bin/rsh ...
3
votes
1answer
2k views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
1
vote
0answers
22 views

Can't setup mount of EncFS on user login

I've tried to setup EncFS to be mounted on user login as described in this guide excluding the Password Utility section, however it works with little success. The EncFS works properly ...
2
votes
1answer
46 views

How can I use different kerberos principals for sudo than for system-auth?

At my organization, we're required to use different kerberos principals when authenticating for sudo than for other types of auth, such as logging in. For instance, my regular (login) principal might ...
3
votes
2answers
672 views

Change password through linux PAM without running application as root

An application I'm writing will have some password change functionality. However I'm wondering if it is possible to not run the account management part of it as root. Right now I'm running into the ...
2
votes
1answer
33 views

Replacement for php5-auth-pam to authenticate website login against local users

I am working on a login for a PHP-based website where users should be successfully logged in if they enter a valid username and password for a local account on the system. Looking around, it seems ...
2
votes
1answer
192 views

dyanamically creating directories with pam_mkhomedir and mysql for vsftpd

I'm a Linux noob, so hopefully someone will be able to help me to get this up and running. I've installed vsftpd using the following instructions ...
52
votes
3answers
13k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
1
vote
0answers
33 views

ConsoleKit reports active/is-local only on the second+ login

Running KDE Frameworks 5, Plasma 5, using sddm as a display manager. ConsoleKit and PAM-linux are both installed. Upon login (using the sddm login screen), ck-list-sessions returns FALSE for both ...
2
votes
1answer
67 views

How do you get `pam_succeed_if.so` to recognize `service` user?

I have a Linux system with a user named service. I'm using the pam_succeed_if.so module to match this username. For example: auth required pam_succeed_if.so user = service But it won't ...
1
vote
2answers
204 views

Pamtester automate password testing

We have a system image which uses a default password for root. This should be changed, though I have a feeling not all users do this. I know I can test login with pamtester: # pamtester system-auth ...
0
votes
2answers
884 views

Why does PAM prevent root from using useradd?

I'm using Arch Linux on a single-user workstation with LXDE and lxde-session autologin to the regular user. I then "su" or "sudo" to root privileges, and try to run "useradd." useradd fails on my ...
4
votes
5answers
21k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
2
votes
1answer
61 views

Use multiple PAM login methods at once?

I'm using pam-fprintd as a login method. Currently it works perfectly for logging into the cinnamon screensaver and sudo. Unfortunately you have to fail the fingerprint login a certain number of times ...
1
vote
1answer
41 views

Why root is not constrained by pam

I have the following settings in file /etc/pam.d/common-password. password requisite pam_cracklib.so retry=3 lcredit=-1 ucredit=-1 dcredit=-1 password [success=1 ...
3
votes
0answers
77 views

What SELinux context shall the script have to be ran by pam_exec?

I just installed Fedora 22 on my VPS and tried to make trivial thing -- run my informer script on every ssh login via pam_exec. But I was confronted with unexpected difficulties: pam_exec failed with ...
1
vote
1answer
93 views

What is pam_unix2 / why doesn't it exist on some distributions?

Some documentations, blogs and forums and other examples on the web use pam_unix2 in /etc/pam.d/ configurations. An example taken from pam_winbind manpage: auth required pam_env.so auth ...
0
votes
1answer
95 views

Disable PAM login but keeping landscape-sysinfo y motd

Running Ubuntu Server, I have no need for PAM login, and thus disabled this service in the sshd_config file. However, oddly, there is some login info that is only displayed if you enable PAM logins ...
0
votes
1answer
97 views

PAM timestamp - how to inspecting the /var/run/sudo/<user> file?

The centos documentation stated that: ... In the PAM timestamp scheme, the graphical administrative application prompts the user for the root password when it is launched. When the user has ...
0
votes
0answers
165 views

lightdm: (pam_mount.c:477): warning: could not obtain password interactively either

Ubuntu 14.04 does not mount folders, libpam-pkcs11 with ldap mapper $ sudo tail -f /var/log/auth.log May 7 12:58:06 my-company-ub14 lightdm: pam_unix(lightdm-greeter:session): session closed for ...
0
votes
1answer
148 views

what does pam_env.so really do?

Having the following line: auth required pam_env.so Documentation happily says "This module is required—it must run successfully for authentication to proceed." ...
1
vote
1answer
30 views

common-account line read order

My authentication is centralized in a LDAP. I've one login system who is working without any ldap so it's present in my /etc/passwd file. This my common-account file in pam.d directory. account ...
2
votes
1answer
52 views

Externally authenticate user within PAM session/PAM session within PAM session

Is there a way of properly authenticating a user from within a custom PAM session? I am currently writing my own PAM authentication module which allows the user to login via an external token. This ...
3
votes
1answer
308 views

How to make a PAM substack “requisite”?

For the auth section of my PAM configuration, login and mdm etc. call common-auth. I have common-auth calling the following as a substack (as auth substack krb5ldap-cache-auth): auth optional ...
1
vote
1answer
78 views

How to get the authentication status from the last PAM module run

If I have the following PAM stack: auth required default_pam.so auth requisite my_custom_pam.so .... How do you obtain the authentication status from the last/previous PAM module run for use in ...
1
vote
4answers
4k views

PAM login permission denied

I have an OpenSuSE 12.3 machine and can't login to the box either on tty or via ssh. As soon as the user logs in the session terminates and in the message "login [1234] permission denied" is printed. ...
1
vote
1answer
480 views

CUPS not working correctly after Debian Wheezy -> Jessie upgrade because of a faulty libpam

I just upgraded a Debian Wheezy to Jessie, by changing the /etc/apt/sources.lst. If important: I pinned systemd to stay with sysvinit, and after the upgrade I removed the pin. If I now do apt-get ...
6
votes
1answer
318 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
2
votes
0answers
184 views

Force OpenSSH / pam / pam_ldapd to do pam_ldapd(sshd:auth) with public-key authentication

I have working pam_ldap authentication using libpam_ldapd. I'm using slapo-nssov and want to use loginStatus attribute which is added to users ldap entry after opening pam session and deleted when its ...
1
vote
1answer
120 views

Password policy on existing accounts not updated after making changes to login.defs

I have two old accounts that were previously set to defaults (no password expiration). I updated login.defs and /etc/pam.d/system-auth for stricter password policy. New accounts added to the system ...
7
votes
3answers
9k views

Allow user1 to “su - user2” without password

I need to allow user martin to switch to user martin-test without password su - martin-test I think this can be configured in /etc/pam.d/su. There are already some lines in that file which can be ...
6
votes
1answer
4k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
2
votes
2answers
115 views

check “newness” / “is-read” of /var/spool/mail/$USER like pam_mail for custom motd script

How can I check with bash or python (preferred) if there are some unread mails in /var/spool/mail/$USER like pam_mail does? I'd like to use this for my own custom motd script, motd.dynamic
1
vote
0answers
81 views

Using pam_listfile.so with radius authentication

I have set up radius authentication on my machine (as a client - untested yet). The pam radius conf file has the shared secret etc. The radius authentication can potentially authenticate every single ...
3
votes
0answers
189 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
1
vote
0answers
50 views

PAM and fprintd

Occasionally I get an error on the login screen of Ubuntu 14.04 under unity. The problem occurs after waking up from suspend after closing the lid. Essentially instead of asking me first for ...
7
votes
3answers
185 views

Restrict the times a user is allowed to log in

We have several Backbox 3.13 systems built on Ubuntu 12.04. One of my teenagers does not understand the concept of this thing called "sleep" and tends to get up to play on the computer. I'm trying to ...
0
votes
2answers
150 views

Setting up a script on an AMI box to create directories - vsftpd, pam, mysql

I'd like to first say I'm a noob when it comes to linux, so please excuse my confusion. I'm trying to setup vsftpd on a amazon ami 64 bit box, free tier micro. Following these instructions, ...
1
vote
2answers
423 views

Unable to determine your tty name on Debian Wheezy on ARM

while trying to create my Debian Wheezy image for a FriendlyARM mini210s ARM single board computer, I am bumping into this issue. I have opened a terminal via serial sudo screen /dev/cu.usbserial ...
0
votes
1answer
121 views

useradd PAM authentication failed

I needed to customize useradd command so i downloaded shadow-utils source package. Using configure-make i was able to compile the source , binary was generated (configure prefix) at custom location ...
1
vote
0answers
303 views

removing `nullok` from system-auth prevents any root password

[ this is a follow-up on my post on ServerFault : http://serverfault.com/questions/661136/root-accepts-any-password-how-to-change-to-a-real-password ] On an old system the root account accepts any ...
1
vote
0answers
89 views

Configure pam_mount to prompt for password

I have configured my Ubuntu system to mount a cifs share using pam_mount and a credentials file (the credentials to access the cifs share are different to those I use on my Linux machine). I'd like to ...
1
vote
1answer
466 views

VSFTP local user works, but PAM users Permission Denied

I am attempting to configure vsftp to use PAM to authenticate virtual users on my Arch server. It seems so straight forward, I must be missing something simple. Configuration local user virtualftp ...
2
votes
0answers
204 views

Debian ignores PAM env variables (while Arch doesn't)

I have a weird issue with my Debian Sid system. I want to set a global environment variable in /etc/environment, which is supposed to be read by the pam_env module. Unfortunately, after having relogin ...