Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

5
votes
1answer
112 views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
3
votes
1answer
1k views

Why does pam_mount ask for password?

I used the pam-auth-update tool in order to enable some pam configuration profiles: PAM configuration PAM profiles to enable: [*] encfs encrypted home directories [*] Unix ...
2
votes
1answer
194 views

Problem with log in after change locale, maybe relate to PAM

System information: Debian Wheezy CPU: intel core i7 3770 I initially only had en_US.UTF-8 as the default language. This morning, I changed the /etc/local.gen file and un-comment the zh_CN.UTF-8 and ...
1
vote
1answer
258 views

How to allow pam radius module in centos for user's password as well as one time password

I have a problem with the PAM Radius module. Actually, I have it installed already under CentOS. I've inserted the line: auth required /lib/security/pam_radius_auth.so in /etc/pam.d/sshd and ...
1
vote
1answer
424 views

mount luks volume through pam with gdm

I'm on debian testing. I encrypted my /home with dm-crypt (luks). Following various tutorials I setup pam_mount to open it at login time. However when I try to login using gdm, it fails. The login ...
1
vote
1answer
102 views

Pass login messages to tmux

When I login, I connect to a tmux session (either by exec'ing tmux if there is no current session, or exec'ing tmux attach if there is). However this means I don't see the login messages (/etc/issue, ...
1
vote
1answer
424 views

VSFTP local user works, but PAM users Permission Denied

I am attempting to configure vsftp to use PAM to authenticate virtual users on my Arch server. It seems so straight forward, I must be missing something simple. Configuration local user virtualftp ...
3
votes
0answers
84 views

Why libpam-systemd run interactively on apt upgrade, even when specified force-confdef/force-confold

I upgrade my packages using aptitude, specifying the apt options --force-confdef and --force-confold. This generally works, but the package libpam-systemd (204-5ubuntu20.8, on Ubuntu 14.04) still ...
3
votes
0answers
207 views

How to make a PAM substack “requisite”?

For the auth section of my PAM configuration, login and mdm etc. call common-auth. I have common-auth calling the following as a substack (as auth substack krb5ldap-cache-auth): auth optional ...
3
votes
0answers
109 views

Restrict usage of the same password during a time period

I need to configure a server with some requisites on the password changing: in addition to other requisites, I need to ensure that, on a password change, it is not repeated (last 5 passwords) and ...
2
votes
0answers
37 views

Force OpenSSH / pam / pam_ldapd to do pam_ldapd(sshd:auth) with public-key authentication

I have working pam_ldap authentication using libpam_ldapd. I'm using slapo-nssov and want to use loginStatus attribute which is added to users ldap entry after opening pam session and deleted when its ...
2
votes
0answers
112 views

Debian ignores PAM env variables (while Arch doesn't)

I have a weird issue with my Debian Sid system. I want to set a global environment variable in /etc/environment, which is supposed to be read by the pam_env module. Unfortunately, after having relogin ...
2
votes
0answers
72 views

Is there way to print the entered password in PAM?

We are using CentOS 6.5. We have a perl script for our automation testing. One of the script login to the user as non-root user and test "su -" command. This test case passes most of the times but ...
2
votes
0answers
38 views

Integrate my own PAM module with the passwd command

I know that to integrate my module with the passwd command all I need to do is add the following line to the /etc/pam.d/passwd file: password sufficient mymodule.so My question is I want my module ...
2
votes
0answers
28 views

Externally authenticate user within PAM session/PAM session within PAM session

Is there a way of properly authenticating a user from within a custom PAM session? I am currently writing my own PAM authentication module which allows the user to login via an external token. This ...
2
votes
0answers
93 views

ACL for a binddn user for PAM?

I've installed 389-ds and created a user and a couple groups. I then configured authconfig on a client to use the LDAP instance to authenticate the user. I've logged in successfully as that user. All ...
2
votes
0answers
37 views

Is it possible to login to a Linux machine with AD credentials without the machine beeing member of the AD?

I'm asking because as far as I know this is not possible with Windows machines since it's mandatory that a Windows machine is known to the AD in order to login with AD credentials. Is it possible to ...
2
votes
0answers
132 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
2
votes
0answers
198 views

SSH login from external authentication

Here is what I try to accomplish: I have a server with a git repository. I use ISPConfig as control panel for our websites and I want to integrate the ISPConfig API for email authentication as second ...
2
votes
0answers
1k views

Changing Samba/LDAP password with passwd

We've installed CentOS Directory Server (389 DS) and have Samba using it as a backend. This works great except that when enabling password syncing in the smb.conf it is only synced one way. I could ...
2
votes
0answers
615 views

PAM debugging “check pass; user unknown”

I am attempting to get Prosody authenticating with its auth_pam module. It is configured to use the PAM service name xmpp. The pam.d/xmpp file is copied straight from the one configured for dovecot ...
2
votes
0answers
235 views

Wrong PAM settings: successful login logged as failure

SERVER:/etc/pam.d # head -1 /etc/issue SUSE LINUX Enterprise Server 9.4 SERVER:/etc/pam.d # cat login #%PAM-1.0 auth requisite pam_unix2.so nullok #set_secrpc auth required ...
2
votes
0answers
306 views

Including pending update list in motd

How would you include the list and / or count of pending updates in the welcome banner? Eg. username: User password: ***** Hi 'User', welcome on 'localhost' There are 8 pending updates, you need to ...
1
vote
0answers
27 views

Using pam_listfile.so with radius authentication

I have set up radius authentication on my machine (as a client - untested yet). The pam radius conf file has the shared secret etc. The radius authentication can potentially authenticate every single ...
1
vote
0answers
9 views

common-account line read order

My authentication is centralized in a LDAP. I've one login system who is working without any ldap so it's present in my /etc/passwd file. This my common-account file in pam.d directory. account ...
1
vote
0answers
27 views

PAM and fprintd

Occasionally I get an error on the login screen of Ubuntu 14.04 under unity. The problem occurs after waking up from suspend after closing the lid. Essentially instead of asking me first for ...
1
vote
0answers
94 views

removing `nullok` from system-auth prevents any root password

[ this is a follow-up on my post on ServerFault : http://serverfault.com/questions/661136/root-accepts-any-password-how-to-change-to-a-real-password ] On an old system the root account accepts any ...
1
vote
0answers
51 views

Configure pam_mount to prompt for password

I have configured my Ubuntu system to mount a cifs share using pam_mount and a credentials file (the credentials to access the cifs share are different to those I use on my Linux machine). I'd like to ...
1
vote
0answers
113 views

With pam_script, how do I pass PAM_AUTHTOK and PAM_USER in all cases?

I need to run a script whenever a user enters a password; the script should be able to reject that password, but shouldn't be sufficient. I placed the script in /etc/pamunlockscript/pam_script_auth ...
1
vote
0answers
166 views

gksu -S ask for password only once even when set to three times in sudo configuration

I have a problem with gksu command. It always ask for password only once even when I set Defaults passwd_tries=3 in /etc/sudoers file. Command: $ gksu -S --debug ls No ask_pass set, using default! ...
1
vote
0answers
21 views

Is there a Linux capabilities(7) to allow a process to execute pam_authenticate?

I am writing a process that needs to periodically authenticate users (i.e. call pam_authenticate()). For security purposes I would prefer not to run this process with root privilege. I can use ...
1
vote
0answers
16 views

skip pam_fprintd.so with closed lid

I really love fprintd and I really love having my laptop closed while in docking station. But I hate both together. This is my /etc/pam.d/system-auth: auth sufficient pam_fprintd.so ...
1
vote
0answers
1k views

What does “Cannot make/remove an entry for the specified session” mean?

Instead of logging me in, PAM greets me with the message "Cannot make/remove an entry for the specified session" after I enter the password. What entry is it talking about (and what session)? The ...
1
vote
0answers
260 views

pam_tacplus.so and sshd: skip user validation?

I'm trying to implement tacacs authentication on a freebsd box as a client. The box is actually a network appliance that SHOULD have this config built into its cli/ui but doesn't. Since it's built ...
1
vote
0answers
436 views

Unmounting shares on logout with pam_mount

I am using pam_mount to mount cifs and sshfs shares for users when they log in to an Arch Linux workstation. I have the a volume line in /etc/security/pam_mount.conf.xml: <volume user="strongbad" ...
1
vote
0answers
54 views

How to get the authentication status from the last PAM module run

If I have the following PAM stack: auth required default_pam.so auth requisite my_custom_pam.so .... How do you obtain the authentication status from the last/previous PAM module run for use in ...
1
vote
0answers
39 views

libpam load pam modules at every connection

I want to reduce ssh connection time, by debugging sshd have found that libpam is loading all pam modules specified in /etc/pam.d/sshd file at every connection. How to configure/modifiy libpam such ...
1
vote
0answers
890 views

PAM's passwd retry prompt fail

I am trying to use PAM to stop password reuse. Adding 'remember=24' to pam_unix stores the old passwords hashed with MD5 which I find unnerving. I was recommended 'pam_pwhistory' instead. Here is the ...
1
vote
0answers
196 views

Ulimits and pam modules

Can you explain me the relation of ulimit setting on a proccess and line session required pam_limits.so in pam module. In wich modules i really require this line? I have this line in pam.d/su ...
1
vote
0answers
68 views

How to obtain current user environment in pam_script?

I'm running pam_script after pam_krb5 with a session open script. In my script, I need to use the ticket cache generated by krb5 to do something. Well, the script was actually run as root, and ...
1
vote
0answers
1k views

pam ldap authentication an AWS EC2 ami (Amazon's ami)

I have some custom built instances running in AWS EC2 that are configured with ldap authentication. I have now brought up one of the AWS-provided EC2 AMIs, and am trying to configure it to work with ...
0
votes
0answers
81 views

How to log failed username and plaintext passwords in dovecot server using PAM authentication?

I am configuring web mail honeypot in centOS 6.6 using SquirrelMail, postfix and Dovecot. I need to log all the entered user name and plain text passwords for web mail login. Modifications done to ...
0
votes
0answers
89 views

dyanamically creating directories with pam_mkhomedir and mysql for vsftpd

I'm a Linux noob, so hopefully someone will be able to help me to get this up and running. I've installed vsftpd using the following instructions ...
0
votes
0answers
366 views

While trying to ssh, pam_ldap always sends the password “INCORRECT” causing bind to fail

I installed ldap-auth-client nscd ldap-utils on lubuntu 14.04 running on a banana pi. I can successfully bind as the user using ldapwhoami, but I cannot log in via ssh: Auth.log: Oct 21 02:12:05 ...
0
votes
0answers
72 views

How to fix Module is Unknown error without logging in (PiLFS)

I've built a PiLFS distribution and was running it fine about a month ago. Now, when I turn on the Raspberry pi and attempt to login as root with the proper password, it gives the error Module is ...
0
votes
0answers
89 views

pam.d password hardening: nullok

In most all pam.d documentation or linux distributions that I saw, the recommend "secure" configuration for password is the following: password required pam_unix.so sha512 shadow nullok ...
0
votes
0answers
168 views

What processes on CentOS6/RHEL regulates user login but not password itself?

I was doing some maintenance via root account over ssh after several months of inattention. I shutdown, after startup I can't log in to root account at tty or via ssh. Fortunately, sudo works to ...
0
votes
0answers
164 views

Root able to login but non root users are denied - PAM

One of our servers is not letting non-root users login, but root can login without any issues. The following are the messages from /var/log/secure: Jun 24 18:08:43 jonnserver sshd[14470]: debug1: ...
0
votes
0answers
125 views

sshd without pam slower

I am running OpenSSH_6.5 with UsePAM yes in my board. I have observed that with UsePAM no in /etc/ssh/sshd_config, sshd runs slower than previous case. How is this possible? My understanding is ...
0
votes
0answers
64 views

How can I add PAM functionality in netkit-rsh-0.17

I am using CentOS. In my project, that is working on a network, I need an rsh utility. I downloaded netkit-rsh-0.17 for that and until recently all worked fine. But now I found that this utility ...