Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

learn more… | top users | synonyms

46
votes
2answers
11k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
16
votes
2answers
4k views

How does one change the delay that occurs after entering an incorrect password?

After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?
16
votes
3answers
1k views

How to prevent shutdown when an SSH user is logged in?

I'm administrating a networked environment and I had an interesting situation arise yesterday. When a host is required to shutdown by a regular user, it refuses to do so if other users are logged in ...
11
votes
4answers
685 views

Groups differ from the local ones when logging in remotely

We store our users in LDAP, alongside some groups that have meaning across different systems (organizational roles including wheel). There are also groups local to workstations, e.g. audio or video ...
9
votes
2answers
530 views

How do I force a user to change a password at the first time login using ssh?

I'm trying to force a newly created user to change a password at the first time login using ssh. For security reasons I want to give him a secure password until he logs in for the first time. I did ...
9
votes
2answers
174 views

How to automatically enter sudo's grace period upon CLI login?

What I would like to do is be able to login and sudo commands immediately without entering a password again. It is very redundant to type my password twice in a row when I need to login and run a ...
8
votes
2answers
14k views

Effect of entries in /etc/securetty

By default on RHEL 5.5 I have [deuberger@saleen trunk]$ sudo cat /etc/securetty console vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 vc/7 vc/8 vc/9 vc/10 vc/11 tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 ...
7
votes
5answers
20k views

Program for decrypt linux shadow file

Is there any program or script available for decrypt Linux shadow file ?
7
votes
1answer
704 views

What steps does the system go through when handling an SSH connection?

What steps does the system go through when handling an SSH connection? We try to log in via ssh sshd starts pam and pam module to authenticate us Depending on pam configuration, we need to provide ...
7
votes
4answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password ...
6
votes
4answers
2k views

Is it possible to change password database file(/etc/passwd) in linux?

Is it possible to change password database file(/etc/passwd) to some other file. How does this authentication mechanism work internally ? Does it depend on pam ?
6
votes
4answers
2k views

SSH authentication: either SSH keys or one time password

I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
6
votes
3answers
57 views

different passwords depending on plugged-in devices

I would like to have different passwords for my account(s): When (e.g.) a certain USB stick is plugged in then an easy password is to be used. The idea is: If I leave my computer then I take the stick ...
6
votes
1answer
123 views

First sudo always slow

The first sudo I enter on my Ubuntu 14.04 server is always slow. The password prompt displays immediately, but after I press enter it takes about 10-15 seconds until the output is printed. All sudo ...
6
votes
1answer
112 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at ...
6
votes
1answer
598 views

Default umask 077 not applied at session start

I cannot get the default umask for a session to be 0077. I have edited /etc/login.defs and set the value to 077 there: UMASK 077 Also I've made sure the following entry exists in ...
6
votes
1answer
956 views

How to make a system lock when the USB pendrive with authentication key is removed?

Say, I have USB drive authentication up and working. So far, so hoopy. But now I want to take the next step, which is locking the machine when I eject the medium. I know there is udev I can script, ...
6
votes
1answer
470 views

Backing up and restoring a system user account

How would I go about completely backing up a user account and restoring it on a new system? The Home directory is just 'copy-and-paste'. But then what about things like the account password; and its ...
5
votes
1answer
3k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
5
votes
1answer
753 views

Escape hash mark (#) in /etc/environment

I am adding an env variable to /etc/environment but because the variable value contains # sign, string is striped. MYSQL_PWD="something#no" Now if I do env above code yields MYSQL_PWD=something. ...
5
votes
1answer
696 views

Custom PAM modules and security considerations

I am writing my own PAM module that will be part of an application that I am developing, but I'm not sure exactly where to put it. My module basically does network-level authentication (with other ...
5
votes
2answers
162 views

PAM - required and sufficient control flag

I'm studying PAM, and I'm a bit clueless about the meaning of some combination of control flags. From the Red Hat documentation we have: *required failure of such a PAM will ultimately lead to the ...
5
votes
1answer
3k views

Preventing `passwd` for asking for the local password

I have setup the sever to only use LDAP for authentication by using authconfig-tui. Everything works well but, when I run passwd, I get two prompts for a password: [beamin@rhel6-test-server1 ~]$ ...
5
votes
1answer
435 views

2 Factor Authentication in SSH using public key and PAM

I'm trying to setup 2 Factor Authentication. I want the user to login successfully if: The public private/public key matches (authentication method: publickey) or the password is correct My pam ...
5
votes
1answer
951 views

Allow su without password for users in a particular Active Directory group when using pam_winbind

I know on my Gentoo system, the /etc/pam.d/su file comes with the following commented out: auth sufficient pam_wheel.so use_uid trust Which allows a user to su to root without a password as ...
5
votes
2answers
110 views

Restrict the times a user is allowed to log in

We have several Backbox 3.13 systems built on Ubuntu 12.04. One of my teenagers does not understand the concept of this thing called "sleep" and tends to get up to play on the computer. I'm trying to ...
4
votes
4answers
236 views

Howto find and move a text line inside a file?

I need to change a text line position inside a file; from one line position to another one, underneath a defined text. For example, I have the following text block (on /etc/pam.d/system-auth file) ...
4
votes
6answers
986 views

Identity Management with ActiveDirectory

What is the best, or most reliable, way to manage my Unix/Linux user accounts with ActiveDirectory? Or, is this even feasible?
4
votes
2answers
7k views

Avoid “Authentication token manipulation error” on password change

I'm implementing a security policy that will force the users to introduce stricter passwords when they change their own: The /etc/pam.d/passwd configuration file is: #%PAM-1.0 auth include ...
4
votes
1answer
2k views

How to have pam_exec run the script as the current user?

I need to run a script, when the session is opened, as the user who's opening the session. I have added in /etc/pam.d/common-session : session optional pam_exec.so ...
4
votes
2answers
2k views

What are the reasons Slackware still refuses to include PAM?

I know that Pat Volkerding didn't include PAM back in the day when it was considered by some to be messy or inconsistent, although that doesn't really seem to be the case today with PAM being ...
4
votes
3answers
1k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
4
votes
1answer
261 views

Confused about PAM configuration stanza and the roles of the control-flag parameters

I just begun studying for the RHCE. While on the topic of PAM configuration, I was a little perplexed with this stanza from /etc/pam.d/system-auth: auth required pam_env.so auth ...
4
votes
2answers
4k views

Can I create a local only guest account?

Is it possible to create a "guest" account in Linux? by "guest" account I mean an account that does not require a password to log in graphically. I want this account for when people come over and are ...
3
votes
2answers
2k views

Allow user1 to “su - user2” without password

I need to allow user martin to switch to user martin-test without password su - martin-test I think this can be configured in /etc/pam.d/su. There are already some lines in that file which can be ...
3
votes
2answers
3k views

Ubuntu password policy

I want to set the system-wide password policy on an Ubuntu 12.04 LTS server. Googling around, a lot of people point to this (very old) document: ...
3
votes
2answers
299 views

allow only specific users to login via sshd, but refuse connect to non-listed users

I'm running a CentOS server (7.0) and I'd like to login via sshd as a user, not root. So I set PermitRootLogin no in the config file and su - after login. I've received lots of hacking activities and ...
3
votes
1answer
289 views

pam: action on (unsuccessful) login

I know how to execute an action on login, by adding a line to /etc/profile. But that only gets executed, if the login was successful. I would like to have action executed even when login fails. For ...
3
votes
1answer
820 views

Setting ulimits without PAM

How to do that? Without PAM on my GNU/Linux OS the number of open files is 1024 by default and cannot be raised above 4096 (via ulimit -n NNNN command) despiting what is written in ...
3
votes
1answer
638 views

Is /sbin/sulogin safe?

Lately my machine's authentication system broke twice: once because I messed up with PAM/LDAP and the other one because I messed up with /etc/passwd or /etc/shadow. In order to recover things I had ...
3
votes
1answer
160 views

Run Script at fail login attempt?

Lately, I've been trying to create a Bash script to capture a webcam photo when a fail attempt to login is registered. First of all, I found 2 guides related to this (links at the end), they explained ...
3
votes
1answer
55 views

How to lock users with PAM in Scientific Linux 5.5? [duplicate]

I need to lock the users that are trying to log in via SSHD after 5 unsuccessful login tries. I already googled for it, but I just can see it working: root@server:~# faillog -u testuser Login ...
3
votes
1answer
331 views

Configure SCP access for login without a local account

Can I set up accounts that can do SCP that are NOT local users (i.e. users with an entry in /etc/passwd)? I've tried googling for SCP "without PAM authentication" or alternative authenication for sshd ...
3
votes
1answer
933 views

sudo: unable to initialize PAM: No such file or directory

While trying to build the NumPy Python math module with Intel's Math Kernel Library (MKL) on OSX 10.8.3, I was running into some problems with the Accelerate and vecLib frameworks overriding the MKL. ...
3
votes
1answer
2k views

Automatically mount encrypted home folder on login

I'm looking into encrypting my home folder with Truecrypt, and mounting it after I've logged in, which should be pretty straightforward. However, it occurred to me that it should be theoretically ...
3
votes
0answers
125 views

How to make a PAM substack “requisite”?

For the auth section of my PAM configuration, login and mdm etc. call common-auth. I have common-auth calling the following as a substack (as auth substack krb5ldap-cache-auth): auth optional ...
3
votes
1answer
788 views

Why does pam_mount ask for password?

I used the pam-auth-update tool in order to enable some pam configuration profiles: PAM configuration PAM profiles to enable: [*] encfs encrypted home directories [*] Unix ...
3
votes
2answers
299 views

Change password through linux PAM without running application as root

An application I'm writing will have some password change functionality. However I'm wondering if it is possible to not run the account management part of it as root. Right now I'm running into the ...
3
votes
0answers
104 views

Restrict usage of the same password during a time period

I need to configure a server with some requisites on the password changing: in addition to other requisites, I need to ensure that, on a password change, it is not repeated (last 5 passwords) and ...
2
votes
2answers
1k views

SFTP with Mysql user pass instead of PAM

Is there a way for people to log onto a debian server via sftp using just mysql database table as authentaction. IE not adding a user to the system? I know it can be done over ftp and TLS but i ...