Tag Info

New answers tagged

0

I downloaded the sudo SRPM from here, compiled and ran it from inside gdb to have a closer understanding. This tip on debugging setuid root programs was invaluable. The thing is that sudo creates/updates the timestamp file (resides inside /var/db/sudo/<user>) only when the user is authorized to run the command and has been authenticated as well. ...


3

In short, it's a security thing. You have said, that mary can run certain commands without the supplying of a password. That fails, then the "default action" is taken. Go and ask the password, then log the failed attempt. With out getting horridly technical, it's the separation between authentication and authorization. is this mary trying to run a ...


1

Where should I store the user's cell phone number? And how should it be retrieved by the PAM module? This is entirely your design decision. Some PAM modules store information in local files in /etc, like pam_access or the google authenticator module. Other modules may contact a remote server, like the radius authentication module. A scalable solution ...


0

As we discussed in the comments, this problem was due to a keyboard layout settings during installation. As for your secondary question, to have the graphical (and console) interface in Greek and not English, you simply need to reconfigure your "locales" sudo dpkg-reconfigure locales.


3

You seem pretty close with your PAM conf line: session [success=1 default=ignore] pam_succeed_if.so service in sudo quiet uid = 0 Looking at the manual page for pam_succeed_if, I think you want to test that the requesting user (ruser) is zabbix. So I suggest: session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0 ruser = zabbix That will ...


0

Seems this was already asked and answered here: http://stackoverflow.com/questions/14277116/suppress-log-entry-for-single-sudo-commands, copied below with the user changed to "zabbix": You can disable the logging on a user basis using the Defaults: directive > Defaults:zabbix !syslog or using a Cmnd_Alias to disable it per command(s) > ...


2

The standard *nix authentication stack uses PAM. You'll want to look into building a module for PAM: http://www.linux-pam.org/Linux-PAM-html/ Typically multi-factor auth vendors will provide one. For example, here's a how-to guide for implementing google authenticator as a second factor for SSH login: ...


7

No stdout/stdin there at the PAM stage. You need to call pam_conv(3) via pam_get_item(3) to perform i/o. Good example at ben.akrin.com including the relevant C source example. pam_conv(3) pam_get_item(3)



Top 50 recent answers are included