Hot answers tagged

64

This is a security thing, it's not actually taking long to realize it. 2 vulnerabilities this solves: this throttles login attempts, meaning someone can't pound the system as fast as it can go trying to crack it (1M attempts a sec? idk). If it did it as soon as it verified your credentials were incorrect, you could use the amount of time it took for it to ...


32

This is intentional, to try and limit brute forcing. You can usually modify it by looking for the FAIL_DELAY configuration entry in /etc/login.defs and changing its value (mine is 3 seconds by default), although the comment in that file makes it sound like PAM will enforce at least a 2 second delay no matter what


25

Passwords on a linux system are not encrypted, they are hashed which is a huge difference. It is not possible to reverse a hash function by definition. For further information see the Hash Wikipedia entry. Which hash function is used, depends on your system configuration. MD5 and blowfish are common examples for used hash functions. So the "real" password ...


17

change the age of password to 0 day syntax chage -d 0 {user-name} In this case chage -d0 foo This works for me over ssh also


14

I assume you are using Linux and pam. The delay is probably caused by pam_faildelay.so. Check your pam configuration in /etc/pam.d using pam_faildelay, e.g: # Enforce a minimal delay in case of failure (in microseconds). # (Replaces the `FAIL_DELAY' setting from login.defs) # Note that other modules may require another minimal delay. (for example, # to ...


12

/etc/securetty is consulted by pam_securetty module to decide from which virtual terminals (ttyS) root is allowed to login from. In the past, /etc/securetty was consulted by programs like login directly, but now PAM handles that. So changes to /etc/securetty will affect anything using PAM with a configuration file that uses pam_securetty.so. So, only the ...


11

Add the following lines right below the pam_rootok.so line in your /etc/pam.d/su: auth [success=ignore default=1] pam_succeed_if.so user = martin-test auth sufficient pam_succeed_if.so use_uid user = martin The first line makes sure the target user is martin-test. If it is, the next line will take control and succeed authorization if the ...


10

Under default behavior, you will still be able to log in using your ssh key, but the system administrator is free to change this behavior using pam or other methods. OpenSSH doesn't care about the expiration date on your password if it's not using password authentication, but pam can be set up to check password expiration even after sshd has authenticated ...


9

Whew. I solved the problem. It amounts to a config but within /etc/pam.d/vsftpd Because ssh sessions succeeded while ftp sessions failed, I went to /etc/pam.d/vsftpd, removed everything that was there and instead placed the contents of ./sshd to match the rules precisely. All worked! By method of elimination, I found that the offending line was: ...


9

If you don't want to change groups or use sudo, use a pam module called pam_exec to execute external scripts in a pam stage. Add a line in your /etc/pam.d/su after the pam_rootok.so line: auth sufficient pam_exec.so quiet /path/to/script /path/to/script has the permissions 755 (rwxr-xr-x) and the following content: #!/bin/bash if [ "$PAM_TYPE" == ...


9

No. PAM is a framework for authentication using different pam modules. The benefit to this is that application developers do not have to write the authentication logic themselves; e.g. it provides standards: from man 7 pam: Linux-PAM is a system of libraries that handle the authentication tasks of applications (services) on the system. PAM does provide ...


8

You need to pass the nodelay parameter to the auth pam_unix.so. Depending on how your'e authenticating, where you need to set the parameter varies. However most linux distrubtions have something like /etc/pam.d/system-auth which is included by all the different files. So for example in /etc/pam.d/system-auth you might have a line that looks like this: ...


7

As far as I know, PAM doesn't determine the user's shell, this is left to the application. PAM's session modules perform generic actions and checks that must be done for on every login using that particular service. If the application then wants to start a shell, it is free to do so, and will typically look up the shell in the user database. Assuming your ...


7

You're right: /etc/passwd and /etc/shadow are consulted by pam_unix.so, which are part of PAM. At least on modern Linuxes. You could change this by patching pam_unix.so. If the manpage is to be believed, you can't change the location of the system databases. And you really don't want to. /etc/passwd isn't just used for authentication, it's also used for ...


7

You can use pam_exec to invoke an external command. Beware that pam_exec runs in an environment that is under the control of the user who calls the login service, so don't invoke it from su, only from services with a predictable environment such as sshd or login. sudo has no option to update a user's time stamp, only to remove it. So you'll have to update ...


7

No stdout/stdin there at the PAM stage. You need to call pam_conv(3) via pam_get_item(3) to perform i/o. Good example at ben.akrin.com including the relevant C source example. pam_conv(3) pam_get_item(3)


6

Question 1 This can be done with the module hashlimit. iptables -A INPUT -p tcp --dport 22 -m hashlimit \ --hashlimit-mode srcip --hashlimit-above 3/minute -j DROP Question 2 Netfilter does not see login failures only connections. You need a tool (like Fail2ban) which is active on both levels. You could create a chain with blocked IPs and run a script ...


6

You might want to take a look at fail2ban. It can be configured to lock an account after a set number of failed attempts, and then unlock after a set period of time. http://www.fail2ban.org/wiki/index.php/Downloads If you're really serious about using pam_tally, you probably want to use pam_tally2 instead. Should be installed with any PAM package that's ...


6

This doesn't appear to be possible with /etc/environment. It's meant as a common location for variables that's shell independent. Given this it doesn't look like it supports strings with hash marks (#) in them and there doesn't appear to be a way to escape them. I found this SF Q&A titled: How does one properly escape a leading “#” character in linux ...


6

You can do it using the Tie::File module which ties a file's lines to an array variable: perl -MTie::File -e ' tie @lines,"Tie::File","your_file_here"; $last_line = pop @lines; splice @lines,1,0,$last_line ' The tied variable (@lines) becomes magical in the sense that whatever array operations you carry out on it affect the lines ...


5

When you call into Linux-PAM for some authentication procedure, there is always one and only one stack that is run. The stack definition is looked up in these places; the first successful attempt determines which file is read: the file in /etc/pam.d named after the application "service name" (e.g., sshd or gdm), or the file /etc/pam.d/other if no ...


5

My two cent suggestion: you could use PAM to do this. E.g. Use some pam module as pam-mysql to store some of your users in mysql and pam_require to avoid that mysql-stored users can access other than sftp service. Start looking here: Modules/Applications available or in progress...


5

PAM is not a daemon, but just a library. As a normal user has no access to authentication data (like /etc/shadow), programs running under a normal user cannot authenticate. There is one small exception: The user can authenticate himself, because in this case the SETGID /sbin/unix_chkpwd helper program is automatically called, which has access to ...


5

You can do this with pam_exec module and some PAM trickery. PAM configuration is usually very different across distributions so you will have to understand your configuration and try to tweak it. For Debian (tested with 7.1) edit /etc/pam.d/common-auth (comments left out for clarity) before auth [success=1 default=ignore] pam_unix.so nullok_secure ...


5

PAM proceeds through the items on the stack in sequence. It only keeps the memory of what state it's in (success or denied, with success meaning success so far), not of how it reached that state. If an item marked sufficient succeeds, the PAM library stops processing that stack. This happens whether there were previous required items or not. At this point, ...


5

LDAP is a directory service (a type of database) along with a protocol that describes what information is stored, how to search it, etc. All kinds of things can be stored there, but in this case it'd be Unix user and group info. Very loosely, an alternative to /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. Or to NIS. NSS is glibc's name service ...


5

You seem pretty close with your PAM conf line: session [success=1 default=ignore] pam_succeed_if.so service in sudo quiet uid = 0 Looking at the manual page for pam_succeed_if, I think you want to test that the requesting user (ruser) is zabbix. So I suggest: session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0 ruser = zabbix That will ...


5

Once they have the hard disk drive they hardly need your password. They simply mount all partitions according to (your) /etc/fstab. The next step is sudo su - "your account id" (if your id is 501, just sudo su - 501). Short on using encrypted disk with a good password and all, there is little if any you can do to make your data safe. This "little" include: ...


4

What you're looking for is the pam_pwdfile module. On Debian/Ubuntu the package is libpam-pwdfile (not sure about RedHat derived distros). The README included with the package explains how to use it.


4

You need to change the first line password [success=1 default=ignore] pam_unix.so obscure sha512 But don't use md5 since the new one is using sha512. If you want to set a minimum password length (8) use the line below password [success=2 default=ignore] pam_unix.so obscure sha512 min=8



Only top voted, non community-wiki answers of a minimum length are eligible