Tag Info

Hot answers tagged

56

This is a security thing, it's not actually taking long to realize it. 2 vulnerabilities this solves: this throttles login attempts, meaning someone can't pound the system as fast as it can go trying to crack it (1M attempts a sec? idk). If it did it as soon as it verified your credentials were incorrect, you could use the amount of time it took for it to ...


28

This is intentional, to try and limit brute forcing. You can usually modify it by looking for the FAIL_DELAY configuration entry in /etc/login.defs and changing its value (mine is 3 seconds by default), although the comment in that file makes it sound like PAM will enforce at least a 2 second delay no matter what


22

Passwords on a linux system are not encrypted, they are hashed which is a huge difference. It is not possible to reverse a hash function by definition. For further information see the Hash Wikipedia entry. Which hash function is used, depends on your system configuration. MD5 and blowfish are common examples for used hash functions. So the "real" password ...


15

change the age of password to 0 day syntax chage -d 0 {user-name} In this case chage -d0 foo This works for me over ssh also


13

I assume you are using Linux and pam. The delay is probably caused by pam_faildelay.so. Check your pam configuration in /etc/pam.d using pam_faildelay, e.g: # Enforce a minimal delay in case of failure (in microseconds). # (Replaces the `FAIL_DELAY' setting from login.defs) # Note that other modules may require another minimal delay. (for example, # to ...


9

Under default behavior, you will still be able to log in using your ssh key, but the system administrator is free to change this behavior using pam or other methods. OpenSSH doesn't care about the expiration date on your password if it's not using password authentication, but pam can be set up to check password expiration even after sshd has authenticated ...


8

If you don't want to change groups or use sudo, use a pam module called pam_exec to execute external scripts in a pam stage. Add a line in your /etc/pam.d/su after the pam_rootok.so line: auth sufficient pam_exec.so quiet /path/to/script /path/to/script has the permissions 755 (rwxr-xr-x) and the following content: #!/bin/bash if [ "$PAM_TYPE" == ...


8

No. PAM is a framework for authentication using different pam modules. The benefit to this is that application developers do not have to write the authentication logic themselves; e.g. it provides standards: from man 7 pam: Linux-PAM is a system of libraries that handle the authentication tasks of applications (services) on the system. PAM does provide ...


7

/etc/securetty is consulted by pam_securetty module to decide from which virtual terminals (ttyS) root is allowed to login from. In the past, /etc/securetty was consulted by programs like login directly, but now PAM handles that. So changes to /etc/securetty will affect anything using PAM with a configuration file that uses pam_securetty.so. So, only the ...


7

You're right: /etc/passwd and /etc/shadow are consulted by pam_unix.so, which are part of PAM. At least on modern Linuxes. You could change this by patching pam_unix.so. If the manpage is to be believed, you can't change the location of the system databases. And you really don't want to. /etc/passwd isn't just used for authentication, it's also used for ...


7

You can use pam_exec to invoke an external command. Beware that pam_exec runs in an environment that is under the control of the user who calls the login service, so don't invoke it from su, only from services with a predictable environment such as sshd or login. sudo has no option to update a user's time stamp, only to remove it. So you'll have to update ...


6

As far as I know, PAM doesn't determine the user's shell, this is left to the application. PAM's session modules perform generic actions and checks that must be done for on every login using that particular service. If the application then wants to start a shell, it is free to do so, and will typically look up the shell in the user database. Assuming your ...


6

Whew. I solved the problem. It amounts to a config but within /etc/pam.d/vsftpd Because ssh sessions succeeded while ftp sessions failed, I went to /etc/pam.d/vsftpd, removed everything that was there and instead placed the contents of ./sshd to match the rules precisely. All worked! By method of elimination, I found that the offending line was: ...


6

You need to pass the nodelay parameter to the auth pam_unix.so. Depending on how your'e authenticating, where you need to set the parameter varies. However most linux distrubtions have something like /etc/pam.d/system-auth which is included by all the different files. So for example in /etc/pam.d/system-auth you might have a line that looks like this: ...


5

When you call into Linux-PAM for some authentication procedure, there is always one and only one stack that is run. The stack definition is looked up in these places; the first successful attempt determines which file is read: the file in /etc/pam.d named after the application "service name" (e.g., sshd or gdm), or the file /etc/pam.d/other if no ...


5

My two cent suggestion: you could use PAM to do this. E.g. Use some pam module as pam-mysql to store some of your users in mysql and pam_require to avoid that mysql-stored users can access other than sftp service. Start looking here: Modules/Applications available or in progress...


5

This doesn't appear to be possible with /etc/environment. It's meant as a common location for variables that's shell independent. Given this it doesn't look like it supports strings with hash marks (#) in them and there doesn't appear to be a way to escape them. I found this SF Q&A titled: How does one properly escape a leading “#” character in linux ...


5

You can do it using the Tie::File module which ties a file's lines to an array variable: perl -MTie::File -e ' tie @lines,"Tie::File","your_file_here"; $last_line = pop @lines; splice @lines,1,0,$last_line ' The tied variable (@lines) becomes magical in the sense that whatever array operations you carry out on it affect the lines ...


5

LDAP is a directory service (a type of database) along with a protocol that describes what information is stored, how to search it, etc. All kinds of things can be stored there, but in this case it'd be Unix user and group info. Very loosely, an alternative to /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. Or to NIS. NSS is glibc's name service ...


4

You need to change the first line password [success=1 default=ignore] pam_unix.so obscure sha512 But don't use md5 since the new one is using sha512. If you want to set a minimum password length (8) use the line below password [success=2 default=ignore] pam_unix.so obscure sha512 min=8


4

Actually it can, you just need to run the syscall (which is what the ulimit command does) with CAP_SYS_RESOURCE capability. There are two distinct values for every limit: hard and soft. Soft can be raised even by the user up to the hard limit. The hard limit can only be increased with proper privileges (for some resources it cannot be raised over kernel ...


4

Question 1 This can be done with the module hashlimit. iptables -A INPUT -p tcp --dport 22 -m hashlimit \ --hashlimit-mode srcip --hashlimit-above 3/minute -j DROP Question 2 Netfilter does not see login failures only connections. You need a tool (like Fail2ban) which is active on both levels. You could create a chain with blocked IPs and run a script ...


4

It's specified by the OpenGroup (the body specifying Unix) and by the Linux Standard Base. I don't know how well those are followed on the various Unices/Linuces though. The Wikipedia page is also a good reference.


4

Try restructuring your PAM chain like this for file, /etc/pam.d/common-password: password required pam_pwcheck.so password required pam_cracklib.so use_authtok minlen=10 retry=3 minclass=3 password required pam_pwcheck.so remember=5 use_authtok use_first_pass password required pam_unix2.so nullok use_authtok use_first_pass I found the above and modified ...


4

You can do this with pam_exec module and some PAM trickery. PAM configuration is usually very different across distributions so you will have to understand your configuration and try to tweak it. For Debian (tested with 7.1) edit /etc/pam.d/common-auth (comments left out for clarity) before auth [success=1 default=ignore] pam_unix.so nullok_secure ...


4

In libmisc/utmp.c (for Debian in the source of the login package) line 301 the comment for setutmp() reads: /* * setutmp - Update an entry in utmp and log an entry in wtmp * * Return 1 on failure and 0 on success. */ Actually /var/run/utmp is updated first immediately followed by writing the log by calling updwtmp() (if PAM if used, PAM writes ...


4

I don't think it is possible to do what you are asking. If you could, someone could "brute force" to find valid usernames on your server. I am also pretty sure that the username and the password are sent simultaneously by the client, you could verify this by capturing packets using Wireshark on an unencrypted SSH connection. By "hacking activities" I assume ...


3

Edit: sorry for answering my own question! (The other two answers are great, but don't completely answer the question. But still very helpful!) The OTPassword Pluggable Authentication Module implements Steve Gibson's Perfect Paper Password system in a PAM for Linux. Once you install that, you'll have PPP authentication. But what about a ssh keys bypass? An ...


3

Public-Key-Authentication with OTP as fallback (that's what you meant, right?): Public-Key-Auth with Password fallback is OpenSSH's default behaivour How your password gets verified is best defined in the PAM configuration files


3

I don't think that making automated changes in pam config file is a good idea. There is so many possible configurations that is impossible to predict in which line of config we should insert ours. Sometimes configs are spitted into many files and included to main config. User may want to use your authorization backend only for specified services like ssh ...



Only top voted, non community-wiki answers of a minimum length are eligible