Tag Info

Hot answers tagged

45

This is a security thing, it's not actually taking long to realize it. 2 vulnerabilities this solves: this throttles login attempts, meaning someone can't pound the system as fast as it can go trying to crack it (1M attempts a sec? idk). If it did it as soon as it verified your credentials were incorrect, you could use the amount of time it took for it to ...


24

This is intentional, to try and limit brute forcing. You can usually modify it by looking for the FAIL_DELAY configuration entry in /etc/login.defs and changing its value (mine is 3 seconds by default), although the comment in that file makes it sound like PAM will enforce at least a 2 second delay no matter what


20

Passwords on a linux system are not encrypted, they are hashed which is a huge difference. It is not possible to reverse a hash function by definition. For further information see the Hash Wikipedia entry. Which hash function is used, depends on your system configuration. MD5 and blowfish are common examples for used hash functions. So the "real" password ...


12

I assume you are using Linux and pam. The delay is probably caused by pam_faildelay.so. Check your pam configuration in /etc/pam.d using pam_faildelay, e.g: # Enforce a minimal delay in case of failure (in microseconds). # (Replaces the `FAIL_DELAY' setting from login.defs) # Note that other modules may require another minimal delay. (for example, # to ...


9

Under default behavior, you will still be able to log in using your ssh key, but the system administrator is free to change this behavior using pam or other methods. OpenSSH doesn't care about the expiration date on your password if it's not using password authentication, but pam can be set up to check password expiration even after sshd has authenticated ...


8

If you don't want to change groups or use sudo, use a pam module called pam_exec to execute external scripts in a pam stage. Add a line in your /etc/pam.d/su after the pam_rootok.so line: auth sufficient pam_exec.so quiet /path/to/script /path/to/script has the permissions 755 (rwxr-xr-x) and the following content: #!/bin/bash if [ "$PAM_TYPE" == ...


7

You're right: /etc/passwd and /etc/shadow are consulted by pam_unix.so, which are part of PAM. At least on modern Linuxes. You could change this by patching pam_unix.so. If the manpage is to be believed, you can't change the location of the system databases. And you really don't want to. /etc/passwd isn't just used for authentication, it's also used for ...


7

You can use pam_exec to invoke an external command. Beware that pam_exec runs in an environment that is under the control of the user who calls the login service, so don't invoke it from su, only from services with a predictable environment such as sshd or login. sudo has no option to update a user's time stamp, only to remove it. So you'll have to update ...


6

As far as I know, PAM doesn't determine the user's shell, this is left to the application. PAM's session modules perform generic actions and checks that must be done for on every login using that particular service. If the application then wants to start a shell, it is free to do so, and will typically look up the shell in the user database. Assuming your ...


6

Whew. I solved the problem. It amounts to a config but within /etc/pam.d/vsftpd Because ssh sessions succeeded while ftp sessions failed, I went to /etc/pam.d/vsftpd, removed everything that was there and instead placed the contents of ./sshd to match the rules precisely. All worked! By method of elimination, I found that the offending line was: ...


5

When you call into Linux-PAM for some authentication procedure, there is always one and only one stack that is run. The stack definition is looked up in these places; the first successful attempt determines which file is read: the file in /etc/pam.d named after the application "service name" (e.g., sshd or gdm), or the file /etc/pam.d/other if no ...


5

My two cent suggestion: you could use PAM to do this. E.g. Use some pam module as pam-mysql to store some of your users in mysql and pam_require to avoid that mysql-stored users can access other than sftp service. Start looking here: Modules/Applications available or in progress...


5

You need to pass the nodelay parameter to the auth pam_unix.so. Depending on how your'e authenticating, where you need to set the parameter varies. However most linux distrubtions have something like /etc/pam.d/system-auth which is included by all the different files. So for example in /etc/pam.d/system-auth you might have a line that looks like this: ...


4

/etc/securetty is consulted by pam_securetty module to decide from which virtual terminals (ttyS) root is allowed to login from. In the past, /etc/securetty was consulted by programs like login directly, but now PAM handles that. So changes to /etc/securetty will affect anything using PAM with a configuration file that uses pam_securetty.so. So, only the ...


4

Question 1 This can be done with the module hashlimit. iptables -A INPUT -p tcp --dport 22 -m hashlimit \ --hashlimit-mode srcip --hashlimit-above 3/minute -j DROP Question 2 Netfilter does not see login failures only connections. You need a tool (like Fail2ban) which is active on both levels. You could create a chain with blocked IPs and run a script ...


4

It's specified by the OpenGroup (the body specifying Unix) and by the Linux Standard Base. I don't know how well those are followed on the various Unices/Linuces though. The Wikipedia page is also a good reference.


4

You can do this with pam_exec module and some PAM trickery. PAM configuration is usually very different across distributions so you will have to understand your configuration and try to tweak it. For Debian (tested with 7.1) edit /etc/pam.d/common-auth (comments left out for clarity) before auth [success=1 default=ignore] pam_unix.so nullok_secure ...


4

This doesn't appear to be possible with /etc/environment. It's meant as a common location for variables that's shell independent. Given this it doesn't look like it supports strings with hash marks (#) in them and there doesn't appear to be a way to escape them. I found this SF Q&A titled: How does one properly escape a leading “#” character in linux ...


4

You can do it using the Tie::File module which ties a file's lines to an array variable: perl -MTie::File -e ' tie @lines,"Tie::File","your_file_here"; $last_line = pop @lines; splice @lines,1,0,$last_line ' The tied variable (@lines) becomes magical in the sense that whatever array operations you carry out on it affect the lines ...


3

Edit: sorry for answering my own question! (The other two answers are great, but don't completely answer the question. But still very helpful!) The OTPassword Pluggable Authentication Module implements Steve Gibson's Perfect Paper Password system in a PAM for Linux. Once you install that, you'll have PPP authentication. But what about a ssh keys bypass? An ...


3

I don't think that making automated changes in pam config file is a good idea. There is so many possible configurations that is impossible to predict in which line of config we should insert ours. Sometimes configs are spitted into many files and included to main config. User may want to use your authorization backend only for specified services like ssh ...


3

I don't see how running sulogin in this way helps you. sulogin is normally run when you boot into single user mode, so if it doesn't work there (because the shadow password file is hopelessly corrupted) it isn't going to work if you run it in multi-user mode. And if sulogin works in single-user mode you have no need to run it in multi-user mode. A better ...


3

I highly highly highly (highly) recommend using Likewise Open to do this. Every time I talk about them, I sound like a paid shill, but I'm not. It's just really that good. Essentially, you install the software (painless, there's an RPM and DEB intaller), run "domainjoin-cli domain.com adminuser", type the password for "adminuser", and then your machine is ...


3

Since you want to use a password that is something other than the one for your normal account, try security/pam_pwdfile from the ports tree. Basically, it allows you to use an alternate file (format: username:crypted_password) to authenticate against. To use it, put the following line in /etc/pam.d/sshd right before the line for pam_opie: auth required ...


3

You need to change the first line password [success=1 default=ignore] pam_unix.so obscure sha512 But don't use md5 since the new one is using sha512. If you want to set a minimum password length (8) use the line below password [success=2 default=ignore] pam_unix.so obscure sha512 min=8


3

Yes, security is the reason and no, su has no way of circumventing that. But there is sudo, which can be used for what you want and it has a configuration file where you can disable the need to enter a password. It also allows for complex configurations so that you can disable the need for a password for a very specific command only, to not fully void ...


3

Actually it can, you just need to run the syscall (which is what the ulimit command does) with CAP_SYS_RESOURCE capability. There are two distinct values for every limit: hard and soft. Soft can be raised even by the user up to the hard limit. The hard limit can only be increased with proper privileges (for some resources it cannot be raised over kernel ...


3

PAM is not a daemon, but just a library. As a normal user has no access to authentication data (like /etc/shadow), programs running under a normal user cannot authenticate. There is one small exception: The user can authenticate himself, because in this case the SETGID /sbin/unix_chkpwd helper program is automatically called, which has access to ...


3

I would write a small program that checked for any active SSH connections via netstat and/or ps. Drop it in place of the shutdown command. If no one else is using the machine, call shutdown when the user tries to. If someone is using the machine, simply warn the user who issued the shutdown command. Netstat will give you output like this, and it's pretty ...


3

Never, ever even consider using rsh for remote connections. It is horribly insecure to have rshd running, as it is very easy to take over any account (and even the whole machine) unless utmost care is taken. And as you see, it hasn't been kept up to date either. Use ssh, with shared keys (no password). It isn't much harder to set up, and offers some ...



Only top voted, non community-wiki answers of a minimum length are eligible