1

I followed a guide online and installed some PAM modules:

sudo apt-get install libpam-modules libpam-pwquality libpam-cracklib

My standard user account "jon" has sudo privileges but now if I try to elevate myself it keeps telling me I'm putting in the password wrong. I even typed it very slowly to make sure. Did I break something?

My /etc/pam.d/common-* files look like this.

/etc/pam.d/common-auth:

auth        required      pam_tally2.so deny=3 unlock_time=300 even_deny_root
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        required      pam_deny.so

/etc/pam.d/common-account:

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     required      pam_permit.so

/etc/pam.d/common-password:

password    requisite     pam_pwquality.so local_users_only retry=3 minlen=15 gecoscheck maxrepeat=3
password    required      pam_pwhistory.so remember=400 use_authtok
password    sufficient    pam_unix.so sha512 shadow use_authtok
password    required      pam_deny.so

/etc/pam.d/common-session:

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
  • 1
    Boot into rescue mode and put your PAM files back how they were. If you can then elevate, then yes, you broke something in them. – Joseph Sible-Reinstate Monica Dec 14 '19 at 22:52
  • 1
    @JosephSible-ReinstateMonica I was able to restore everything and now I'm able to elevate again. Is there any way I can test each line to see what went wrong? I tried with pamtester but the syntax isn't clear to me – Jonathan Dec 15 '19 at 1:59
  • Do a binary search: make half of your changes at a time until you narrow it down to a single line that's breaking it. – Joseph Sible-Reinstate Monica Dec 15 '19 at 2:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.