Questions tagged [authentication]
Use this tag for questions relating to authentication mechanism (i.e. proving to the system that you are you, using passwords, keycards etc.). In general don't use this and the security tag on the same question, unless it is about the security of the authentication process.
0
votes
1answer
35 views
Cannot SSH into server because authorized_keys is in a different folder
I was able to SSH into this remote server using password authentication before. I wanted to change that to make it use private/public key pairs instead. I followed the necessary steps by generating a ...
0
votes
0answers
29 views
PAM tweaks to enable login with blank password from console on CentOS 7.6.1810
I am writing an application that forces the user to change his password after the first login. I set a blank password for this admin user with
passwd -d admin
and verified that no password was set ...
2
votes
1answer
29 views
Switch to root user always failed after modifying /etc/pam.d/common-password
I'm using ubuntu 18.04. To strengthen my pass-word policy I modify my /etc/pam.d/common-password like this:
# here are the per-package modules (the "Primary" block)
#password requisite ...
0
votes
0answers
12 views
KDE screen unlock rejects correct password, then eventually unlocks
When my KDE screen is locked, it rejects my password multiple times and then eventually unlocks. Sometimes I make multiple attempts and KDE eventually accepts it; other times, I'll type it in once, ...
-2
votes
1answer
67 views
How are `/etc/ssh/ssh_known_hosts` and `~/.ssh/known_hosts` used for client authentication?
SSH The Definitive Guide says
OpenSSH maintains a single database serving both server authentication and client
authentication. It is the union of the system’s known_hosts file (/etc/ssh/...
1
vote
1answer
95 views
How to configure Linux to authenticate users based on Keycloak user database?
I have an existing user database in Keycloak.
I want to build a Linux machine which logs in users according to the user database in Keycloak (username, password).
How can I accomplish this?
4
votes
1answer
23 views
Multiple user authentications for same account/environment
A computer is being used for shift work currently with a shared account with autologin at boot. Certain UI applications start up at autologin and its important that they run continuously.
How can we ...
0
votes
0answers
45 views
Passwordless SCP from automated script - NO ADMIN RIGHTS server side
I have a cloudways server with no admin rights. I have set up ssh keys using their website interface, to use ssh and scp without passwords from a raspberry pi 3b+ running stretch, however i am having ...
0
votes
1answer
76 views
lynx proxy authorization
A number of scripts on my system are relying on lynx which in turn can't pass through my proxy. More specifically, lynx successfully picks up the global proxy settings except the user id and password ...
0
votes
1answer
152 views
Basic Authentication of Squid - /usr/lib64/squid/basic_ncsa_auth file not found
I have centos 7.6 & installed squid 4.5 on it.
sudo yum -y install squid
I followed this link for Basic Authentication.
Without authentication squid works fine.
Here is squid.conf after ...
0
votes
0answers
21 views
PAM successful authentication limits
I have a question regarding PAM and the possibility that it throttles too many 'auth' attempts if they happen in a short time.
I have posted my question on the PAM mailing list, but to no avail. I ...
0
votes
1answer
40 views
Passwordless(MFA) login Linux
On windows there is Windows Hallo with support for bio-metrics/pin/yubikey/smartphone app. Even if it's not a 1:1 alternative Im looking for something similar.
Is there any way to set up multi-factor ...
0
votes
0answers
22 views
sshd_config AllowUsers not working for Active Directory users Centos & [duplicate]
I am able to authenticate with my CentOS 7 server using Active Directory account in the format of domain/user or user@local.domain. However, when I edit the sshd_config file and try to explicitly ...
0
votes
0answers
47 views
login not working from new tty but with su <username> works
I'm installing LDAP auth on CentOs7 (command-line way).
I'm facing a strange behaviour:
[root@client]# su ldapuser01
(run as root) works and let me connect as ldap user (without prompting for a ...
0
votes
0answers
95 views
NTLMv2 authentication with Centos7
I have a Centos7 VPS with Apache 2.4 and i use it only as a web server.
I use web services of a company that needs NTLMv2 authentication. I use CURL to get the data for the web services for other ...
0
votes
2answers
84 views
auth not working in apache
I was trying to enable authentication in apache . I tried the following configuration items.
<Directory "/var/www/html/balancer-manager">
Order deny,allow
AuthName "Restricted area for ...
0
votes
3answers
132 views
PAM doesn't block my account after 5 failed logins
I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file :
#%...
0
votes
1answer
27 views
Secondary password file creation and reset
Is there any way to reset all passwords previously created when the secondary password file is enabled for the first time to ensure higher-level protection ?.
-2
votes
1answer
83 views
PAM conf files are insecure! [closed]
PAM configuration files located in /etc/pam.d/ are vulnerable to physical attack. That is they can be modified from an external system (bootable USB or take drive to another machine)
Other than ...
1
vote
0answers
999 views
Ubuntu 18.04 netplan configuration for WPA-EAP
Background
I'm using Ubuntu 18.04 server (on a laptop, for development) and am trying to get my wifi configured to work with an WPA-EAP network.
To enable Wifi I followed the guide Wifi on Ubuntu 18 ...
1
vote
1answer
41 views
Possible to get sshd (openssh) to log the public key of failed key based login attempts?
As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.
What I'm looking for is ...
0
votes
0answers
165 views
How to generate keytab for headless AD user
I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
2
votes
1answer
952 views
ldap users unable to ssh to the server
I have configured ldap local server running centos 7, using this article: https://www.itzgeek.com/how-tos/linux/centos-how-tos/step-step-openldap-server-configuration-centos-7-rhel-7.html.
Now my ...
2
votes
0answers
1k views
Add LDAP server certificate to trusted list and enable certificate verification
I am trying to use a secure LDAP connection via TLS ldaps://<server_name>:<port> for various applications (e.g. Gitlab). However, the connection raises certificate errors which is due to ...
1
vote
1answer
593 views
SSH fails with error “Permission denied (Password)”
I am trying to SSH into a PC (lets call it B) with Ubuntu Server 18.04 from a Raspberry Pi (lets call it A) with Raspbian Stretch Lite. Both are on my local network.
PublicKeyAuth is disabled and ...
0
votes
0answers
129 views
For rotating logs- Cronjob issue
Invoking logrotate every 15 mins.
logrotate will rotate only after size threshold crosses 1M
Working machine
[root@machine1 output]# ls -l --block-size=1K
total 296
-rw------- 1 root root 55 Oct ...
6
votes
2answers
237 views
setting sudo password different from login password
I am attempting to use PAM to use a different password for sudo than I do for logging in.
I worked off of this post originally
Set sudo password differently from login one
Unfortunately, every time ...
3
votes
0answers
29 views
Authentication of users via HTTPd with certificates and two CAs
I would like to implement an internal site for our company, with certificate authentication used wherever possible. I have run into (and tried) various examples where one creates their own self-signed ...
2
votes
2answers
72 views
Downloading using curl, username and password required (cookie, phpsessid, etc…) [closed]
I am trying to download files using curl and chrome extension called CurlWget. When I click on a file to download it, I get this message:
wget --header="Host: www.dummy-website.com" \
--header="User-...
1
vote
1answer
87 views
Arch linux set up wifi issue
I've just finished setting up arch linux and am trying to configure wifi (wired internet works ok I checked).
As for wireless I have this issue: I try to connect to wireless router with iw dev ...
0
votes
0answers
17 views
How to create a dummy printer with AuthInfoRequired option
How can I create a dummy printer for CUPS that has realistic support for the AuthInfoRequired option? Ideally this would work even when having the printer on localhost.
I was thinking about CUPS-PDF, ...
1
vote
1answer
280 views
Authenticate Linux<->LDAP Protocol<->AD(active directory): Fail to logon with password
Dears,
I spent much time on this and even successfully verified (Auth)Linux-LDAP-openLDAP ok. But get blocked with AD.I can now switch to user from root account but can not log on with password(...
0
votes
1answer
22 views
MySQL - OS tied users
So, I'm trying to find this option and I can't find it in the docs. I need to know if there is a way in MySQL in which every user on the OS is also a User on the dB.
Just to clarify, when using ...
1
vote
1answer
648 views
Unable to log in to tty1 password incorrect? [closed]
In the console tty1 I can't access with my login and password. It states that my password is incorrect however my password is correct?
1
vote
2answers
64 views
Bypass Apache Authentication for specific IP
We're using Apache as a reverse proxy, so some of our internal development/testing servers are accessible on the open Internet for UAT/CAT purposes.
We have basic authentication setup through LDAP ...
0
votes
2answers
35 views
How do I activate time based admin login to a Linux system using windows active directory?
I have set up a solution where the login to our linux systems is regulated by microsoft active Directory and group memberships. Now i want the access time based so that the ad user will be kicked out ...
1
vote
0answers
322 views
pam_sss access denied with kerberos authentication ok [closed]
I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
8
votes
4answers
3k views
How does Linux identify users?
I mean, if two users have the same name, how does the system know that they're actually different users when it enforces file permissions?
This doubt came to my mind while I was considering to rename ...
3
votes
1answer
921 views
Using pam_exec.so to run a script as root when a user logs in (while extracting user information)?
Question
How can I run a script as root when a user logs in with pam_exec.so (or otherwise)? The script requires information about the user to function.
Problem and Environment
I would like to run ...
1
vote
1answer
1k views
How do I correctly configure exim4 on Debian so I can use `sendmail -t` to send mail via my office365 account?
I'm using Debian stretch (9.4).
I have an office365 account.
Using Evolution, I can successfully download mail via POP3, and also send mail using the Evolution "Sending E-mail" preferences:
Server: ...
0
votes
1answer
106 views
Regarding PAM via ldap
I have a question for the authentication between Linux and Windows.
When I get an authentication from the OS system such as Linux, then I can use PAM by configuration of "/pam.d".
However, it's the ...
1
vote
1answer
1k views
How to make changes to pam config such that further execution of authconfig will not overwrite them?
I'm configuring a CentOS7 host (through ansible) running authconfig. Now I need to add/configure pam_exec module to the setup but it seems it is not supported by authconfig (cf. man authconfig and /...
1
vote
2answers
3k views
ssh through authentication requiring proxy
At work we have of course a company's-proxy. I need to ssh to some machines out of the company's network. The proxy though requires authentication.
lets assume we have the following variables:
...
0
votes
1answer
1k views
LDAP server setup with GUI on CentOS7
I have, in the past, set up an LDAP server using OpenSuSE (13.2), which worked well since there was a YaST module which allowed a GUI set-up.
Now I have the problem that I must set up an OpenLDAP ...
0
votes
1answer
243 views
White List and Black List for SSH
How to create a (username/password or certificate) white/black list for ssh?
For example of blacklist, I can use any username/password combination to access the server, except the ones on the ...
1
vote
2answers
1k views
How to verify that ssh certificate was signed by specified ssh CA private key?
I am trying to harden my ssh setup using this material. It works fine, but I've got a question which I'm struggling to find the answer to.
Does anyone know if there is a way to check the ssh host/...
0
votes
0answers
32 views
How to use 2FA with cert based SSH auth?
I used this guide to enable Google TOTP auth on Ubuntu 16.04.
SSH only allows cert based auth (PasswordAuthentication no)
I set ChallengeResponseAuthentication yes and restarted the SSH service.
I ...
2
votes
1answer
106 views
How to enable usage of SSH keys pair without exposing it
We have a topsecret@remote.org SSH account that can be accessed with SSH key pair ts_key.pub/ts_key.priv from our gateway server (gateway.org). We have many sysadmins that need to access that account. ...
-1
votes
2answers
61 views
How to copy public key to the server that doesn't allow password?
I configured my server to not allow password authentication. Now I have a new machine in a remote location, how is it possible for me to generate an ssh key and do an ssh-copy-id to the server if the ...
1
vote
1answer
47 views
Can two local users on two separate machines use SSH keys to authenticate without passwords?
I have two local users (whose homes directories are listed under /localhome/user) on two separate VMs on the same network. They share the same uid (set in /etc/passwd) and the same username (<user&...
