Questions tagged [authentication]
Use this tag for questions relating to authentication mechanism (i.e. proving to the system that you are you, using passwords, keycards etc.). In general don't use this and the security tag on the same question, unless it is about the security of the authentication process.
0
votes
0answers
24 views
Linux Mint 19 “Tara” Cinnamon - Fingerprint GUI tiny, can barely use
I've installed fingerprint-gui on the mentioned system.
It's working so far (exept on the login screen and autorization for installs in the software center), but I wonder why the GUI is so "compressed"...
1
vote
1answer
31 views
Possible to get sshd (openssh) to log the public key of failed key based login attempts?
As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.
What I'm looking for is ...
0
votes
0answers
15 views
How to generate keytab for headless AD user
I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
0
votes
1answer
53 views
ldap users unable to ssh to the server
I have configured ldap local server running centos 7, using this article: https://www.itzgeek.com/how-tos/linux/centos-how-tos/step-step-openldap-server-configuration-centos-7-rhel-7.html.
Now my ...
2
votes
0answers
97 views
Add LDAP server certificate to trusted list and enable certificate verification
I am trying to use a secure LDAP connection via TLS ldaps://<server_name>:<port> for various applications (e.g. Gitlab). However, the connection raises certificate errors which is due to ...
1
vote
1answer
96 views
SSH fails with error “Permission denied (Password)”
I am trying to SSH into a PC (lets call it B) with Ubuntu Server 18.04 from a Raspberry Pi (lets call it A) with Raspbian Stretch Lite. Both are on my local network.
PublicKeyAuth is disabled and ...
0
votes
0answers
39 views
For rotating logs- Cronjob issue
Invoking logrotate every 15 mins.
logrotate will rotate only after size threshold crosses 1M
Working machine
[root@machine1 output]# ls -l --block-size=1K
total 296
-rw------- 1 root root 55 Oct ...
6
votes
2answers
190 views
setting sudo password different from login password
I am attempting to use PAM to use a different password for sudo than I do for logging in.
I worked off of this post originally
Set sudo password differently from login one
Unfortunately, every time ...
3
votes
0answers
24 views
Authentication of users via HTTPd with certificates and two CAs
I would like to implement an internal site for our company, with certificate authentication used wherever possible. I have run into (and tried) various examples where one creates their own self-signed ...
2
votes
2answers
47 views
Downloading using curl, username and password required (cookie, phpsessid, etc…) [closed]
I am trying to download files using curl and chrome extension called CurlWget. When I click on a file to download it, I get this message:
wget --header="Host: www.dummy-website.com" \
--header="User-...
1
vote
1answer
36 views
Arch linux set up wifi issue
I've just finished setting up arch linux and am trying to configure wifi (wired internet works ok I checked).
As for wireless I have this issue: I try to connect to wireless router with iw dev ...
0
votes
0answers
9 views
How to create a dummy printer with AuthInfoRequired option
How can I create a dummy printer for CUPS that has realistic support for the AuthInfoRequired option? Ideally this would work even when having the printer on localhost.
I was thinking about CUPS-PDF, ...
1
vote
1answer
95 views
Authenticate Linux<->LDAP Protocol<->AD(active directory): Fail to logon with password
Dears,
I spent much time on this and even successfully verified (Auth)Linux-LDAP-openLDAP ok. But get blocked with AD.I can now switch to user from root account but can not log on with password(...
0
votes
1answer
21 views
MySQL - OS tied users
So, I'm trying to find this option and I can't find it in the docs. I need to know if there is a way in MySQL in which every user on the OS is also a User on the dB.
Just to clarify, when using ...
1
vote
1answer
175 views
Unable to log in to tty1 password incorrect? [closed]
In the console tty1 I can't access with my login and password. It states that my password is incorrect however my password is correct?
1
vote
2answers
42 views
Bypass Apache Authentication for specific IP
We're using Apache as a reverse proxy, so some of our internal development/testing servers are accessible on the open Internet for UAT/CAT purposes.
We have basic authentication setup through LDAP ...
0
votes
2answers
35 views
How do I activate time based admin login to a Linux system using windows active directory?
I have set up a solution where the login to our linux systems is regulated by microsoft active Directory and group memberships. Now i want the access time based so that the ad user will be kicked out ...
1
vote
0answers
178 views
pam_sss access denied with kerberos authentication ok
I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
8
votes
4answers
3k views
How does Linux identify users?
I mean, if two users have the same name, how does the system know that they're actually different users when it enforces file permissions?
This doubt came to my mind while I was considering to rename ...
2
votes
1answer
410 views
Using pam_exec.so to run a script as root when a user logs in (while extracting user information)?
Question
How can I run a script as root when a user logs in with pam_exec.so (or otherwise)? The script requires information about the user to function.
Problem and Environment
I would like to run ...
1
vote
1answer
478 views
How do I correctly configure exim4 on Debian so I can use `sendmail -t` to send mail via my office365 account?
I'm using Debian stretch (9.4).
I have an office365 account.
Using Evolution, I can successfully download mail via POP3, and also send mail using the Evolution "Sending E-mail" preferences:
Server: ...
0
votes
1answer
82 views
Regarding PAM via ldap
I have a question for the authentication between Linux and Windows.
When I get an authentication from the OS system such as Linux, then I can use PAM by configuration of "/pam.d".
However, it's the ...
0
votes
0answers
27 views
Authentication password changed?
When I installed linux mint 18.3, I set a password. Then I changed the admin of the device but the old password isn't accepted. Any thoughts?
1
vote
1answer
397 views
How to make changes to pam config such that further execution of authconfig will not overwrite them?
I'm configuring a CentOS7 host (through ansible) running authconfig. Now I need to add/configure pam_exec module to the setup but it seems it is not supported by authconfig (cf. man authconfig and /...
1
vote
2answers
1k views
ssh through authentication requiring proxy
At work we have of course a company's-proxy. I need to ssh to some machines out of the company's network. The proxy though requires authentication.
lets assume we have the following variables:
...
0
votes
1answer
849 views
LDAP server setup with GUI on CentOS7
I have, in the past, set up an LDAP server using OpenSuSE (13.2), which worked well since there was a YaST module which allowed a GUI set-up.
Now I have the problem that I must set up an OpenLDAP ...
0
votes
1answer
129 views
White List and Black List for SSH
How to create a (username/password or certificate) white/black list for ssh?
For example of blacklist, I can use any username/password combination to access the server, except the ones on the ...
1
vote
2answers
544 views
How to verify that ssh certificate was signed by specified ssh CA private key?
I am trying to harden my ssh setup using this material. It works fine, but I've got a question which I'm struggling to find the answer to.
Does anyone know if there is a way to check the ssh host/...
0
votes
0answers
30 views
How to use 2FA with cert based SSH auth?
I used this guide to enable Google TOTP auth on Ubuntu 16.04.
SSH only allows cert based auth (PasswordAuthentication no)
I set ChallengeResponseAuthentication yes and restarted the SSH service.
I ...
2
votes
1answer
97 views
How to enable usage of SSH keys pair without exposing it
We have a topsecret@remote.org SSH account that can be accessed with SSH key pair ts_key.pub/ts_key.priv from our gateway server (gateway.org). We have many sysadmins that need to access that account. ...
-1
votes
2answers
51 views
How to copy public key to the server that doesn't allow password?
I configured my server to not allow password authentication. Now I have a new machine in a remote location, how is it possible for me to generate an ssh key and do an ssh-copy-id to the server if the ...
1
vote
1answer
46 views
Can two local users on two separate machines use SSH keys to authenticate without passwords?
I have two local users (whose homes directories are listed under /localhome/user) on two separate VMs on the same network. They share the same uid (set in /etc/passwd) and the same username (<user&...
0
votes
1answer
129 views
Why does the pam_unix module documentation list PAM_IGNORE as its only return value?
From http://www.linux-pam.org/Linux-PAM-html/sag-pam_unix.html:
6.37.4. RETURN VALUES
PAM_IGNORE
Ignore this module.
Obviously the module must return success or failure for password ...
0
votes
1answer
165 views
LDAP authentication and default groups
I have multiple RHEL 7.4 servers with LDAP authentication via sssd. Conveniently, my university's LDAP environment has a UIDNumber attribute that is unique for every person. My sssd.conf is at the end ...
1
vote
0answers
278 views
Access SMB shares using stored credentials
Assuming I have a network of a few Windows computers, and I set up the same user with the same password on all computers, this user will be able to access any shares on any of the computers - without ...
1
vote
1answer
65 views
How to allow any user to log as a non loggable user?
I'm trying to implement the following functionality on Redhat:
I have a user "John" that can't be used to login directly via GDM or console or SSH.
I want to allow any user that are logged onto the ...
0
votes
1answer
148 views
OpenBSD LDAP authentication - ypldap high CPU usage
I have an OpenBSD server with login_ldap, ypldap, ypbind and portmapper is configured according to these guides that I managed to find courtesy of Google.
http://obfuscurity.com/2009/08/OpenBSD-as-an-...
0
votes
0answers
135 views
OpenBSD - login_ldap - ypldap - sudo.ldap and handling of remote and local users
I have an OpenBSD server with login_ldap, ypldap, ypbind and portmapper is configured according to these guides that I managed to find courtesy of Google.
http://obfuscurity.com/2009/08/OpenBSD-as-an-...
1
vote
0answers
24 views
How can I list which users can login without key auth?
I have recently been charged with a large amount of Ubuntu servers that are exclusively accessed via private/public SSH authentication.
There is no information regarding how these servers were ...
0
votes
1answer
152 views
Password for user is not asked anymore [closed]
I am using Debian Stretch with lightdm. Suddenly, I am no longer asked for a password when I log in. As soon as I fill in my username and press tab, the password field is removed and I can log in ...
2
votes
1answer
500 views
Authentication mechanism to connect to Windows AD in Linux?
My company has asked me to look into connecting our CentOS 7 instance's to our Active Directory to make it easier for user management.
I have so far looked at:
Kerberos, doing it via command line - ...
2
votes
1answer
98 views
What is the correct format for xpra password files?
I created a username/password combination of the form onetwo:bucklemyshoe, ie the password file contains the single line onetwo|bucklemyshoe
Whenever I try to connect the message appears on the ...
2
votes
2answers
381 views
Why do we use optional in PAM even if it'll be ignored?
As we know, optional is one of the control value in PAM's configuration files.
From linux-pam.org:
optional:
the success or failure of this module is only important if it is the only module in ...
1
vote
0answers
42 views
Ignore certain hosts in last log
I have an ansible job that uses ssh to perform tasks on many servers. It uses an authorized key to gain entry. When I run the last command it just shows a long list of root logins from the ansible ...
0
votes
0answers
32 views
Forward apache authentication to remote “ressource”
I want to implement some kind of "forwarding" apache authentication to a remote ressource.
Imagine multiple servers to be able to authenticate the same users.
Yes, I could do this via "...
1
vote
0answers
428 views
SSO with Samba4 Client and Samba3 Server without Active Directory
In the office I'm currently working is the following setup:
a linux server managing the accounts for single sign on, shares and printers. This will be called 'server129' and should not be modified. (...
0
votes
0answers
200 views
disable invalid username logging in auth.log
Logging invalid usernames can result in logging user passwords. Is there any way to silent these logs in /var/log/auth.log file? This discussion:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=...
0
votes
0answers
204 views
One server, two Kerberos realms
I have a number of CentOS 7 servers which need to authenticate with two different Kerberos realms: A.EXAMPLE.COM and B.EXAMPLE.POOP. Most users exist in the one, a few in the other. I have them ...
0
votes
0answers
249 views
Pass Opal SED PBA (Pre-Boot Authentication) credential to system to log in automatically with default user
TCG Opal drives support the use of a pre-boot environment ("shadow MBR") to request the AK (Authorization Key) from the user in order to unlock the drive (by deciphering the Data Encryption Key) ...
1
vote
1answer
464 views
Unable to execute GUI application as a different user using `pkexec`
I have created following policy file at /usr/share/polkit-1/actions/com.xyz.xyz.policy
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit ...
