Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
0
votes
0answers
31 views

pam_tally2 fails after password change

I am running Debian buster on several PCs. I used the pam_tally2 module to add some security to the systems. I tested on ssh and desktop login, and it worked very well. So, for an extra layer of ...
0
votes
0answers
22 views

Custom PAM fails at PAM_CONVERSATION in ssh

I've been trying to implement a custom PAM for 2nd Factor Verification. The Custom PAM needs to read factor selected(integer) and pass it on to the program. The below code works fine in SUDO and SU ...
0
votes
0answers
15 views

Prevent user login before mount is complete

All our workstations are Ubuntu 18. The /home/ is a network mount (nas). This is how it looks in /etc/fstab: nas:/mnt/export/home /home nfs nfsvers=3,_netdev 0 0 The problem is: ...
0
votes
1answer
31 views

error bootmessages. PAM unable to load. PAM adding faulty module

So when booting my Mint 20.1 I always see a short error. With journalctl -bI can see the following suspecious logs Feb 16 15:28:43 username-home kernel: ACPI Error: Needed type [Reference], found [...
-1
votes
0answers
50 views

Is there a way to suspend a user allowing the user to only unsuspend themself?

I have a user foo I want to prevent foo from doing anything else other than unlocking themself, until they're unlocked. Then I want them to function as a regular user. This is an event that the system ...
0
votes
1answer
31 views

How can I see if a Linux Embedded system authenticates with PAM or passwd only?

I cross compiled Linux-PAM and OpenLDAP for my linux embedded system (with ARM architecture) and copied the compiled files and folders into it. I create a /etc/pam.d/ folder and i put inside of it the ...
0
votes
0answers
8 views

Is it possible to put an increment on unlock_time for every failed login attempt?

I have Debian 10.7 machine with a PAM setup: auth [success=1 default=ignore] pam_unix.so nullok_secure auth required pam_deny.so auth required pam_tally2.so ...
0
votes
1answer
25 views

Cross-compile Linux-PAM: both pam.d and pam.conf are missing

I am trying to cross-compile Linux-PAM from a Ubuntu host machine to powerpc architecture (running linux kernel 2.6.34). First, I run ./configure command, giving the --host path to the cross compiler ...
1
vote
0answers
26 views

systemd-logind failing to create per-user instance for ssh

I have an Ubuntu 20.04 system that's failing to create the per-user instance of systemd when logging in via ssh. /var/log/auth.log Jan 26 21:36:15 hostname sshd[4181]: pam_systemd(sshd:session): ...
0
votes
0answers
14 views

Automating SELinux user mappings for SSSD AD users without an IdM solution

I have several RHEL7 and CentOS7 based systems that are tied into a Windows Server 2019 Active Directory using realms/SSSD. Currently, AD users adopt the unconfined_u SELinux user mapping by default. ...
0
votes
0answers
49 views

lightdm: gkr-pam: no password is available for user - how to solve?

I know that this was also mentioned in Password for user is not asked anymore to a certain extent, however, the issue discussed there does not seem to unequivocally connected to this one. Changing ...
0
votes
0answers
60 views

PAM account management error: Permission denied

I am getting some authentication errors while using some sudo commands in my Kali Linux. The error is: └─$ sudo apt-get update ...
-1
votes
1answer
18 views

How can I prevent a ssh login failing from occurring if a script run via pam_exec.so fails?

I'm trying to trigger a script everytime a login occurs over SSH. I've added the following line to the end of /etc/pam.d/sshd: session required pam_exec.so stdout /home/root/xyz/login-alert.sh ...
0
votes
0answers
10 views

pam_xauth isn't working with sudo: Unsupported authorisation protocol

I'm trying to set up xauth cookie forwarding between users, so that GUI programs could be run as any user via SSH. I have added the following line to /etc/pam.d/su and /etc/pam.d/sudo: session ...
0
votes
1answer
37 views

Fingerprint sensor detected; never unlocks

I have a Lenovo IdeaPad 14ARE05 and have installed Debian SID on it. There were multiple compatibility issues out-of-the-box, but I've been able to resolve most of them. The only major one that ...
0
votes
0answers
18 views

Why don't hostnames work in pam_access?

The man page for access.conf specifies using a DNS hostname for the origin field: + : foo_user : foo1.bar.org but, I get errors in auth.log (Ubuntu 16.04) when connecting over ssh. If I change foo1....
0
votes
0answers
17 views

does single user mode bypass PAM and always allow console login?

I am investigating setting up a RHEL 7 linux system to authenticate with active directory along with MFA. In doing do I am being given instructions that modify various pam.d files such as system-auth....
0
votes
1answer
114 views

What does pam_systemd.so do?

I switched my SD card from the fast RaspberryPi 4 to the RaspberryPi 2. Now, logging into it with ssh -vv took about 3 minutes and got stuck at pledge: network. This question discusses such behaviour ...
0
votes
1answer
17 views

Why is my build of the libpam-ldap package on Ubuntu 18.04 failing?

I'm not great at building from source but trying to build the Bionic source package of libpam-ldap on a Ubuntu 18.04 host to fix a timeout issue when using Duo MFA. I issued apt source libpam-ldap and ...
0
votes
1answer
28 views

Sendmail PAM authentication not working

I have been trying to migrate my mail functionality to a new server. I've copied my alterations to sendmail.mc and rebuilt sendmail.cf. For authentication I use a DB file that is configured in /etc/...
0
votes
1answer
43 views

Using pam to configure ssh access via specific ip

I am currently trying to configure a server and I want to allow every user with UID from 6000-6500 to ssh into my server ONLY if that ssh comes from an IP present in the file /etc/remote-hosts. I ...
0
votes
0answers
51 views

how to configure XRDP session with two factor authentication (Radius Server) by using Pam modules?

how to configure XRDP session with two factor authentication (Radius Server) by using Pam modules? I have done changes in /etc/pam.d/xrdp-sesman file
1
vote
1answer
50 views

SSH Publickey+TOTP and Password+TOTP simultaneously

I am trying to setup an SSH server where some users prefer to use an SSH key but others prefer LDAP provided passwords. I found out that I can set in sshd_config for publickey + PAM or PAM only ...
0
votes
0answers
18 views

Create own /bin/login program

I created a simple program using python-pam module that simply reads login, password and verifies them: #!/usr/bin/env python3 import subprocess import getpass import pam p = pam.pam() while True: ...
0
votes
1answer
68 views

pam_ssh_agent_auth: sudo asks for password with ssh user@host, but ssh user@host 'bash' not

I use gpg-agent to manage ssh-agent. On my PC: ssh-add -L prints my public keys which is used on the server. ForwardAgent is open. pam.d/sudo and sudoers are configured. After ssh user@host, echo $...
0
votes
0answers
57 views

Grant Linux Capabilities upon login with GDM using pam_cap

I am trying to grant a user the CAP_NET_ADMIN and CAP_NET_RAW capabilities on a Debian 11 system running the GNOME3 desktop environment. The user should receive the ability to use these capabilities ...
0
votes
0answers
13 views

can't get pam_duo to prompt for mfa for afp share login

I am trying to use sssd and Duo MFA to protect some linux afp shares. I've successfully got sssd up and working, however I can only login if I set my user in Duo to bypass MFA. If I enforce MFA, the ...
0
votes
0answers
75 views

winbind / pam / nss-systemd: “Cannot find name for group ID” errors after logon with AD-Accounts!

on several (but not all) ad joined member servers running Ubuntu 18.04 using winbind/pam as logon modules, the console displays several errors after logging in (or display group memberships) with some ...
0
votes
1answer
44 views

SSH doesn't prompt for new password when expired

I'd like to setup SSH to prompt for a new password when a user's existing one is expired, but currently it just fails to login. I use Kerberos as an authentication backend. You can see this user's ...
1
vote
1answer
43 views

Is it possible to stop users from changing their passwords with PAM?

How can I stop users form changing their passwords with PAM? Is this possible? PAM can enforce password strength and the like, but it can reject all changes?
0
votes
1answer
25 views

Shell for only changing password

I need to restrict all access to a user on a RHEL 8 system and allow them to only change their own password. I thought that I could do [root]$ usermod <username> -s /bin/passwd but this is not ...
0
votes
1answer
95 views

What happens if I accidentally delete the contents of /etc/pam.d/password-auth

Situation: Poking around some system files in /etc/ Problem: I managed to accidentally rm-ed some files, including /etc/pam.d/password-auth and /etc/pam.d/system-auth (don't ask...) Question: What are ...
0
votes
0answers
14 views

create user on the fly for ssh-ca

I want to use ssh-ca to grant access to servers. What I don't want is, that all user are using the same system user for access. Is it possible to create the systemuser on-the-fly when the ssh ...
0
votes
0answers
49 views

sudo intermittent error message: “Your account has been locked. Please contact your System administrator”

Please bare with me, I am trying to help out some colleagues who are experiencing an issue with sudo. Our Linux workstations are joined to the AD domain. Occasionally, when users run sudo they get ...
1
vote
0answers
87 views

PAM fingerprint login blocks password

Is there a way to make PAM run authentication modules in parallel? For all people who use PAM this may be useful. It seems that PAM runs authentication modules in sequence and blocking. What that ...
0
votes
0answers
33 views

Alter Linux username with PAM

So, I have this 3rd party application that uses usernames in the format user@domain. More precisely, it uses the UPN from ActiveDirectory, e.g. john.doe@company.local. That’s fine in this application. ...
0
votes
0answers
11 views

Allow LDAP login for selected users only on SLES 12 SP 5

I have configured a LDAP Client on SLES 12 SP5. Now I want to allow only a selected group of users to login to the system. This group comprises 2 or 3 users. For all other users login must be ...
3
votes
0answers
23 views

OpenSSH U2F as second factor with fallback to Google Authenticator

We use Google Authenticator for 2FA SSH logins. It's configured in /etc/pam.d/sshd as follows: @include common-password auth required pam_google_authenticator.so nullok As you may know, OpenSSH 8.2 ...
1
vote
1answer
146 views

sudo -i and ~/.pam_environment

I have switched to using ~/.pam_environment for setting my user environment variables, and it works quite well. PAM takes care of setting everything, regardless of what shell I'm using, how I'm using ...
0
votes
0answers
83 views

Run login user through PAM before systemd-user

My user@.service does not start properly due to /etc/pam.d/systemd-user failing to provide a password interactively (of course) to pam_mount; so consequently paths it needs are missing. # pam.d/...
1
vote
0answers
1k views

CentOS 7.7 - sudo: PAM account management error: Permission denied

We have a CentOS 7.7 system which is joined to a Microsoft AD domain using realmd/sssd. Sudo does work perfectly fine for local system users, however when we attempt to use sudo as an Active Directory ...
0
votes
0answers
41 views

Systemd user units enabled but don't automatically activate, start fine manually

None of my systemd user units start automatically, but activate fine if I systemctl --user start them myself. For example: [Unit] Description=pass db sync [Service] Type=oneshot ExecStart=/bin/bash --...
0
votes
1answer
51 views

Parental password for kid's account

I am one of the many many parents facing the prospect of my two kids spending a whole lot more time in front of the computer screen this fall, due to remote schooling. I have a ubuntu (actually pop_os)...
1
vote
1answer
62 views

what does a dash in front of a pam entry mean?

I have searched everything I can but couldn't find any explanation. My /etc/pam.d/lightdm file contains the following two gnome keyring entries: auth include system-login -auth ...
0
votes
0answers
16 views

i3lock: how to unlock when system-auth has 2fa enabled?

I am running Arch Linux with i3, and have system-wide 2fa for logging in; which is defined in my pam.d/system-auth file. The issue arises when I lock the screen with i3lock, and can't get back in!.. ...
0
votes
1answer
73 views

Get Linux user password into a C program

I am trying to implement a PAM for Linux which gets invoked for sudo operations, the purpose of it is to ask the user for SMS sent to his mobile right after he enters a password when performing sudo ...
3
votes
0answers
31 views

force specific shell environment variable on process using /etc/pam.d/ rules

I am using slim login manager, and it has its own pam rules file: /etc/pam.d/slim. auth requisite pam_nologin.so auth required pam_env.so readenv=1 auth required pam_env....
0
votes
0answers
51 views

Automount zfs on login, auto unmount on logoff

What I want I want to login (ssh, gdm, or any other way) and have my zfs datasets mounted with my login password. I don't want to have to type in my password a second time. When I log off I want the ...
0
votes
0answers
19 views

Systemd --user services not starting since enabling pam_mount

Since using pam_mount to encrypt my home directory, units enabled in ~/.config/systemd/user are no longer starting on login. I believe (but haven't tested) that this can be resolved with loginctl ...
0
votes
1answer
200 views

pam_get_uid; no such user

I am seeing this error when an app server is trying to access to a postgres database on the RHEL 6 server. authentication: pam_succeed_if(postgresql:auth): error retrieving information about user svc-...

1
2 3 4 5
11