2022 Developer Survey is open! Take survey.

Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
1 vote
0 answers
35 views

Why isn't a systemd user session started by `su`?

When I use ssh to log in to the root user on my server, an entry 0 is created in /var/run/user because pam_systemd tells systemd-logind to do this. This is an indicator that a user session has been ...
user avatar
  • 147
0 votes
0 answers
28 views

PAM allow only a specific su command for a user

i created a rule to allow mygroup group to do su command. In /etc/pam.d/su auth sufficient pam_succeed_if.so use_uid user ingroup mygroup Now i want mygroup to be able to use only halt command, ...
user avatar
  • 1
1 vote
1 answer
33 views

How to suppress PAM audit logs for RHEL8?

I have a system that is getting a ton of audit traffic for a particular account we will call 'redacted'. The logs are showing this account executing the su command. My first instinct was to check the ...
user avatar
0 votes
1 answer
40 views

Cannot login after enabling pam_faillock module

I am running Ubuntu 20.04 LTS. I enable the pam_faillock module by adding the following two lines in the /etc/pam.d/common-auth file. auth [default=die] pam_faillock.so authfail ...
user avatar
  • 3
-4 votes
1 answer
54 views

Please help me in figuring out What does this command do?

I saw a command to fix issues while running cron jobs on stackoverflow. https://stackoverflow.com/questions/21926465/issues-running-cron-in-docker-on-different-hosts I am ntsure what exactly this ...
user avatar
0 votes
0 answers
15 views

HP ZCentral Remote Boost Opening Session for Users with Expired Password

I am using HP ZCentral Remote Boost Version 20.1.2.8161 on RHEL 7.9. Current behavior: When an LDAP user (free IPA) with an expired password authenticates (using their expired password) via the HP ...
user avatar
  • 921
1 vote
2 answers
31 views

Clarification of pam rule with `success=3`

I'm trying to configure pam_ssh_agent_auth.so to provide some users a password-less experience using sudo, when authenticating via ssh pubkey. I started looking at the gentoo wiki, which suggests to ...
user avatar
  • 35
0 votes
0 answers
55 views

pam_radius_auth all radius servers failed to respond

I am trying to integrate Radius server 3.0.13 with SSHD so I can enable 2FA. The SSH server is RHEL 8.5. All the time getting error pam_radius_auth all radius servers failed to respond. In my SSH ...
user avatar
0 votes
0 answers
26 views

RHEL 6 Password policy

I've setting my password policies in RHEL 6 using pam_passwdqc. This is what I've set into system-auth & password-auth files: password requisite pam_passwdqc.so min=disabled,disabled,disabled,...
user avatar
2 votes
0 answers
80 views

Is pam_krb5 affected by Active Directory kerberos changes due to CVE-2021-42287?

I use pam_krb5 to authenticate Linux users against a Microsoft Active Directory. Due to CVE-2021-42287, Microsoft is pushing out updates that will change the way kerberos works in AD. Microsoft's ...
user avatar
1 vote
0 answers
31 views

How to purposefully delay the `account` PAM phase?

My OpenSSH server is getting bombarded with dictionary attacks on usernames, and instead of using pam_tally2, fail2ban or similar (or the frankly just ugly suggestion of "change the port" ...
user avatar
  • 111
0 votes
0 answers
35 views

Making multiple PAM modules work together with success as soon as any of them return successfully

I basically want to unlock any sudo authentication with any of these criteria met (whatever completes first successfully): a usb as a security key matched (custom script). fingerprint matched. ...
user avatar
1 vote
1 answer
75 views

how to use a custom PAM before asking for a password in the login screen (Fedora 35)

I have developed a PAM module to use my fingerprint scanner for login. I tested it in ubuntu 18. in Ubuntu, I changed the /etc/pam.d/common-auth file and added this line at the first line: auth ...
user avatar
  • 11
2 votes
0 answers
38 views

Infrequent kerberos authentication issue (pam_krb5 vs. pam_unix)

My Linux computer belongs to a company network using a windows domain. The authentication is done using kerberos. Usually the authentication works fine and I am happy with my linux desktop. But ...
user avatar
  • 147
1 vote
0 answers
33 views

Best practices permissions for /etc/pam.d/sshd

What are the best recommendations for file permissions for /etc/pam.d/sshd? I currently have 0644/-rw-r--r-- root:root and was wondering if it's a good ideea to go to 600. Disclaimer: I use yubikeys ...
user avatar
0 votes
1 answer
47 views

Add parameter to existing config file if present

Using a script I want to modify the /etc/pam.d/common-session file based on the existing value: if session required pam_mkhomedir.so exist, then add skel=/etc/skel/ umask=0022 if it's not ...
user avatar
  • 3
3 votes
0 answers
151 views

set sshd SELinux security context

I'm working on my custom board and on my custom UNIX-like O.S. . When I connect using ssh and no root users a receve this SELinux error: A valid context for could not be obtained. where user is not ...
user avatar
  • 31
0 votes
1 answer
109 views

What's the difference between use_authtok and try_first_pass or use_first_pass in pam_unix?

The documentation for try_first_pass and use_first_pass sounds reasonable enough: try_first_pass Before prompting the user for their password, the module first tries the ...
user avatar
0 votes
0 answers
170 views

error: PAM: User account has expired for [user] from [IP]

I am currently trying to setup libpam-google-authenticator for 2FA on a Debian 9.0 VPS. I've installed the package using apt, set it up using the google-authenticator command and connected it to a ...
user avatar
  • 1
0 votes
2 answers
62 views

su issues for non-root user if SELinux is on

I have a common user on my RHEL 7.6 server and when SELinux is off, su command works for it. But when SElinux is on, su command doesn't work anymore. In the PAM sources I found that #ifndef ...
user avatar
  • 259
0 votes
0 answers
84 views

pam_fprint_enroll no devices detected dell xps 15 9510

I am trying to get the fingerprint sensor to work on the dell xps 15 9510 running a fresh install of arch linux. After following these instructions I am able to use fprint_enroll to add prints to the ...
user avatar
  • 111
1 vote
1 answer
176 views

Switch password/fingerprint authentication on lid behaviour

I set the fingerprint authentication as default for login and sudo commands. On 3 failures or no fingerprint detection for 10 seconds, password auth is required. When working with lid closed (external ...
user avatar
1 vote
0 answers
238 views

Fingerprint sensor not working on Ideapad Slim 5 although support is mentioned on fprint's website

The support for the fingerprint reader device I use (04f3:0c58 Elan Microelectronics Corp. ELAN:Fingerprint) is available according to this page but when I try to run fprintd-enroll I always get ...
user avatar
  • 45
2 votes
0 answers
300 views

Unsupported option UsePAM even though OpenSSH is PAM-aware

For my ARM-based Linux system, I crosscompiled OpenSSH, as I need to have a ssh server. In my sshd_config file I set the UsePAM option to yes, because I want to use PAM for the authentication (I need ...
user avatar
0 votes
0 answers
636 views

samba access denied: "session closed for user nobody"

I am seeking to add a Samba share to a host running Linux Mint. Desired features of the share are discoverability of the host and share through broadcast, accessibility of files only by users with ...
user avatar
  • 162
0 votes
0 answers
21 views

Password policy with pam_tally2 and 6 ssh password prompts

I'm trying to configure a password policy on an embedded Linux distro. I want to have a 30 seconds cooldown after 3 failed login attempts. Therefore, I added in the common-auth file the last line, ...
user avatar
  • 351
0 votes
0 answers
145 views

can't login to arch permission denied

I'm getting an error when I'm trying to login to linux from a tty or ly it says "permission denied" and prompt me to enter credentials again, even with root account I'm getting the same ...
user avatar
3 votes
1 answer
574 views

How to disable fingerprint authentication when laptop lid is closed?

I recently managed to make fingerprint authentication work on my laptop, thanks to the Goodix Linux Development discord community and the github users Infinytum and Michael Teuscher on the driver/...
user avatar
  • 2,887
0 votes
1 answer
64 views

Accounting with pam_radius

How can Implement accounting on a unix system using pam_radius ? pam_radius configuration is easy for authentication. But I confused to find a way for accounting. In accounting we send some AVP's to ...
user avatar
2 votes
1 answer
110 views

Accept both MD5 and SHA512 hashes is /etc/shadow

recently upgraded debian server with many users to a recent version. The old server used MD5 password hashes (the shadow passwords begin with $1$) and new one is configured to use SHA-512. I want to ...
user avatar
  • 21
1 vote
0 answers
49 views

How to configure /etc/pam.d/sshd and nsswitch.conf in order to avoid all remote calls for ssh with local user?

I have created an NSS and a PAM module in order to authenticate and get users and groups from a custom remote server. In order to get them used by the system I am adding a line in /etc/pam.d/sshd: ...
user avatar
  • 11
0 votes
0 answers
34 views

Apache PAM Credential Caching

I use FreeIPA Authentication on Apache via PAM. I am trying to enable credential caching for PAM, however socache does not cache PAM Credentials. I have tested socache using local accounts in htpasswd ...
user avatar
0 votes
0 answers
25 views

User not getting forced to change password

Any one has idea why user don't get prompted to change password after running below command on user account chage -d 0 user
user avatar
1 vote
0 answers
46 views

How to force user to change VNC password without leaving him any way to elude the rule?

I need to find a way to force all users to periodically change their VNC display password. I do the same thing for the users' linux credentials using chage command, and i noticed that when the user ...
user avatar
1 vote
0 answers
69 views

PAM guru help to interpret system-auth password-auth RHEL 7

I have a RHEL 7.9 system which currently has identical system-auth and password-auth files located under /etc/pam.d/. That file is auth required pam_faillock.so preauth audit deny=3 ...
user avatar
  • 4,121
0 votes
0 answers
310 views

sudo: PAM authentication error: Failure setting user credentials

I am not able to run sudo command. Every time i run with sudo I get the PAM error, Failure setting user credentials. > sudo su [sudo] password for userX: sudo: PAM authentication error: Failure ...
user avatar
  • 101
0 votes
1 answer
193 views

systemd-homed with FIDO2 - Login from tty still possible with password only

I recently tried out systemd-homed and doing that I enrolled my Yubikey as FIDO2 device. When i try to authenticate against the created home via homectl authenticate <user> it correctly ...
user avatar
  • 95
2 votes
2 answers
2k views

X11 connection rejected because of wrong authentication

First of all what I want to do: I want to login to a server via ssh. Then change change the user via sudo su user and start some application on my screen. Some collegues do it by su user export ...
user avatar
  • 123
6 votes
3 answers
5k views

sshd: what are the practical effects of setting "UsePAM no"

in /etc/ssh/sshd_config, PAM is enabled by default on Debian 10: UsePAM yes In a situation when I don't want to allow login with password or kerberos, and only want to allow SSH key authentication, ...
user avatar
0 votes
1 answer
94 views

What's the difference between lock_time and unlock_time in pam_tally2?

I realize that pam_tally2 is deprecated in favor of pam_faillock, but I have to use it anyway. What I don't get is the difference between these two options. They sound identical to me: ...
user avatar
1 vote
1 answer
1k views

Use fingerprint reader for everything but first login

I want to make efficient use of the fingerprint reader on my laptop. I was able to configure fingerprint reading through fprint and PAM (using the steps described in the second comment here), but I've ...
user avatar
  • 113
1 vote
0 answers
106 views

Fully replace sssd->ldap with web APIs in Linux

My organization has to get rid of their ldap servers, so I am facing the task of replacing it's functionality. To make this as customizable and future-proof as I can, I am looking for something that ...
user avatar
  • 11
0 votes
0 answers
128 views

AD authentication failure Ubutnu || Access denied for user 4 (System error)

Facing this issue tried all the steps available online, but still having issue. need some expert solutions. ssh -vvv view OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017 debug1: Reading configuration ...
user avatar
  • 2,953
1 vote
0 answers
164 views

How to allow SSH-key-based login (only) via pam rules

I am trying to allow an application to log in using only an SSH key (no password required). The application is a backup/restore system called Veeam. It uses vmtoolsd to log in in stead of SSH / SCP. ...
user avatar
0 votes
1 answer
52 views

Where to put script in pam.d file?

I'm trying to add a script that will take a picture when someone unlocks my machine, as per this question. Right now, I have fprint setup so that I can unlock using my fingerprint - the line auth ...
user avatar
1 vote
1 answer
74 views

It's possible to restrict access with PAM based on groups?

I was wondering if it's possible to create a rule in /etc/security/time.conf in which you restrict users to log in not just by username but instead by the group they belong to.
user avatar
3 votes
0 answers
77 views

can not delete file with root in /etc/pam.d directory

can not delete file in /etc/pam.d directory with root user on centos7.7 system,please help work out this problem. #rm -f /etc/pam.d/2.txt rm: cannot remove ‘/etc/pam.d/2.txt’: Permission denied ...
user avatar
1 vote
0 answers
269 views

Unix PAM module fails on login/lock screen - Permission denied - exit code 13

How it works? I'm back with yet another issue I can't figure out by myself. Basically what I have is 2 factor authentication (2FA) module based on Python PAM and with NFC card reader. Once user is ...
user avatar
1 vote
0 answers
315 views

Why is `pam_nologin.so` denying access despite no existence of `/etc/nologin`?

After A lot of searching, I managed to debug a PAM configuration file, and it turns out the pam_nologin.so module was denying access to my system. Now, this is particularly strange since, according to ...
user avatar
1 vote
1 answer
52 views

what is the meaning of backslash in /etc/security/limits.conf

/etc/security/limits.conf looks like this #<domain> <type> <item> <value> # #* soft core 0 #* hard rss ...
user avatar
  • 10.9k

1
2 3 4 5
12