Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

0
votes
1answer
40 views

sshd[5589]: error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session

I am working with a CentOS7 minimal install. I configured pam_radius with pam_script and was always able to ssh to the server using pubkey auth: that was on purpose. But after hardening the server ...
3
votes
2answers
57 views

How to show “number of failed login attempts” on a successful ssh login?

I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this: Last failed ...
0
votes
0answers
7 views

Configure pam_mount to suppress error output

I'm using pam_mount on Ubuntu 18.04 for mount CIFS shares. It works, but because it's called via 'common-session' pam_mount called during 'su -' and in this case it fails. I have no problem with that ...
0
votes
0answers
17 views

libpam-shield config allow certain IP addresses

libpam-shield's config file /etc/security/shield.conf has a line that says allow HOSTNAME. The man pages for shield.conf(8) says that HOSTNAME can be name, or IP address or network/mask or network in ...
3
votes
1answer
36 views

PAM error after uninstalling pam_shield.so

I would like to know the correct procedure to uninstall a PAM module that was installed using apt install. I had "libpam-shield" https://packages.debian.org/stable/admin/libpam-shield installed on a ...
0
votes
0answers
18 views

pam_radius_auth : DEBUG : getservbyname(radius,udp) returned -1217119556 on DEBIAN 9.6

I have two debian servers connected. I set FreeRADIUS on a Debian Server (10.10.10.20). And I'd like the another Debian Server (10.10.10.10) can login locally using the users listed on RADIUS Server. ...
2
votes
0answers
39 views

PAM configuration to execute a shell script on every login failure

I would like to execute my shell script on every login failure. To do this I updated the file /etc/pam.d/common-auth: From (original body): auth required pam_env.so auth required ...
0
votes
0answers
8 views

dm_crypt mount on login takes 90 seconds

I'm trying to configure automounting encrypted home on login with user password=encryption password. I'm using archlinux + kde + sddm + crypsetup (dm_crypt). Following archlinux article I did as ...
0
votes
1answer
21 views

How can I restore login in GDM3 screen? It disappeared after upgrade from Debia 8 to 9, thus GDM3 doesn't starts anymore!

During an upgrade of Debian 8 to 9 I was asked about PAM Modules package installation. How i didn't knew the correct answer, I choosed option 1. Unix Authentication. Now the GDM3 doesn't starts ...
1
vote
0answers
13 views

Use pam_unix if pam_userdb failed

I would like to use a pin to easily log in to my system, as my password is pretty complex. The pin works, but I would also like to have the password as fallback. Here's how I'd like it to be: ...
1
vote
0answers
136 views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
0
votes
0answers
67 views

SSHD Denies access with password + google-authenticator combo

I am running ProxMox 5.3 (Debian 9 stretch) Hypervisor and I want to secure SSH access to the hypervisor. I have followed the documentation found here for adding MFA to openssh, however I have made ...
0
votes
0answers
33 views

PAM tweaks to enable login with blank password from console on CentOS 7.6.1810

I am writing an application that forces the user to change his password after the first login. I set a blank password for this admin user with passwd -d admin and verified that no password was set ...
3
votes
1answer
88 views

How to configure a shutdown at the xth wrong entered password?

Having an encrypted hard drive is all well and good, but chances are that if someone is gonna steal your laptop, it’s probably not going to be turned off. Most likely, it will be stolen in a powered-...
0
votes
0answers
44 views

pam_systemd failed to create session: Start job for unit user@1000.service failed

I am simply trying to log in via console to my laptop because Gnome isn't booting on my 18.10 Ubuntu machine. I enter my username and password and the login fails. In auth.log I see: login[2425]: ...
1
vote
0answers
8 views

Setting mount options for PAM mounted ecryfptfs

Is there any way of using (for example) the lazytime mount option with ecryptfs if it's automatically mounted by PAM when you login?
0
votes
0answers
70 views

Add all users in AD-Group to the local wheel group

We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group. The users that we want to permit to use the program 'su' are ...
2
votes
1answer
42 views

Switch to root user always failed after modifying /etc/pam.d/common-password

I'm using ubuntu 18.04. To strengthen my pass-word policy I modify my /etc/pam.d/common-password like this: # here are the per-package modules (the "Primary" block) #password requisite ...
0
votes
0answers
42 views

How to start services (or targets) inside a session scope?

I use systemd to start most of my processes for a desktop session: xmonad (the window manager), emacs daemon, a tmux session, etc. Listing my users processes with loginctl user-status consequently ...
0
votes
1answer
15 views

LDAP per-user overrides

I'm using openldap + nslcd to connect to a LDAP server for authentication of some users (these users would want their passwords and most of their configuration shared over many devices). I don't ...
0
votes
1answer
36 views

How PAM determines system password and 2FA OTP

I configured freeradius+google auth otp Below are content of /etc/pam.d/radiusd auth requisite pam_google_authenticator.so forward_pass auth required pam_unix.so use_first_pass I was wondering how ...
3
votes
1answer
94 views

Running a script prior to ssh login … but only once

I'm hoping someone can offer some insight on this problem, I found a solution to execute a script before an ssh login. It was done by placing the following line within /etc/pam.d/sshd and allowing pam ...
0
votes
0answers
57 views

Give root's permission to restricted user using PAM and Linux capabilities

I want to give root's permission (or root account) to my test's user not using wheel-group or sudoers on CentOS 7. Instead I would like to use module pam_cap.so and linux capabilities. I try this: ...
1
vote
1answer
61 views

pam_cracklib setting min password length

I am experimenting with PAM and, in particular, pam_cracklib at the moment. I've run into a bit of a problem setting min password length and credit for particular character types. My config file for ...
0
votes
1answer
50 views

Install PAM(Pluggable Authentication Modules) in Slackware 14.2

PAM (Pluggable Authentication Modules) is a service that implements modular authentication modules. PAM is implemented as a set of shared objects that are loaded and executed when a program needs to ...
0
votes
0answers
112 views

Freeipa client on debian 9 - Cannot find user error

EDIT 1: added solution, pam was faulty i'm trying to set up freeipa client on debian 9 client using this guide: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
0
votes
0answers
23 views

PAM successful authentication limits

I have a question regarding PAM and the possibility that it throttles too many 'auth' attempts if they happen in a short time. Long story short: I am not seeking to increase the number of attempts ...
1
vote
1answer
24 views

Solaris 11 - PAM application

I'm trying to compile an application which interacts with the PAM system on Solaris 11, however everytime I try compile the code I get "fatal error: security/pam_appl.h: No such file or directory" ...
0
votes
3answers
230 views

PAM doesn't block my account after 5 failed logins

I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file : #%...
5
votes
2answers
469 views

Cron is trying (and failing) to open env file: /etc/environment

I'm using Devuan ASCII (which is more or less Debian 9, Stretch). Now, my /var/log/auth.log has a bunch of these entries: Jan 6 09:45:01 mybox CRON[20951]: pam_env(cron:session): Unable to open env ...
1
vote
0answers
44 views

pam_unix Module Not Allowing Random String Passwords in Ubuntu 18.10

I just installed Ubuntuy 18.10 on one of my computers, and am trying to understand why a series of passwords are not working, even though they are completely random character strings. I started by ...
1
vote
1answer
112 views

Centos PAM can't start httpd.service

I have OS CentOS Linux release 7.6.1810 (Core). I try just start almost pure httpd.service. I run command: systemctl start httpd.service I try run this from my user and from root - it is not ...
3
votes
0answers
111 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
3
votes
1answer
205 views

How to block shutdown or reboot in Debian xfce when other users logged in

I want to prevent users to start shutdown or reboot when another user is logged in. Users can be a TTY user (Ctrl+Alt+F3) or a ssh user from a client host. In OpenBSD, I use polkit org.xfce.session....
-2
votes
1answer
88 views

PAM conf files are insecure! [closed]

PAM configuration files located in /etc/pam.d/ are vulnerable to physical attack. That is they can be modified from an external system (bootable USB or take drive to another machine) Other than ...
2
votes
1answer
35 views

Password history restrictions are written to in system-auth(-ac), but not password-auth(-ac). Why, when every other policy gets written to both?

According to this STIG, password history is entered into /etc/pam.d/system-auth, but not /etc/pam.d/password-auth. Other policies, for example, account lockouts are applied to both files. Why isn't ...
1
vote
0answers
53 views

PAM File Modification for Google Authenticator

i use the google authenticator for the ssh authentication, but i use a publickey + authenticator or a password + authenticator (when no publickey is defined it should be ask only for password, but i ...
1
vote
2answers
879 views

fingerprint-gui on Linux Mint 19 “Tara” cinnamon works but not on first boot or in software center

On my Lenovo Thinkpad X1 Carbon 3rd. Gen., fingerprint-gui works fine when locking the screen or requesting sudo in terminal. It doesn't work when I freshly boot up the system at first login, and it ...
2
votes
1answer
37 views

Allow PAM module to always access a root only file

I have a custom PAM module that needs to access some sensitive information on the hard disk to perform its job. These files would ideally be stored with root access permissions only. I've been ...
0
votes
0answers
85 views

Require a yubikey AND (publickey OR password) for SSHD auth

I am attempting to configure OpenSSH on a Debian based system to always require a yubikey TOTP AND either a publickey OR password. I realise other combinations are possible through ...
0
votes
1answer
185 views

ssh & local root login works with invalid password in Debian 9

I am trying to login to Debian 9 machine with root username, locally and through ssh.  It logs in with any invalid password.  I want to access the machine with the correct password only.  Why does an ...
2
votes
0answers
94 views

Pam.d three files lightdm, lightdm-greater, lightdm-auth

What are the differences in the three files located in /etc/pam.d /etc/pam.d/lightdm-greeter /etc/pam.d/lightdm-auth /etc/pam.d/lightdm I assume they each serve a different role, what do they do?
1
vote
3answers
456 views

How is sendmail SMTP authentication logging controlled?

I get a ton of failed SMTP login attempts. I'd really like to defend against it, but the logging of those attempts is poor. I'm using sendmail 8.15, cyrus-sasl 2.1.26. The SASL setup is the simplest ...
0
votes
2answers
44 views

Unable to Login to Wok on Fedora Server 27 - Python and PAM

I just setup WOK and can't login via my root uname/pwd. I found a ticket on Github with a "solution" but I have no idea how to implement it. Does anybody have an idea how to translate this into ...
1
vote
1answer
42 views

Send an email when an incorrect password is entered

On the Debian workstations at work that I administrate I get an email whenever somebody tries to call sudo with the exact command that they have tried, the machine and their username. This is really ...
1
vote
2answers
147 views

why Linux server do not ask password in single user mode

Why doesn't RHEL server ask for a password in single user mode? Red Hat Enterprise Linux Server release 6.6 (Santiago), in case it's relevant. I had many cases where I had to reset root password in ...
0
votes
0answers
156 views

For rotating logs- Cronjob issue

Invoking logrotate every 15 mins. logrotate will rotate only after size threshold crosses 1M Working machine [root@machine1 output]# ls -l --block-size=1K total 296 -rw------- 1 root root 55 Oct ...
0
votes
1answer
76 views

directory listing command error after install google-authenticator on CentOS 7

Status CentOS 7.5.1804 (Core) Linux 3.10.0-862.14.4.el7.x86_64 Problem After I installed and setting google-authenticator packages, weird authentication related message keep shown when I use ...
6
votes
2answers
250 views

setting sudo password different from login password

I am attempting to use PAM to use a different password for sudo than I do for logging in. I worked off of this post originally Set sudo password differently from login one Unfortunately, every time ...
1
vote
1answer
538 views

GNOME: Different PAM configurations for lockscreen vs login

I recently purchased a U2F security key, and I have successfully configured my Ubuntu 18.04 machine to require authentication via the key as well as my usual password to log in. I am hoping to change ...