Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

0
votes
0answers
18 views

SSHD Denies access with password + google-authenticator combo

I am running ProxMox 5.3 (Debian 9 stretch) Hypervisor and I want to secure SSH access to the hypervisor. I have followed the documentation found here for adding MFA to openssh, however I have made ...
0
votes
0answers
29 views

PAM tweaks to enable login with blank password from console on CentOS 7.6.1810

I am writing an application that forces the user to change his password after the first login. I set a blank password for this admin user with passwd -d admin and verified that no password was set ...
3
votes
1answer
74 views

How to configure a shutdown at the xth wrong entered password?

Having an encrypted hard drive is all well and good, but chances are that if someone is gonna steal your laptop, it’s probably not going to be turned off. Most likely, it will be stolen in a powered-...
0
votes
0answers
22 views

pam_systemd failed to create session: Start job for unit user@1000.service failed

I am simply trying to log in via console to my laptop because Gnome isn't booting on my 18.10 Ubuntu machine. I enter my username and password and the login fails. In auth.log I see: login[2425]: ...
1
vote
0answers
7 views

Setting mount options for PAM mounted ecryfptfs

Is there any way of using (for example) the lazytime mount option with ecryptfs if it's automatically mounted by PAM when you login?
0
votes
0answers
25 views

Add all users in AD-Group to the local wheel group

We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group. The users that we want to permit to use the program 'su' are ...
2
votes
1answer
29 views

Switch to root user always failed after modifying /etc/pam.d/common-password

I'm using ubuntu 18.04. To strengthen my pass-word policy I modify my /etc/pam.d/common-password like this: # here are the per-package modules (the "Primary" block) #password requisite ...
0
votes
0answers
23 views

How to start services (or targets) inside a session scope?

I use systemd to start most of my processes for a desktop session: xmonad (the window manager), emacs daemon, a tmux session, etc. Listing my users processes with loginctl user-status consequently ...
0
votes
1answer
11 views

LDAP per-user overrides

I'm using openldap + nslcd to connect to a LDAP server for authentication of some users (these users would want their passwords and most of their configuration shared over many devices). I don't ...
0
votes
1answer
18 views

How PAM determines system password and 2FA OTP

I configured freeradius+google auth otp Below are content of /etc/pam.d/radiusd auth requisite pam_google_authenticator.so forward_pass auth required pam_unix.so use_first_pass I was wondering how ...
3
votes
1answer
71 views

Running a script prior to ssh login … but only once

I'm hoping someone can offer some insight on this problem, I found a solution to execute a script before an ssh login. It was done by placing the following line within /etc/pam.d/sshd and allowing pam ...
0
votes
0answers
39 views

Give root's permission to restricted user using PAM and Linux capabilities

I want to give root's permission (or root account) to my test's user not using wheel-group or sudoers on CentOS 7. Instead I would like to use module pam_cap.so and linux capabilities. I try this: ...
1
vote
1answer
42 views

pam_cracklib setting min password length

I am experimenting with PAM and, in particular, pam_cracklib at the moment. I've run into a bit of a problem setting min password length and credit for particular character types. My config file for ...
0
votes
1answer
30 views

Install PAM(Pluggable Authentication Modules) in Slackware 14.2

PAM (Pluggable Authentication Modules) is a service that implements modular authentication modules. PAM is implemented as a set of shared objects that are loaded and executed when a program needs to ...
0
votes
0answers
60 views

Freeipa client on debian 9 - Cannot find user error

EDIT 1: added solution, pam was faulty i'm trying to set up freeipa client on debian 9 client using this guide: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
0
votes
0answers
21 views

PAM successful authentication limits

I have a question regarding PAM and the possibility that it throttles too many 'auth' attempts if they happen in a short time. I have posted my question on the PAM mailing list, but to no avail. I ...
1
vote
1answer
23 views

Solaris 11 - PAM application

I'm trying to compile an application which interacts with the PAM system on Solaris 11, however everytime I try compile the code I get "fatal error: security/pam_appl.h: No such file or directory" ...
0
votes
3answers
129 views

PAM doesn't block my account after 5 failed logins

I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file : #%...
4
votes
2answers
404 views

Cron is trying (and failing) to open env file: /etc/environment

I'm using Devuan ASCII (which is more or less Debian 9, Stretch). Now, my /var/log/auth.log has a bunch of these entries: Jan 6 09:45:01 mybox CRON[20951]: pam_env(cron:session): Unable to open env ...
1
vote
0answers
41 views

pam_unix Module Not Allowing Random String Passwords in Ubuntu 18.10

I just installed Ubuntuy 18.10 on one of my computers, and am trying to understand why a series of passwords are not working, even though they are completely random character strings. I started by ...
1
vote
1answer
87 views

Centos PAM can't start httpd.service

I have OS CentOS Linux release 7.6.1810 (Core). I try just start almost pure httpd.service. I run command: systemctl start httpd.service I try run this from my user and from root - it is not ...
3
votes
0answers
72 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
3
votes
1answer
159 views

How to block shutdown or reboot in Debian xfce when other users logged in

I want to prevent users to start shutdown or reboot when another user is logged in. Users can be a TTY user (Ctrl+Alt+F3) or a ssh user from a client host. In OpenBSD, I use polkit org.xfce.session....
-2
votes
1answer
83 views

PAM conf files are insecure! [closed]

PAM configuration files located in /etc/pam.d/ are vulnerable to physical attack. That is they can be modified from an external system (bootable USB or take drive to another machine) Other than ...
2
votes
1answer
25 views

Password history restrictions are written to in system-auth(-ac), but not password-auth(-ac). Why, when every other policy gets written to both?

According to this STIG, password history is entered into /etc/pam.d/system-auth, but not /etc/pam.d/password-auth. Other policies, for example, account lockouts are applied to both files. Why isn't ...
1
vote
0answers
45 views

PAM File Modification for Google Authenticator

i use the google authenticator for the ssh authentication, but i use a publickey + authenticator or a password + authenticator (when no publickey is defined it should be ask only for password, but i ...
1
vote
2answers
563 views

fingerprint-gui on Linux Mint 19 “Tara” cinnamon works but not on first boot or in software center

On my Lenovo Thinkpad X1 Carbon 3rd. Gen., fingerprint-gui works fine when locking the screen or requesting sudo in terminal. It doesn't work when I freshly boot up the system at first login, and it ...
2
votes
1answer
28 views

Allow PAM module to always access a root only file

I have a custom PAM module that needs to access some sensitive information on the hard disk to perform its job. These files would ideally be stored with root access permissions only. I've been ...
0
votes
0answers
70 views

Require a yubikey AND (publickey OR password) for SSHD auth

I am attempting to configure OpenSSH on a Debian based system to always require a yubikey TOTP AND either a publickey OR password. I realise other combinations are possible through ...
0
votes
1answer
125 views

ssh & local root login works with invalid password in Debian 9

I am trying to login to Debian 9 machine with root username, locally and through ssh.  It logs in with any invalid password.  I want to access the machine with the correct password only.  Why does an ...
2
votes
0answers
58 views

Pam.d three files lightdm, lightdm-greater, lightdm-auth

What are the differences in the three files located in /etc/pam.d /etc/pam.d/lightdm-greeter /etc/pam.d/lightdm-auth /etc/pam.d/lightdm I assume they each serve a different role, what do they do?
1
vote
3answers
344 views

How is sendmail SMTP authentication logging controlled?

I get a ton of failed SMTP login attempts. I'd really like to defend against it, but the logging of those attempts is poor. I'm using sendmail 8.15, cyrus-sasl 2.1.26. The SASL setup is the simplest ...
0
votes
2answers
37 views

Unable to Login to Wok on Fedora Server 27 - Python and PAM

I just setup WOK and can't login via my root uname/pwd. I found a ticket on Github with a "solution" but I have no idea how to implement it. Does anybody have an idea how to translate this into ...
1
vote
1answer
39 views

Send an email when an incorrect password is entered

On the Debian workstations at work that I administrate I get an email whenever somebody tries to call sudo with the exact command that they have tried, the machine and their username. This is really ...
1
vote
2answers
127 views

why Linux server do not ask password in single user mode

Why doesn't RHEL server ask for a password in single user mode? Red Hat Enterprise Linux Server release 6.6 (Santiago), in case it's relevant. I had many cases where I had to reset root password in ...
0
votes
0answers
128 views

For rotating logs- Cronjob issue

Invoking logrotate every 15 mins. logrotate will rotate only after size threshold crosses 1M Working machine [root@machine1 output]# ls -l --block-size=1K total 296 -rw------- 1 root root 55 Oct ...
0
votes
1answer
68 views

directory listing command error after install google-authenticator on CentOS 7

Status CentOS 7.5.1804 (Core) Linux 3.10.0-862.14.4.el7.x86_64 Problem After I installed and setting google-authenticator packages, weird authentication related message keep shown when I use ...
6
votes
2answers
237 views

setting sudo password different from login password

I am attempting to use PAM to use a different password for sudo than I do for logging in. I worked off of this post originally Set sudo password differently from login one Unfortunately, every time ...
1
vote
1answer
372 views

GNOME: Different PAM configurations for lockscreen vs login

I recently purchased a U2F security key, and I have successfully configured my Ubuntu 18.04 machine to require authentication via the key as well as my usual password to log in. I am hoping to change ...
0
votes
0answers
48 views

case-preserving linux usernames and hostnames

Is there a way to set pam library to do case-preserving username validation? Is there a way to set useradd command to accept and preserve the case of usernames? I know usernames and URLs are not OS ...
0
votes
2answers
924 views

PAM Authentication Errors for one username. All other usernames log in properly

Red Hat Enterprise Linux 6.10 in VMWare virtual machine. We have several user accounts defined. One user account (user3) is unable to log in, either through SSH or the VMWare Console. It has logged in ...
0
votes
1answer
291 views

How to omit PAM log messages for specific user (pam_succeed_if quiet)

I'm using a monitoring agent (telegraf) to monitor fail2ban. Unfortunately, it requires SuperUser rights to execute fail2ban-client, which causes 24 system log messages every 10 seconds... Do the math,...
3
votes
0answers
219 views

Fedora 28: Generate kerberos ticket on login

I'm trying to generate kerberos ticket when I login on my computer(Fedora 28). I want to achieve it using PAM. my /etc/pam.d/system-auth looks like this: auth required ...
1
vote
1answer
271 views

PAM account interface vs /etc/shadow

According to the official Red Had documentation on pam for the account interface: account — This module interface verifies that access is allowed. For example, it checks if a user account has ...
1
vote
1answer
278 views

Deleted /etc/pam.d/common

I deleted all common-* files in /etc/pam.d folder and now I am locked out. I am running Ubuntu 14.04. I did backup all these files in a folder inside pam.d but now I can't even move them. If I try, ...
1
vote
1answer
373 views

password length with pam_cracklib.so

I ran a security scan in a RedHat Linux Server and got the following vulnerabilty: Incorrect System Default minimum password length or password complexity rules. Minimum password length should be ...
0
votes
1answer
29 views

Right place for user specific enviroment variables if you don't use a display manager

I recently purged my display manager in favor of starting xsessions with startx. I did this after setting up a new installation of ubuntu 18.04. Up to now I was used to use ~/.pam_environment to set ...
1
vote
0answers
20 views

Is it possible to pull additional info from LDAP during pam_ldap authentication?

I have additional ldap data that I'd like to store in the user's home when they first log into a client using pam_ldap. However, I can't seem to think of a way to make this work without prompting the ...
1
vote
1answer
280 views

Authenticate Linux<->LDAP Protocol<->AD(active directory): Fail to logon with password

Dears, I spent much time on this and even successfully verified (Auth)Linux-LDAP-openLDAP ok. But get blocked with AD.I can now switch to user from root account but can not log on with password(...
0
votes
0answers
47 views

journalctl -f is spamming “cannot create session” and “session opened for root user”, how can I get it to stop/fixed?

I'm using fedora 28. I don't understand why I'm getting these messages and would love some help so I can use journalctl -f for other things. This is a fresh terminal window and I hadn't tried su ...