Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

PAM fingerprint login blocks password

Is there a way to make PAM run authentication modules in parallel? For all people who use PAM this may be useful. It seems that PAM runs authentication modules in sequence and blocking. What that ...
0
votes
0answers
21 views

Alter Linux username with PAM

So, I have this 3rd party application that uses usernames in the format user@domain. More precisely, it uses the UPN from ActiveDirectory, e.g. john.doe@company.local. That’s fine in this application. ...
0
votes
0answers
8 views

Allow LDAP login for selected users only on SLES 12 SP 5

I have configured a LDAP Client on SLES 12 SP5. Now I want to allow only a selected group of users to login to the system. This group comprises 2 or 3 users. For all other users login must be ...
2
votes
0answers
16 views

OpenSSH U2F as second factor with fallback to Google Authenticator

We use Google Authenticator for 2FA SSH logins. It's configured in /etc/pam.d/sshd as follows: @include common-password auth required pam_google_authenticator.so nullok As you may know, OpenSSH 8.2 ...
1
vote
1answer
69 views

sudo -i and ~/.pam_environment

I have switched to using ~/.pam_environment for setting my user environment variables, and it works quite well. PAM takes care of setting everything, regardless of what shell I'm using, how I'm using ...
0
votes
0answers
18 views

Run login user through PAM before systemd-user

My user@.service does not start properly due to /etc/pam.d/systemd-user failing to provide a password interactively (of course) to pam_mount; so consequently paths it needs are missing. # pam.d/...
1
vote
0answers
92 views

CentOS 7.7 - sudo: PAM account management error: Permission denied

We have a CentOS 7.7 system which is joined to a Microsoft AD domain using realmd/sssd. Sudo does work perfectly fine for local system users, however when we attempt to use sudo as an Active Directory ...
0
votes
0answers
39 views

Systemd user units enabled but don't automatically activate, start fine manually

None of my systemd user units start automatically, but activate fine if I systemctl --user start them myself. For example: [Unit] Description=pass db sync [Service] Type=oneshot ExecStart=/bin/bash --...
0
votes
1answer
45 views

Parental password for kid's account

I am one of the many many parents facing the prospect of my two kids spending a whole lot more time in front of the computer screen this fall, due to remote schooling. I have a ubuntu (actually pop_os)...
0
votes
1answer
37 views

what does a dash in front of a pam entry mean?

I have searched everything I can but couldn't find any explanation. My /etc/pam.d/lightdm file contains the following two gnome keyring entries: auth include system-login -auth ...
0
votes
0answers
12 views

i3lock: how to unlock when system-auth has 2fa enabled?

I am running Arch Linux with i3, and have system-wide 2fa for logging in; which is defined in my pam.d/system-auth file. The issue arises when I lock the screen with i3lock, and can't get back in!.. ...
0
votes
1answer
59 views

Get Linux user password into a C program

I am trying to implement a PAM for Linux which gets invoked for sudo operations, the purpose of it is to ask the user for SMS sent to his mobile right after he enters a password when performing sudo ...
3
votes
0answers
17 views

force specific shell environment variable on process using /etc/pam.d/ rules

I am using slim login manager, and it has its own pam rules file: /etc/pam.d/slim. auth requisite pam_nologin.so auth required pam_env.so readenv=1 auth required pam_env....
0
votes
0answers
31 views

Automount zfs on login, auto unmount on logoff

What I want I want to login (ssh, gdm, or any other way) and have my zfs datasets mounted with my login password. I don't want to have to type in my password a second time. When I log off I want the ...
0
votes
0answers
15 views

Systemd --user services not starting since enabling pam_mount

Since using pam_mount to encrypt my home directory, units enabled in ~/.config/systemd/user are no longer starting on login. I believe (but haven't tested) that this can be resolved with loginctl ...
0
votes
0answers
22 views

What dependencies pam_tty_audit.so requires to properly work?

I am trying to set up auditing on a server that multiple users are able to log in to and I saw examples of the USER_TTY message type of auditd. I have set up auditd rules and I would like to configure ...
0
votes
1answer
79 views

pam_get_uid; no such user

I am seeing this error when an app server is trying to access to a postgres database on the RHEL 6 server. authentication: pam_succeed_if(postgresql:auth): error retrieving information about user svc-...
1
vote
0answers
23 views

SELinux preventing write access to files

I have written a PAM module. This PAM module is loaded by processes gdm-password and gnome-screensaver (found on RHEL 6.4). The pam module wants to write some logs to a db file under user's home ...
0
votes
0answers
8 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes directly in /etc/shadow, but we ...
0
votes
0answers
13 views

Authentication token manipulation error when not using a tty on recovery mode

I've recently upgraded my dekstop running Pop OS! on the latest LTS version. After the upgrade the system booted to the login screen, not directly to the desktop as it previously was set up to. When I ...
0
votes
0answers
41 views

Why I get user authentication failed error when connecting to my OpenVPN server?

I'm having hard time to get my OpenVPN server working with user authentication using PAM plugin. I want to make so that whenever I try to connect to my OpenVPN server from remote computer I would have ...
0
votes
0answers
25 views

Authentication fails though the password is correct

I have a linux 7.7 machine which is integrated to Windows Active Directory. Also I have a local user "appuser" in the server for managing the application. While I switch to appuser, I am ...
0
votes
0answers
68 views

Should I grant sudo to a user or add CAP_SYS_ADMIN capabilities to use nvprof/ncu? And why?

Since CUDA 10.1, users are required to have sudo privileges to collect advanced metrics with cuda profiling tools such as nvprof or nsight compute (ncu). Alternatives to get around it are described ...
1
vote
0answers
32 views

source .pam_environment file

I'm using the .pam_environment file for some of my global environment settings, but whenever I make a change to the file, I need to log out and log back in again to see the changes since the syntax is ...
0
votes
0answers
32 views

Where is the “delay on a wrong password login” at the KDE login?

Please note this is a "mechanism, not policy" question. That means I do NOT want to discuss security policies, just the mechanism that implements them. I am using the latest Kubuntu 20.04 ...
3
votes
1answer
94 views

How can I limit both pty and non-pty ssh sessions to 'maxlogins'?

I have a normal Linux user that is: only allowed to login via ssh to execute a single command and nothing else may never login more the once at a single time The first restriction is implemented ...
0
votes
0answers
28 views

Setting up disk quotas for every new user account

I'm trying to set up default disk quotas for every new user that gets an account created in my Debian10 server. For example, user1 gets an account created and the first time he logs in the system (...
0
votes
0answers
38 views

How to automatically set quotas/limit for a new user home directory?

I'm using a perl cgi script to create new users in my Debian server through a web portal. Users sing up in my website and their server user is created, using pam_mkhomedir.so module to create their ...
1
vote
0answers
117 views

Understanding /var/log/auth.log in Ubuntu

I am having an hard time understanding some lines inside my auth.log file from Ubuntu. Can you help me breaking down the pieces of this one? pkexec: pam_unix(polkit-1:session): session opened for ...
-1
votes
1answer
23 views

Security considerations for encrypted home dir in case of an untrustworthy root

Heiho, although I have done some manual encrypting using various tools I consider myself a noob. Recently I worked on a tiny project utilizing PAM. Thereby it occurred to me that root can get hold of ...
0
votes
0answers
22 views

Authconfig overwrite the pam module config Centos8

I'm configuring some dictionary passwords to make complexity of the authentication so pushing configuration system-auth(symbolic linked to /etc/authconfig/system-auth) from puppet. After applied ...
1
vote
0answers
59 views

Unable to use AD group names in pam_winbind.conf after recent updates

Since updating my CentOS 7 and RHEL 7 systems I am no longer able to use AD group names in my pam_winbind.conf. I am only able to use SIDS. The package version samba-winbind-4.10.4-11.el7_8:0. I am ...
1
vote
0answers
32 views

How to get ldap/nss/pam to accept usernames beginning with a number: pam_systemd(gdm-password:session): Failed to get user record: Invalid argument

How to get my ldap/pam/nss stack to accept usernames beginning with a number? I am installing LDAP/NSS/PAM with the instructions provided by debian. I have tried both libnss-ldap, and libnss-ldapd ...
0
votes
0answers
33 views

Unlocking keyring with the luks password for the full disk encryption

There is a system with the full LUKS encryption that is also configured for autologin. Q: How can I pass the password used to unlock the LUKS partition to PAM so that automatically unlock the keyring?...
1
vote
1answer
85 views

How to display GUI in PAM module?

I am trying to add a GTK window in PAM module. It works from my test pam app but doesn't work during desktop login or unlock. I see another unanswered question here - https://stackoverflow.com/...
2
votes
1answer
65 views

How to develop fingerprint login for Linux desktop?

I am working on developing an application so that user can login to their Red Hat Enterprise Linux 6.4 desktop using fingerprint. I have the required driver and SDK for the Secugen fingerprint sensor ...
0
votes
0answers
67 views

Typo in /etc/pam.d/sudo and cannot recover from it

I used to have fingerprint authentication support in my /etc/pam.d/sudo file by following this article: https://www.imore.com/how-use-sudo-your-mac-touch-id; however, I made a typo in the file, ...
0
votes
0answers
8 views

invalid option for pam_pwquality

I was going through the PAM settings recently. and came across this in the password-auth and system-auth. password requisite pam_pwquality.so try_first_pass local_users_only retry=3 ...
1
vote
1answer
49 views

Callback when logged on via PAM 2F authentication

Whenever authentication is done via PAM, and the module that successfully completes the login is pam_yubico.so then I want a script to be invoked. e.g: user does sudo: -> user is not configured ...
0
votes
0answers
380 views

Pam_unix sshd authentication failure even though the login works?

I have a server that is configured with winbind and samba to provide active directory authentication. The active directory integration works fine however whenever I authenticate I see the following ...
0
votes
0answers
29 views

FreeBSD - Change user password after SSHing into a Server

I would like to change the user password after having SSHed into a server, but get the following error: passwd Changing local password for passwd: pam_start(): System error What is the ...
0
votes
0answers
19 views

logging into the system using one time passwords which are sent via SMS

I have to implement an additional layer of protection in the system. The user has to log in to the system with the password he received in the text message. I don't know which module I should look for ...
1
vote
0answers
11 views

PAM module: the counter in /var/faillog is never updated

I am trying to find out the number of the failed logins attempts (since last successful login) for any given user. The faillog -a reads the file /var/log/logfail, however the counter remains always ...
1
vote
1answer
41 views

Load testing vsftpd causing high CPU load from unix_chkpwd

I'm working on a proof of concept to replace a samba file share with vsftpd (over TLS). This is not a public file store, and so the need for security is essential. And clients will only write to this ...
0
votes
0answers
154 views

pam_lastlog does not write to /var/log/lastlog

I am using pamela with JupyterHub to open PAM sessions for my users. I am on CentOS 8 and I am using the login service. I can see in /var/log/secure pam_unix(login:session): session opened for ...
2
votes
2answers
320 views

How does id command on linux get user groups or which pam module is used?

We have sssd configuration as follows: id_provider = ad auth_provider = krb5 access_provider = ldap enumerate = false ignore_group_members = true; As you can see, we are not enumerating users and ...
0
votes
0answers
73 views

How to reset PAM files

I was recently trying to set up Yubikey with macOS, and somewhere along the lines, something went wrong. Whenever I use sudo, I get sudo: unable to initialize PAM: No such file or directory. I have ...
0
votes
1answer
89 views

pam_ldap: how to hide password hashes in getent output

My question is similar to this. I use pam_ldap for users auth. /etc/nsswitch.conf file contains: passwd: files ldap group: files ldap shadow: files ldap All seems to be OK, ...
0
votes
1answer
30 views

What is the purpose of the pam_stress module?

There is currently very little documentation for this Linux-PAM module, and I am struggling to understand what it might be used for? Reference The Linux-PAM System Administrators' Guide pam_stress ...
0
votes
1answer
331 views

Disable local user PAM, enable root user with LDAP

I am trying to set up a Linux machine with LDAP authentication and root account enabled. There is no issue with the LDAP server and everything works fine. I wanted to disable local users, so I tried ...

1
2 3 4 5
11