Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
1 vote
3 answers
32 views

How to set default root algorithm to sha512 on Linux?

I can see the content below in /etc/shadow. The root password's hash algorithm is md5, but the test user's is sha512: root:$1$RjnJa1j6$.HbXUfxVzGSSAgSvz52Zm1:19251:0:99999:7::: . . . test:$6$...
  • 11
1 vote
0 answers
17 views

Domains are not found after joining Ubuntu 22.04 to Active Directory using SSSD

Since Ubuntu 20.04 we are using SSSD and realmd to join these server to one of our Active Directory domains. This works (almost) out-of-the-box. For Ubuntu 22.04, however, we run into issues. And I am ...
1 vote
0 answers
9 views

Problems setting with two pam-password-modules in centos at the same time

I would like to prevent the use of last passwords and keeping password complexity. But if I use pam_pwquality.so and pam_pwhistory.so at the same time, it doesn't work properly. For example, I set a ...
0 votes
0 answers
30 views

Xubuntu: XDG_ variables missing

I'm connecting to a remote Xubuntu machine via VNC and since yesterday, I can't run certain applications (e.g. TortoiseHG) any more: remote$ thg QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '...
  • 309
0 votes
0 answers
28 views

what is pam_pkcs11 and how does it work?

yum install pam_pkcs11 https://linux.die.net/man/8/pam_pkcs11 This Linux-PAM login module allows a X.509 certificate based user login. The certificate and its dedicated private key are thereby ...
  • 4,512
0 votes
0 answers
27 views

pam_pwquality.so - BAD PASSWORD

I set up in /etc/pam.d/common-password the password requirements: password [success=1 default=ignore] pam_unix.so sha512 password requisite pam_deny.so password required ...
  • 1
0 votes
0 answers
26 views

restarting service remotely via snmp blocked by selinux/pam on Redhat8

I am having some trouble remotely starting/stopping/restarting a service through snmp. It seems to work fine with SElinux set in permissive but with it in enforcing mode it will fail with this type of ...
1 vote
1 answer
28 views

Change in Pam configuration

I have change the password policy to apply the same for root by "enforce_for_root" and for now it apply the password complexity on root yet after removing the "enforce_for_root" ...
  • 11
0 votes
0 answers
5 views

Elasticsearch in Docker max file descriptors issue

I'm trying to run a container from a custom Docker image of Elasticsearch. It's crashing with a [1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536] How ...
  • 101
0 votes
0 answers
15 views

Trying to Use libpram-tacacs but Getting TACACS+ service type not configured

I've setup a test environment where I have a containerized TACACS+ service. VM is a vagrant machine using Virtualbox as the provider on macOS, v12.3.1. TACACS+ service is an implementation by Pro-Bono-...
1 vote
0 answers
53 views

sudo takes a long time when connected to a VPN on Ubuntu 22.04

I am using Ubuntu 22.04. My machine is joined to my company's domain using Realm. I am not using Adsys. PAM is configured for Unix and SSS authentication. While logged in as my domain user sudo is ...
  • 133
1 vote
1 answer
32 views

Help with understanding this pam config's auth section

I've inherited this pam config and was auditing it while also adding pam_access. I'm trying to understand specifically the auth pam_succeed_if and auth pam_localuser lines. #%PAM-1.0 ...
  • 619
0 votes
0 answers
35 views

Fingerprint authentication text doesn't fit in login box

I am using Linux-Mint and trying to enable fingerprint authentication using fprintd. When I'm on the login screen and a fingerprint authentication attempt fails, the failure message overflows out of ...
  • 1
0 votes
0 answers
29 views

How to enable fingerprint login with encrypted home?

I recently encrypted my home folder using the ecryptfs auto-mounting method. But now when I try to log in using my fingerprint reader GDM (and the entire system) just freezes. I can still log in and ...
1 vote
0 answers
52 views

How to attach virtual (SSH) session to (systemd) seat0?

I am logging in on a PC using SSH and need to access some devices which are attached to seat0. loginctl shows that my session is not attached to any seat: SESSION UID USER SEAT TTY 50 ...
  • 121
0 votes
1 answer
13 views

How to customize default linux/unix PAM module faillock to lock user in all nodes in a cluster

I have implemented faillock in all nodes in cluster, so If any user failed login attempts three time through ssh he will be locked for certain period.It is working fine on individual node but I wanted ...
1 vote
1 answer
47 views

SSH with multi-factor authentication

The customer requires us to setup MFA for SSH sessions. I have successfully tested MFA using Google Authenticator by following this article: https://www.linode.com/docs/guides/how-to-use-one-time-...
1 vote
1 answer
287 views

unlock gnome-keyring on login

Running debian testing, no display manager, i3 window manager. gnome-keyring & libpam-gnome-keyring packages are installed. Added following 2 lines to end of /etc/pam.d/login: auth optional ...
  • 469
0 votes
0 answers
12 views

PAM module debug and some confusion on password entry

So i have been doing research on learning pam moduel in linux system. And i come across some online resource explaining how pam moudle works. And one of the line is account required pam_unix.so ...
0 votes
1 answer
27 views

selang command: Looking for 'unix' parameter clarification

We have an etrust enabled Solaris 11 host. I was looking at one of the scripts created by our Engineering team which has below command lines. selang -s -c "ng grp1 owner(etrust) ***unix*** ...
  • 15
3 votes
1 answer
88 views

Why is executable found without a full path despite its location not in search path?

This question is about understanding the reason(s) behind a perceived inconsistency between documented and actual behavior when calling an executable through sudo. When the secure_path option is ...
  • 137
0 votes
0 answers
69 views

Script on ssh login triggered by pam_exec.so gets blocked by SELinux

I am trying to execute a custom script on every ssh login. Following several manuals on the internet (and the manpage of pam_exec.so), I added the following line to /etc/pam.d/sshd: session ...
0 votes
0 answers
32 views

Can't get list of files in directory in pam_exec.so script

I'm running a custom script on every ssh login to notify me if there was an a login by an unknown IP address that has not been added to a custom whitelist. I'm using pam_exec.so to check for this ...
1 vote
0 answers
188 views

Why isn't a systemd user session started by `su`?

When I use ssh to log in to the root user on my server, an entry 0 is created in /var/run/user because pam_systemd tells systemd-logind to do this. This is an indicator that a user session has been ...
  • 147
0 votes
0 answers
102 views

PAM allow only a specific su command for a user

i created a rule to allow mygroup group to do su command. In /etc/pam.d/su auth sufficient pam_succeed_if.so use_uid user ingroup mygroup Now i want mygroup to be able to use only halt command, ...
  • 1
1 vote
1 answer
177 views

How to suppress PAM audit logs for RHEL8?

I have a system that is getting a ton of audit traffic for a particular account we will call 'redacted'. The logs are showing this account executing the su command. My first instinct was to check the ...
0 votes
1 answer
500 views

Cannot login after enabling pam_faillock module

I am running Ubuntu 20.04 LTS. I enable the pam_faillock module by adding the following two lines in the /etc/pam.d/common-auth file. auth [default=die] pam_faillock.so authfail ...
  • 3
-4 votes
1 answer
59 views

Please help me in figuring out What does this command do?

I saw a command to fix issues while running cron jobs on stackoverflow. https://stackoverflow.com/questions/21926465/issues-running-cron-in-docker-on-different-hosts I am ntsure what exactly this ...
0 votes
0 answers
67 views

HP ZCentral Remote Boost Opening Session for Users with Expired Password

I am using HP ZCentral Remote Boost Version 20.1.2.8161 on RHEL 7.9. Current behavior: When an LDAP user (free IPA) with an expired password authenticates (using their expired password) via the HP ...
  • 1,011
1 vote
2 answers
185 views

Clarification of pam rule with `success=3`

I'm trying to configure pam_ssh_agent_auth.so to provide some users a password-less experience using sudo, when authenticating via ssh pubkey. I started looking at the gentoo wiki, which suggests to ...
  • 35
0 votes
0 answers
309 views

pam_radius_auth all radius servers failed to respond

I am trying to integrate Radius server 3.0.13 with SSHD so I can enable 2FA. The SSH server is RHEL 8.5. All the time getting error pam_radius_auth all radius servers failed to respond. In my SSH ...
0 votes
0 answers
65 views

RHEL 6 Password policy

I've setting my password policies in RHEL 6 using pam_passwdqc. This is what I've set into system-auth & password-auth files: password requisite pam_passwdqc.so min=disabled,disabled,disabled,...
2 votes
0 answers
131 views

Is pam_krb5 affected by Active Directory kerberos changes due to CVE-2021-42287?

I use pam_krb5 to authenticate Linux users against a Microsoft Active Directory. Due to CVE-2021-42287, Microsoft is pushing out updates that will change the way kerberos works in AD. Microsoft's ...
1 vote
0 answers
53 views

How to purposefully delay the `account` PAM phase?

My OpenSSH server is getting bombarded with dictionary attacks on usernames, and instead of using pam_tally2, fail2ban or similar (or the frankly just ugly suggestion of "change the port" ...
  • 111
0 votes
0 answers
146 views

Making multiple PAM modules work together with success as soon as any of them return successfully

I basically want to unlock any sudo authentication with any of these criteria met (whatever completes first successfully): a usb as a security key matched (custom script). fingerprint matched. ...
1 vote
1 answer
188 views

how to use a custom PAM before asking for a password in the login screen (Fedora 35)

I have developed a PAM module to use my fingerprint scanner for login. I tested it in ubuntu 18. in Ubuntu, I changed the /etc/pam.d/common-auth file and added this line at the first line: auth ...
  • 11
3 votes
0 answers
91 views

Infrequent kerberos authentication issue (pam_krb5 vs. pam_unix)

My Linux computer belongs to a company network using a windows domain. The authentication is done using kerberos. Usually the authentication works fine and I am happy with my linux desktop. But ...
  • 157
1 vote
0 answers
50 views

Best practices permissions for /etc/pam.d/sshd

What are the best recommendations for file permissions for /etc/pam.d/sshd? I currently have 0644/-rw-r--r-- root:root and was wondering if it's a good ideea to go to 600. Disclaimer: I use yubikeys ...
0 votes
1 answer
97 views

Add parameter to existing config file if present

Using a script I want to modify the /etc/pam.d/common-session file based on the existing value: if session required pam_mkhomedir.so exist, then add skel=/etc/skel/ umask=0022 if it's not ...
  • 3
3 votes
0 answers
422 views

set sshd SELinux security context

I'm working on my custom board and on my custom UNIX-like O.S. . When I connect using ssh and no root users a receve this SELinux error: A valid context for could not be obtained. where user is not ...
  • 31
0 votes
1 answer
509 views

What's the difference between use_authtok and try_first_pass or use_first_pass in pam_unix?

The documentation for try_first_pass and use_first_pass sounds reasonable enough: try_first_pass Before prompting the user for their password, the module first tries the ...
0 votes
0 answers
850 views

error: PAM: User account has expired for [user] from [IP]

I am currently trying to setup libpam-google-authenticator for 2FA on a Debian 9.0 VPS. I've installed the package using apt, set it up using the google-authenticator command and connected it to a ...
  • 1
0 votes
2 answers
166 views

su issues for non-root user if SELinux is on

I have a common user on my RHEL 7.6 server and when SELinux is off, su command works for it. But when SElinux is on, su command doesn't work anymore. In the PAM sources I found that #ifndef ...
  • 259
0 votes
0 answers
110 views

pam_fprint_enroll no devices detected dell xps 15 9510

I am trying to get the fingerprint sensor to work on the dell xps 15 9510 running a fresh install of arch linux. After following these instructions I am able to use fprint_enroll to add prints to the ...
  • 123
1 vote
1 answer
389 views

Switch password/fingerprint authentication on lid behaviour

I set the fingerprint authentication as default for login and sudo commands. On 3 failures or no fingerprint detection for 10 seconds, password auth is required. When working with lid closed (external ...
  • 392
1 vote
0 answers
429 views

Fingerprint sensor not working on Ideapad Slim 5 although support is mentioned on fprint's website

The support for the fingerprint reader device I use (04f3:0c58 Elan Microelectronics Corp. ELAN:Fingerprint) is available according to this page but when I try to run fprintd-enroll I always get ...
  • 45
2 votes
0 answers
517 views

Unsupported option UsePAM even though OpenSSH is PAM-aware

For my ARM-based Linux system, I crosscompiled OpenSSH, as I need to have a ssh server. In my sshd_config file I set the UsePAM option to yes, because I want to use PAM for the authentication (I need ...
0 votes
0 answers
1k views

samba access denied: "session closed for user nobody"

I am seeking to add a Samba share to a host running Linux Mint. Desired features of the share are discoverability of the host and share through broadcast, accessibility of files only by users with ...
  • 181
0 votes
0 answers
47 views

Password policy with pam_tally2 and 6 ssh password prompts

I'm trying to configure a password policy on an embedded Linux distro. I want to have a 30 seconds cooldown after 3 failed login attempts. Therefore, I added in the common-auth file the last line, ...
  • 361
0 votes
1 answer
482 views

can't login to arch permission denied

I'm getting an error when I'm trying to login to linux from a tty or ly it says "permission denied" and prompt me to enter credentials again, even with root account I'm getting the same ...

1
2 3 4 5
13