Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
1 vote
0 answers
23 views

How to config SSH authen with all 3 components: publickey, password and OTP

Update 1: I'm able to apply all publickey + password + OTP with this basic config in /etc/pam.d/common-auth. auth [success=ok] pam_unix.so auth [success=1] pam_google_authenticator.so nullok ...
TungNS's user avatar
  • 11
0 votes
0 answers
19 views

How to change the timeout between incorrect password attempts in SDDM?

When entering a password, either in terminal or on login screen (in my case SDDM), the default timeout between incorrect attempts is around 2 or 3 seconds. I want to change it to something lower as I ...
lightproof's user avatar
1 vote
1 answer
160 views

Why is pam_unix.so set "required" even when LDAP is enabled?

On my Rocky Linux 9.3 machine, LDAP authentication is enabled by authselect and is working fine. I can ssh into this machine by both local accounts and LDAP-only accounts. However, my /etc/pam.d/...
biochem_fan's user avatar
0 votes
0 answers
38 views

Need password authentication while runing "systemctl stop .service"

I am looking for a way to add one more password authentication to run systemctl stop abc.service via root access. I am using Rocky Linux. I have no idea if it is even possible. Please help.
Anuj Yadav's user avatar
0 votes
0 answers
11 views

Override PAM module options

Is it possible to override PAM module options for a module that appeared earlier in the PAM stack? For example, I have /etc/pam.d/sudo: #%PAM-1.0 # Set up user limits from /etc/security/limits.conf. ...
Timmmm's user avatar
  • 586
0 votes
0 answers
11 views

ways to identify PAM prompts?

Is there a way to identify when PAM prompts on the terminal? something similar to sudo/doas which allows to set a prefix for all their messages, or override it entirely (e.g. env SUDO_PROMPT)
gcb's user avatar
  • 400
1 vote
0 answers
30 views

SSH Display custom message at login if correct password but no public key

We're moving a server (running Ubuntu Server 23.10) from "password or public-key" auth to "public-key only". I'm looking for a way to make ssh auth behave like this: If public key ...
tbrugere's user avatar
  • 996
0 votes
1 answer
28 views

How to login as root user after deleting system-auth

I wanted to use an old password for my account.  I am using OpenEuler OS distribution.  After searching on Stack Exchange, I found this link. How can I reuse an old password? I followed the exact same ...
Zamaar Shahid's user avatar
1 vote
1 answer
71 views

su : connect to another user with D-BUS activated [duplicate]

I created a user that run timers and service with systemctl --user. When I try to login via ssh, I have no issue with systemctl --user. But when I connect to this user with su, I have a bus error: me@...
Ricain's user avatar
  • 141
0 votes
1 answer
69 views

Can we use bi-key authentication with dovecot & thunderbird?

I run the dovecot imap server and use thunderbird as frontend. The access is password protected, and I see zillion login attempts with leaked passwords. I would like to switch to bi-key authentication ...
chmike's user avatar
  • 211
0 votes
1 answer
63 views

Is "pam_unix(cron:session): session opened" misformulated? [duplicate]

$ journalctl -g sudo -S today Jan 21 00:02:02 limbo sudo[3898480]: pam_unix(sudo:session): session opened for user root(uid=0) by seca(uid=1001) Jan 21 00:02:02 limbo sudo[3898480]: pam_unix(sudo:...
sigil's user avatar
  • 165
0 votes
1 answer
179 views

Enable faillock on Debian 12

Can anyone tell my how to enable faillock on Debian 12? I had a look to several tutorials but nothing worked for me. This is what I get after installation - without comments. /etc/pam.d/common-account ...
chris01's user avatar
  • 585
0 votes
1 answer
200 views

Debian 12: pam_tally2 gone?

I am using pam_tally2 on an old Debian 10 to cound failed logins. Now I was trying to do the same on Debian 12. But it seems there is not pam_tally2 anymore. Whats the idea to count (only count, not ...
chris01's user avatar
  • 585
0 votes
0 answers
88 views

Void Linux won't start past command line anymore after editing pam.d files

Asking for help as a last resort before just fully reinstalling. I'm running Void Linux and just installed it yesterday on my new laptop, however I can no longer boot. This is what I did: First i did ...
JJ Joshua's user avatar
0 votes
1 answer
67 views

Why SSSD Service override_homedir triggers creation of home directory with wrong permissions?

I have a vendor application installed in an Ubuntu Jammy server that relies on SSSD v2.6.3 configured for LDAP integration for the authentication and creation of the home directory of the user in the ...
Alejandro Arévalo's user avatar
0 votes
2 answers
952 views

Debian "Login Incorrect" for all users before entering password

I think I've got a dead system now, but I don't know how to recover. I was updating from Buster to Bookworm with the standard method outlined here - https://wiki.debian.org/DebianUpgrade After ...
Jademalo's user avatar
  • 121
1 vote
1 answer
251 views

How to unlock kdewallet with FIDO2 key

I am using a FIDO2 key to login into my KDE session, but then KDE wallet asks for a password. I am using it and find it quite useful to keep keys, ssh passwords, etc in one place. Is there a way to ...
Artiom's user avatar
  • 143
0 votes
1 answer
42 views

How to enable debug messages for pam_systemd_home.so?

The manual for pam_systemd_home states that debug messages can be enabled with debug=yes, but they don't state where to put it. I tried adding the options to the relevant lines in pam.d/system-auth, ...
DarkRise's user avatar
1 vote
0 answers
611 views

PAM - Disabling "check pass; user unknown" syslog messages

TLDR: We use PAM with SSHD. CentOS and Ubuntu exist in the environment. For every SSHD failure of an unknown user, it creates two messages. One of the messages doesn't provide the unknown username and ...
Top-Lunch-7931's user avatar
2 votes
1 answer
53 views

pam_exec cannot call systemctl due to SELinux

I'm trying to execute a script every time an SSH session starts and ends, on CentOS 7. This script should start/stop a systemd service. This is my setup: In /etc/pam.d/sshd, I added the following ...
flyx's user avatar
  • 131
0 votes
0 answers
77 views

WSL Ubuntu sessions are never actually closed (unless I SIGKILL them)

I have a WSL Ubuntu instance on my Windows 10 machine. The Ubuntu instance has different users. If I reboot the Ubuntu instance, and log in as root, I can see (using w) that no sessions exist except ...
Mads Skjern's user avatar
0 votes
0 answers
445 views

How to authenticate with password in terminal, with fprintd authentication enabled?

I enabled fingerprint authentication on my laptop running Debian 12 by following this guide: $ doas apt install fprintd libpam-fprintd $ fprintd-enroll -f right-middle-finger $ fprintd-verify $ doas ...
mkurz's user avatar
  • 197
2 votes
0 answers
31 views

How to skip further PAM checking when breaking from a command (SIGINT / ctrl+c)?

I have a custom PAM setting for sudo, to use Howdy, an application using face recognition for authentication. My current /etc/pam.d/sudo looks like this: #%PAM-1.0 auth sufficient pam_unix.so ...
renyuneyun's user avatar
0 votes
2 answers
107 views

Run PAM script only when logging in using su

I have a script in /usr/local/bin that I reference in /etc/pam.d/su using: session optional pam_exec.so stdout /usr/local/bin/script.sh It runs as expected when I login to user from root using su ...
ajthealchemist's user avatar
0 votes
0 answers
138 views

Allow sudo but no local login with pam access

Assume we have two servers A and B A: Heavily locked down. Requires TOTP (google authenticator), password and valid public key. This server allows users to log into B with their adm accounts (...
N3buchadnezzar's user avatar
0 votes
0 answers
95 views

Account unlock is not happening even after unlock_time

I want to lock user account after 3 failed attempts, I am following this guide. I am using Ubuntu 14.04 (for jumphost purposes only). However, the automatic unlock is not happening after 10 minutes. ...
rahuls_'s user avatar
  • 11
1 vote
0 answers
53 views

Shutdown after X failed login attempts

I have a laptop with Xubuntu 22.10, whose SSD is encrypted with LUKS, so if it's stolen when shut down, my data should be safe. But it's more likely to be stolen while it's switched on, and then only ...
Michael Marx's user avatar
0 votes
0 answers
95 views

pam_sss(sudo:auth): unknown option: minimum_uid:6000

I've recently tried to convert my Rhel7 configuration to my Rhel9 setup. I'm running into some issues when it comes to authselect and system-auth configuration file. For Rhel7 I used following: auth ...
N. J's user avatar
  • 157
4 votes
0 answers
2k views

How to setup passkey authentication in Linux?

I have setup the PAM module pam_u2f.so for FIDO2 as the primary authentication method on my LMDE 5 (based on Debian 11) machine. Is there a way to integrate passkey support with this PAM module or ...
Pavin Joseph's user avatar
0 votes
0 answers
26 views

PAM: pam_get_authtok return PAM_BAD_ITEM

I'm trying to write my own PAM module: int pam_sm_setcred(pam_handle_t* handle, int flags, int argc, const char** argv) { return PAM_SUCCESS; } int pam_sm_acct_mgmt(pam_handle_t* handle, int ...
Deratelo's user avatar
0 votes
0 answers
203 views

Configuring Sudo to use AD/LDAP password

Looking into the feasibility of configuring our VMs (RHEL 8) so users in the wheel group use their LDAP password to authenticate for Sudo What I've done so far is configured sssd for LDAP ...
user3777740's user avatar
0 votes
0 answers
205 views

pam_unix error when attempting to setup rdxp with AD integration

Issue: Installed Realm, SSSD and SSH works with all users, but trying to remote desktop using xrdp fails with the following errors Aug 30 00:00:00 PC-NAME xrdp-sesman[220997]: pam_unix(xrdp-sesman:...
themantimeforgot's user avatar
0 votes
0 answers
145 views

PAM: Master Password

I want to create a master password that can log into any user account on a system without needing root privileges (but we can use root to create and set up the master password). In other words, I need ...
Anish G.'s user avatar
0 votes
0 answers
139 views

SSH TOTP - Code confirmed but Failed keyboard-interactive/pam

I am on Debian 12 and am trying to setup pam_google_authenticator.so for SSH 2fa with pubkey and TOTP. I get through the setup with google-authenticator and put in the 2FA code that my token gives me, ...
user avatar
0 votes
0 answers
176 views

openSUSE Tumbleweed: facial recognition for login: howdy and PAM configuration issues

My laptop is an Acer Swift 3. It has a fingerprint sensor, but there’s no Linux driver for this one (last time I checked). So since I like Windows Hello, I decided to set up face recognition. I’m ...
Ul Tome's user avatar
  • 117
0 votes
0 answers
236 views

Error when using use_authtok and use_first_pass with pam_pwhistory, but not when I use try_first_pass?

RHEL 7.9 I have a question similar to What's the difference between use_authtok and try_first_pass or use_first_pass in pam_unix? I have created a new local file in /etc/pam.d called system-auth-...
user1070061's user avatar
0 votes
1 answer
381 views

pam_exec.so not running command or logging anything

I have created a new authselect profile with sudo authselect create-profile login-hooks --symlink-meta --symlink-nsswitch --symlink-dconf --base-on=sssd Then I appended the following line to /etc/...
Robin Green's user avatar
  • 1,249
1 vote
0 answers
169 views

SSH Authentication Prompts Twice for Password When Using PAM with Google Authenticator

I'm setting up two-factor authentication (2FA) on an Ubuntu server using libpam-google-authenticator. I've configured SSH to use PAM for authentication with the following /etc/pam.d/sshd configuration:...
rbehzadan's user avatar
1 vote
1 answer
77 views

How to prompt "su" to re-request a password on an incorrect entry?

Default su behaviour : system@sword:/etc/pam.d$ su - test Password: su: Authentication failure <su exits> I need to configure "delay" when someone enters an incorrect password for ...
sword's user avatar
  • 11
0 votes
1 answer
414 views

PAM password "minlen" setting not enforced

I installed Ubuntu 18.04 and manually modified /etc/security/pwquality.conf with the following settings: minlen = 14 minclass = 4 (without # at the start of the line). However, when I add a new user ...
hutcruchi's user avatar
  • 339
0 votes
2 answers
1k views

How to use PAM to allow 'root' access only from local terminal?

I am new to PAM and its quite complex to pinpoint a specific module or config file, thus asking this. I want to allow root access only from the console i.e if someone is physically present on that ...
sword's user avatar
  • 11
0 votes
2 answers
240 views

Difference between *LK* in /etc/shadow and /usr/sbin/nologon in /etc/passwd

What is the practical difference between setting *LK* in /etc/shadow and setting /usr/sbin/nologon in /etc/passwd? When would we choose one over the other? When would we combine them?
Lyubomir's user avatar
  • 113
0 votes
1 answer
2k views

How to fix "PAM unable to dlopen(/lib64/security/pam_ldap.so)" in SLES 15 SP4?

Somehow I ended up in SLES 15 with error messages like this: (systemd)[6729]: PAM unable to dlopen(/lib64/security/pam_ldap.so): /lib64/security/pam_ldap.so: cannot open shared object file: No such ...
U. Windl's user avatar
  • 1,411
2 votes
0 answers
264 views

How to exclude local users from PAM auto mount?

I'm using sssd and pam to allow people to log in via AD and automatically mount NFS shares. It works fine, but when I try to login as a local user like root, the auto-mount process fails and it takes ...
stappero's user avatar
0 votes
0 answers
77 views

libpam-google-authenticator failing on kubuntu 23.04 (seemingly due to polkitd)

I have used libpam-google-authenticator for several years. I always set it up to require a password + TOTP token as the password in pam. I type in my password, and then press the button on my "...
lopass's user avatar
  • 79
3 votes
1 answer
371 views

What effect has "+:ALL:cron crond" in /etc/security/access.conf?

I am refining our rules in /etc/securiy/access.conf. I found the following rule and I am not sure what it is used for: +:ALL:cron crond According to the man page of access.conf it means something ...
N. Kreienbühl's user avatar
0 votes
1 answer
260 views

Allow multiple user groups to "su" to multiple other users without password

I want a specific group of users to be able to use the su command as a specific user. example) Group User allowsu_aa aa allowsu_bb bb allowsu_cc cc So I added the below to /etc/pam.d/su file. ...
genie4u's user avatar
1 vote
0 answers
64 views

/etc/pam.d configuration Ubuntu - common-* versus sytem-auth

I'm trying to configure /etc/pam.d files on Ubuntu servers. I've already configured by RHEL servers by using the /etc/pam.d/system-auth. Problem: Could not chdir to home directory I believe this is ...
N. J's user avatar
  • 157
0 votes
0 answers
406 views

What is the best way to make LDAP based TOTP only required in some cases?

I have a 2FA setup on my network for certain kinds of authentication, but not others. The way it currently works is a combination of pam_ldap for passwords, and pam_oath for TOTP. PAM is configured in ...
stribika's user avatar
  • 5,454
1 vote
0 answers
91 views

create PAM converstation

I tried to create a simple PAM module, that print some message, wait X second and return the PAM_SUCCESS status. Firstly I tried with this script: #include <security/pam_appl.h> #include <...
Atisom's user avatar
  • 71

1
2 3 4 5
14