Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

2
votes
0answers
8 views

Allow PAM module to always access a root only file

I have a custom PAM module that needs to access some sensitive information on the hard disk to perform its job. These files would ideally be stored with root access permissions only. I've been ...
0
votes
0answers
29 views

Require a yubikey AND (publickey OR password) for SSHD auth

I am attempting to configure OpenSSH on a Debian based system to always require a yubikey TOTP AND either a publickey OR password. I realise other combinations are possible through ...
-1
votes
0answers
7 views

Linux pam euid/egid

I'm trying to setup a pam module that has a configuration file (pam_pgsql if it matters). What minimal permissions shall I set to its config? Module uses fopen with "r" access mode string for it. I'd ...
0
votes
1answer
46 views

ssh & local root login works with invalid password in Debian 9

I am trying to login to Debian 9 machine with root username, locally and through ssh.  It logs in with any invalid password.  I want to access the machine with the correct password only.  Why does an ...
0
votes
0answers
29 views

SOLVED Accidentally removed /etc/pam.d How do I reinstall packages in my arch from a live usb

I have Antergos installed on my Notebook. I accidentally deleted the folder /etc/pam.d, so I cannot use any root command, or access my user session. I thought about reinstalling the packages which ...
2
votes
0answers
11 views

Pam.d three files lightdm, lightdm-greater, lightdm-auth

What are the differences in the three files located in /etc/pam.d /etc/pam.d/lightdm-greeter /etc/pam.d/lightdm-auth /etc/pam.d/lightdm I assume they each serve a different role, what do they do?
0
votes
0answers
18 views

Custom PAM Module

I have a use case where I am trying to SSH into a Red Hat Enterprise Linux 7.5 using a custom pam module that makes calls to an api. The problem that I am encountering however is that username and ...
0
votes
0answers
14 views

pam_ldap detecting expiring password on Active Directory

I am maintaining some code that uses: pam_ldap version 186 which compiles against openldap 2.4.40 We are using Active Directory on Windows 2012 for the LDAP backend. pam_ldap successfully ...
1
vote
2answers
55 views

How is sendmail SMTP authentication logging controlled?

I get a ton of failed SMTP login attempts. I'd really like to defend against it, but the logging of those attempts is poor. I'm using sendmail 8.15, cyrus-sasl 2.1.26. The SASL setup is the simplest ...
0
votes
0answers
29 views

Get fsck to work with pam_mount

I've been trying to get luks volumes mounted at login with pam_mount fscked on mount, but without success. fstab provides the sixth field, where one can set a flag to determine whether the volume ...
0
votes
2answers
19 views

Unable to Login to Wok on Fedora Server 27 - Python and PAM

I just setup WOK and can't login via my root uname/pwd. I found a ticket on Github with a "solution" but I have no idea how to implement it. Does anybody have an idea how to translate this into ...
1
vote
1answer
38 views

Send an email when an incorrect password is entered

On the Debian workstations at work that I administrate I get an email whenever somebody tries to call sudo with the exact command that they have tried, the machine and their username. This is really ...
0
votes
2answers
58 views

why Linux server do not ask password in single user mode

Why doesn't RHEL server ask for a password in single user mode? Red Hat Enterprise Linux Server release 6.6 (Santiago), in case it's relevant. I had many cases where I had to reset root password in ...
0
votes
0answers
39 views

For rotating logs- Cronjob issue

Invoking logrotate every 15 mins. logrotate will rotate only after size threshold crosses 1M Working machine [root@machine1 output]# ls -l --block-size=1K total 296 -rw------- 1 root root 55 Oct ...
0
votes
1answer
28 views

directory listing command error after install google-authenticator on CentOS 7

Status CentOS 7.5.1804 (Core) Linux 3.10.0-862.14.4.el7.x86_64 Problem After I installed and setting google-authenticator packages, weird authentication related message keep shown when I use ...
6
votes
2answers
190 views

setting sudo password different from login password

I am attempting to use PAM to use a different password for sudo than I do for logging in. I worked off of this post originally Set sudo password differently from login one Unfortunately, every time ...
0
votes
0answers
67 views

Google Authenticator with NGINX and PAM on ubuntu

I am trying to do nginx 2FA authentication using pam. /etc/pam.d/nginx_google_restricted: auth required pam_google_authenticator.so forward_pass auth required pam_unix.so ...
1
vote
1answer
58 views

GNOME: Different PAM configurations for lockscreen vs login

I recently purchased a U2F security key, and I have successfully configured my Ubuntu 18.04 machine to require authentication via the key as well as my usual password to log in. I am hoping to change ...
0
votes
0answers
97 views

Mounting NFS Directory as Home Directory under /home for Users using PAM.D and PAM_MOUNT

Currently I am trying to mount NFS folder as home folder for my users via pam.d and pam_mount. Unfortunately, when I log into my machine I get stuck in spawn.c with following message: (spawn.c:136): ...
0
votes
0answers
35 views

case-preserving linux usernames and hostnames

Is there a way to set pam library to do case-preserving username validation? Is there a way to set useradd command to accept and preserve the case of usernames? I know usernames and URLs are not OS ...
0
votes
1answer
202 views

PAM Authentication Errors for one username. All other usernames log in properly

Red Hat Enterprise Linux 6.10 in VMWare virtual machine. We have several user accounts defined. One user account (user3) is unable to log in, either through SSH or the VMWare Console. It has logged in ...
0
votes
1answer
94 views

How to omit PAM log messages for specific user (pam_succeed_if quiet)

I'm using a monitoring agent (telegraf) to monitor fail2ban. Unfortunately, it requires SuperUser rights to execute fail2ban-client, which causes 24 system log messages every 10 seconds... Do the math,...
3
votes
0answers
105 views

Fedora 28: Generate kerberos ticket on login

I'm trying to generate kerberos ticket when I login on my computer(Fedora 28). I want to achieve it using PAM. my /etc/pam.d/system-auth looks like this: auth required ...
1
vote
1answer
77 views

PAM account interface vs /etc/shadow

According to the official Red Had documentation on pam for the account interface: account — This module interface verifies that access is allowed. For example, it checks if a user account has ...
1
vote
1answer
137 views

Deleted /etc/pam.d/common

I deleted all common-* files in /etc/pam.d folder and now I am locked out. I am running Ubuntu 14.04. I did backup all these files in a folder inside pam.d but now I can't even move them. If I try, ...
1
vote
1answer
127 views

password length with pam_cracklib.so

I ran a security scan in a RedHat Linux Server and got the following vulnerabilty: Incorrect System Default minimum password length or password complexity rules. Minimum password length should be ...
0
votes
1answer
25 views

Right place for user specific enviroment variables if you don't use a display manager

I recently purged my display manager in favor of starting xsessions with startx. I did this after setting up a new installation of ubuntu 18.04. Up to now I was used to use ~/.pam_environment to set ...
1
vote
0answers
15 views

Is it possible to pull additional info from LDAP during pam_ldap authentication?

I have additional ldap data that I'd like to store in the user's home when they first log into a client using pam_ldap. However, I can't seem to think of a way to make this work without prompting the ...
1
vote
1answer
92 views

Authenticate Linux<->LDAP Protocol<->AD(active directory): Fail to logon with password

Dears, I spent much time on this and even successfully verified (Auth)Linux-LDAP-openLDAP ok. But get blocked with AD.I can now switch to user from root account but can not log on with password(...
0
votes
0answers
36 views

journalctl -f is spamming “cannot create session” and “session opened for root user”, how can I get it to stop/fixed?

I'm using fedora 28. I don't understand why I'm getting these messages and would love some help so I can use journalctl -f for other things. This is a fresh terminal window and I hadn't tried su ...
2
votes
1answer
28 views

Is there a limit for line length in PAM config files?

How I got to this suspicion: I try to configure the proxy at my companies network. There are quite a few hosts that can only be reached without proxy, so I tried configuring $NO_PROXY in /etc/...
1
vote
0answers
177 views

pam_sss access denied with kerberos authentication ok

I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
1
vote
1answer
772 views

How do you add `cap_sys_admin` permissions to user in CentOS 7?

I tried adding cap_sys_admin permissions to user myroot. For this, I added these lines to /etc/security/capabilities: cap_sys_admin myroot none * and this line to /etc/pam.d/su: auth ...
3
votes
1answer
324 views

How do I allow crontab use for local accounts that don't allow interactive logins?

Ok, here's the situation (you're welcome for the earworm): I am running a multi-server RHEL 7 environment with SELinux enabled. Due to DoD STIG controls, I do not have root access, but I do have a ...
0
votes
0answers
220 views

How to stop Gnome Keyring from asking for Login password, like it used to?

Previously, Gnome Keyring only asked for the Default Keyring password when I attempted to launch Chrome. I tried playing around with settings in Seahorse to see if there was a work around for this, ...
5
votes
2answers
360 views

How to create a conditional PAM entry

I am testing PAM scenarios on RedHat 7.5 The pam module pam_succeed_if.so looks like the most basic level of conditional testing that PAM has to offer, and it is not meeting my needs. You can only ...
0
votes
2answers
910 views

(root) FAILED to authorize user with PAM (Permission denied)

When tailing /var/log/cron i noticed that the cron job is failing due to PAM permissions. In my access.conf i do have the following uncommented to make sure (or what i thought was making sure) that ...
1
vote
1answer
94 views

running pam_exec script after login complete

I'm parsing out the lastlog command into a custom file when a user logs in for use with another application that monitors SSH logins. In /etc/pam.d/sshd I have included the line and the very bottom: ...
2
votes
1answer
409 views

Using pam_exec.so to run a script as root when a user logs in (while extracting user information)?

Question How can I run a script as root when a user logs in with pam_exec.so (or otherwise)? The script requires information about the user to function. Problem and Environment I would like to run ...
0
votes
1answer
82 views

Regarding PAM via ldap

I have a question for the authentication between Linux and Windows. When I get an authentication from the OS system such as Linux, then I can use PAM by configuration of "/pam.d". However, it's the ...
0
votes
0answers
74 views

How to run custom script on local login failure in a screen locking program using PAM

I am trying to run a script every time a login failure occurs via a screen locking program (like SLiM, i3Lock, slock, etc.) I am running Arch. Also, to be clear, I am not talking about logging into ...
1
vote
1answer
393 views

How to make changes to pam config such that further execution of authconfig will not overwrite them?

I'm configuring a CentOS7 host (through ansible) running authconfig. Now I need to add/configure pam_exec module to the setup but it seems it is not supported by authconfig (cf. man authconfig and /...
1
vote
1answer
283 views

How does ssh or any other service work without pam?

I do not understand how ssh or any other service can work without pam. pam defines all the rules, if I understand correctly, calls other modules to set resources or restrictions etc. Can someone ...
3
votes
1answer
584 views

Ubuntu 16 Sudo SU Incorrect Password Attempts

I am using Ubuntu 16.04.3 LTS Server. I have a user with sudo privileges on it. When I attempt to switch from my current user to root, it asks for my password. I enter the correct password and it ...
1
vote
1answer
120 views

Is `pam_limits.so` used like a command?

From http://man7.org/linux/man-pages/man8/pam_limits.8.html SYNOPSIS top pam_limits.so [conf=/path/to/limits.conf] [debug] [set_all] [utmp_early] [noaudit] Does the ...
0
votes
0answers
76 views

Configured local user on OpenVPN Ubuntu server, still access denied via PAM

I'm running an OpenVPN Access Server that is configured to authenticate users using PAM. However, I keep getting "AUTH FAILED" when trying to establish a successful VPN connection. The user that I'm ...
1
vote
0answers
208 views

Using pam_succeed_if to restrict user login to single group

I'm running Debian 9. I'm no PAM expert. What I want to do is restrict user logins to uids that are members of the "goodgroup" group. I forget where I got this solution originally, but this is what I ...
0
votes
0answers
354 views

Run script command after ssh login using pam_exec

I would like to run script command after a ssh connection is established. I want this to be stealthy in order to record every command typed on each SSH session. Things like using bashrc or profile ...
0
votes
0answers
119 views

sudo does not import /etc/environment on Debian 9

I have configured my proxy in /etc/environment. When I become root by sudo su - the proxy environment variables are set. But when I become root by sudo -i the proxy environment variables are ...
0
votes
1answer
129 views

Why does the pam_unix module documentation list PAM_IGNORE as its only return value?

From http://www.linux-pam.org/Linux-PAM-html/sag-pam_unix.html: 6.37.4. RETURN VALUES PAM_IGNORE Ignore this module. Obviously the module must return success or failure for password ...