Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Is there a way to not log specific syslog messages?

For example I have the following: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=997) pam_unix(sudo:session): session closed for user root pam_unix(cron:session): session closed ...
  • 1,702
0 votes
1 answer
31 views

Would a PAM configuration change with other strange behavior possibly indicate a problem/breach?

I am running an Ubuntu VPS with full root access. The VPS provider has an OS version selection feature. This behavior only occurs when I select Ubuntu 22.04; I tested both 18.04 and 20.04 and did not ...
0 votes
0 answers
29 views

PAM configuration pop up when running apt install npm (node)

Also asked this question here: https://serverfault.com/questions/1120767/pam-configuration-pop-up-when-running-apt-install-node Running Ubuntu 22.04 on a VPS; behavior persists on newly installed OS. ...
0 votes
0 answers
22 views

Allowing public key server access only for non-interactive shells

So we have setup a login service at our big company. In short if you come from within a recognized network you only need a public key to ssh in, otherwise you need to enter a 2FA code. Our pam.d/sshd ...
2 votes
0 answers
22 views

WEBMIN LDAP authentication: passwd returns "Authentication token manipulation error"

Update:jan 25 2023 I believe I have sssd and nslcd working properly I also adjusted the pam modules in webmin. I also added db to nsswitch.conf so I checks there first. As of right now I can use ...
0 votes
1 answer
45 views

Ubuntu SFTP connection to Ubuntu server rejecting with "Permission denied, please try again."

I have a personal server connected to my local network, and recently wanted to set up an SFTP-Server on it for some media transfer. When I try to connect to it however, it asks for my password, but ...
0 votes
0 answers
21 views

Gitlab Runner Randomly Quits Session as Root

I am using a Gitlab Runner instance on one of my Kali Linux instances to run a build process for my custom ISOs. This was previously done on a DigitalOcean droplet, instead of my own server, but the ...
1 vote
0 answers
26 views

How to set up SDDM and PAM to cooperate on blocking some logins?

In short - I've read few topics and articles and I can't get PAM to work with SDDM (I'm using Ubuntu+XFCE4+SDDM) I've modified /etc/security/time.conf file to this login ; * ; aaaa ; Wk1900-2000 login ...
  • 11
1 vote
0 answers
15 views

Authenticating user groups with PAM in C

I am writing a program that allow certain users and user groups to not require authentication through PAM. I want to use the pam_access module but am fairly new and can't find good documentation for ...
  • 11
0 votes
1 answer
13 views

password remembered clear or bypass

in /etc/pam.d/system-auth I have password requisite pam_pwhistory.so use_authtok remember=12 as an admin I want to work on a user's account by resetting their password to something like ...
  • 4,973
0 votes
0 answers
29 views

Password manager which gets unlocked by logging in into your session other than GNOME Keyring

Windows has a neat feature: it has a built-in password manager/storage which gets unlocked automatically when you log in. Are there any Linux applications which are linked to pam.d, so that entering ...
0 votes
1 answer
82 views

Authenticate against samba share

I tend to a number of computers running Ubuntu Linux. I want a central service to authenticate console users against. All user files (home) should be in one location. I am aware there are numerous ...
  • 5,398
0 votes
2 answers
124 views

How can I get PAM to check a condition only on initial login?

Similar to Configure pam_mount to only prompt at initial login, but the recommended answer does not work on RHEL 9 (and apparently didn't work for the person who originally asked the question). I need ...
  • 204
0 votes
0 answers
51 views

How to run vncserver/tigervncserver/Xvnc on Debian 11 as a PAM enabled service

I have a Debian 11 EC2, and want to enable multiple users to connect using the noVNC client to their own desktop remotely. I've installed lightdm (no greeters), xfce4 and tigervncserver. When a user ...
  • 3
1 vote
1 answer
21 views

Specify minlen to specific user

OS: Debian 10.10 Hi all, Can I specify a minlen option for "user2" but not for "user1"? Currently, my /etc/pam.d/common-password.conf contains: password requisite ...
  • 45
1 vote
0 answers
92 views

How can I force/guide users to use 'google-authenticator' when they login without MFA?

env: Amazon Linux 2 (centos 7 custom) I recently plugged Google Authenticator into sshd, and I want every user to use it. Current Status Users can log in without MFA using private keys that I ...
  • 361
0 votes
0 answers
57 views

What is the difference between AuthenticationMethods password and PAMs @include common-auth?

When I use PAM and enable @include common-auth, a user password is required for SSH login (assuming AuthenticationMethods keyboard-interactive is on). How is that different than just using ...
2 votes
0 answers
82 views

What is the difference between these two AuthenticationMethods?

What is the difference between the following: AuthenticationMethods publickey,keyboard-interactive AuthenticationMethods publickey,keyboard-interactive:pam The man page of sshd_config says For ...
1 vote
1 answer
31 views

libPAM library Authentication failure after enabling pam_google_authenticator

I've enabled the following line in /etc/pam.d/common-auth: auth required pam_google_authenticator.so nullok With the nullok option, it should not ask OTP when it is not set up (e.g.: when no ....
1 vote
3 answers
142 views

How to set default root algorithm to sha512 on Linux?

I can see the content below in /etc/shadow. The root password's hash algorithm is md5, but the test user's is sha512: root:$1$RjnJa1j6$.HbXUfxVzGSSAgSvz52Zm1:19251:0:99999:7::: . . . test:$6$...
  • 11
1 vote
0 answers
350 views

Domains are not found after joining Ubuntu 22.04 to Active Directory using SSSD

Since Ubuntu 20.04 we are using SSSD and realmd to join these server to one of our Active Directory domains. This works (almost) out-of-the-box. For Ubuntu 22.04, however, we run into issues. And I am ...
1 vote
0 answers
22 views

Problems setting with two pam-password-modules in centos at the same time

I would like to prevent the use of last passwords and keeping password complexity. But if I use pam_pwquality.so and pam_pwhistory.so at the same time, it doesn't work properly. For example, I set a ...
0 votes
0 answers
164 views

Xubuntu: XDG_ variables missing

I'm connecting to a remote Xubuntu machine via VNC and since yesterday, I can't run certain applications (e.g. TortoiseHG) any more: remote$ thg QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '...
  • 329
0 votes
0 answers
101 views

what is pam_pkcs11 and how does it work?

yum install pam_pkcs11 https://linux.die.net/man/8/pam_pkcs11 This Linux-PAM login module allows a X.509 certificate based user login. The certificate and its dedicated private key are thereby ...
  • 4,973
0 votes
0 answers
144 views

pam_pwquality.so - BAD PASSWORD

I set up in /etc/pam.d/common-password the password requirements: password [success=1 default=ignore] pam_unix.so sha512 password requisite pam_deny.so password required ...
  • 1
0 votes
0 answers
66 views

restarting service remotely via snmp blocked by selinux/pam on Redhat8

I am having some trouble remotely starting/stopping/restarting a service through snmp. It seems to work fine with SElinux set in permissive but with it in enforcing mode it will fail with this type of ...
1 vote
1 answer
93 views

Change in Pam configuration

I have change the password policy to apply the same for root by "enforce_for_root" and for now it apply the password complexity on root yet after removing the "enforce_for_root" ...
  • 11
0 votes
0 answers
12 views

Elasticsearch in Docker max file descriptors issue

I'm trying to run a container from a custom Docker image of Elasticsearch. It's crashing with a [1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536] How ...
  • 101
0 votes
0 answers
80 views

Trying to Use libpram-tacacs but Getting TACACS+ service type not configured

I've setup a test environment where I have a containerized TACACS+ service. VM is a vagrant machine using Virtualbox as the provider on macOS, v12.3.1. TACACS+ service is an implementation by Pro-Bono-...
1 vote
0 answers
121 views

sudo takes a long time when connected to a VPN on Ubuntu 22.04

I am using Ubuntu 22.04. My machine is joined to my company's domain using Realm. I am not using Adsys. PAM is configured for Unix and SSS authentication. While logged in as my domain user sudo is ...
  • 133
1 vote
1 answer
211 views

Help with understanding this pam config's auth section

I've inherited this pam config and was auditing it while also adding pam_access. I'm trying to understand specifically the auth pam_succeed_if and auth pam_localuser lines. #%PAM-1.0 ...
  • 621
0 votes
0 answers
80 views

Fingerprint authentication text doesn't fit in login box

I am using Linux-Mint and trying to enable fingerprint authentication using fprintd. When I'm on the login screen and a fingerprint authentication attempt fails, the failure message overflows out of ...
  • 1
0 votes
0 answers
91 views

How to enable fingerprint login with encrypted home?

I recently encrypted my home folder using the ecryptfs auto-mounting method. But now when I try to log in using my fingerprint reader GDM (and the entire system) just freezes. I can still log in and ...
1 vote
0 answers
102 views

How to attach virtual (SSH) session to (systemd) seat0?

I am logging in on a PC using SSH and need to access some devices which are attached to seat0. loginctl shows that my session is not attached to any seat: SESSION UID USER SEAT TTY 50 ...
  • 121
0 votes
1 answer
18 views

How to customize default linux/unix PAM module faillock to lock user in all nodes in a cluster

I have implemented faillock in all nodes in cluster, so If any user failed login attempts three time through ssh he will be locked for certain period.It is working fine on individual node but I wanted ...
1 vote
1 answer
83 views

SSH with multi-factor authentication

The customer requires us to setup MFA for SSH sessions. I have successfully tested MFA using Google Authenticator by following this article: https://www.linode.com/docs/guides/how-to-use-one-time-...
2 votes
1 answer
632 views

unlock gnome-keyring on login

Running debian testing, no display manager, i3 window manager. gnome-keyring & libpam-gnome-keyring packages are installed. Added following 2 lines to end of /etc/pam.d/login: auth optional ...
  • 487
0 votes
0 answers
21 views

PAM module debug and some confusion on password entry

So i have been doing research on learning pam moduel in linux system. And i come across some online resource explaining how pam moudle works. And one of the line is account required pam_unix.so ...
0 votes
1 answer
31 views

selang command: Looking for 'unix' parameter clarification

We have an etrust enabled Solaris 11 host. I was looking at one of the scripts created by our Engineering team which has below command lines. selang -s -c "ng grp1 owner(etrust) ***unix*** ...
  • 15
3 votes
1 answer
144 views

Why is executable found without a full path despite its location not in search path?

This question is about understanding the reason(s) behind a perceived inconsistency between documented and actual behavior when calling an executable through sudo. When the secure_path option is ...
  • 147
0 votes
0 answers
187 views

Script on ssh login triggered by pam_exec.so gets blocked by SELinux

I am trying to execute a custom script on every ssh login. Following several manuals on the internet (and the manpage of pam_exec.so), I added the following line to /etc/pam.d/sshd: session ...
0 votes
0 answers
49 views

Can't get list of files in directory in pam_exec.so script

I'm running a custom script on every ssh login to notify me if there was an a login by an unknown IP address that has not been added to a custom whitelist. I'm using pam_exec.so to check for this ...
2 votes
1 answer
509 views

Why isn't a systemd user session started by `su`?

When I use ssh to log in to the root user on my server, an entry 0 is created in /var/run/user because pam_systemd tells systemd-logind to do this. This is an indicator that a user session has been ...
  • 177
0 votes
0 answers
216 views

PAM allow only a specific su command for a user

i created a rule to allow mygroup group to do su command. In /etc/pam.d/su auth sufficient pam_succeed_if.so use_uid user ingroup mygroup Now i want mygroup to be able to use only halt command, ...
  • 1
1 vote
1 answer
336 views

How to suppress PAM audit logs for RHEL8?

I have a system that is getting a ton of audit traffic for a particular account we will call 'redacted'. The logs are showing this account executing the su command. My first instinct was to check the ...
0 votes
1 answer
1k views

Cannot login after enabling pam_faillock module

I am running Ubuntu 20.04 LTS. I enable the pam_faillock module by adding the following two lines in the /etc/pam.d/common-auth file. auth [default=die] pam_faillock.so authfail ...
  • 3
-4 votes
1 answer
64 views

Please help me in figuring out What does this command do?

I saw a command to fix issues while running cron jobs on stackoverflow. https://stackoverflow.com/questions/21926465/issues-running-cron-in-docker-on-different-hosts I am ntsure what exactly this ...
0 votes
0 answers
105 views

HP ZCentral Remote Boost Opening Session for Users with Expired Password

I am using HP ZCentral Remote Boost Version 20.1.2.8161 on RHEL 7.9. Current behavior: When an LDAP user (free IPA) with an expired password authenticates (using their expired password) via the HP ...
  • 1,037
2 votes
2 answers
471 views

Clarification of pam rule with `success=3`

I'm trying to configure pam_ssh_agent_auth.so to provide some users a password-less experience using sudo, when authenticating via ssh pubkey. I started looking at the gentoo wiki, which suggests to ...
  • 55
0 votes
0 answers
545 views

pam_radius_auth all radius servers failed to respond

I am trying to integrate Radius server 3.0.13 with SSHD so I can enable 2FA. The SSH server is RHEL 8.5. All the time getting error pam_radius_auth all radius servers failed to respond. In my SSH ...

1
2 3 4 5
13