Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

0
votes
0answers
9 views

PAM successful authentication limits

I have a question regarding PAM and the possibility that it throttles too many 'auth' attempts if they happen in a short time. I have posted my question on the PAM mailing list, but to no avail. I ...
1
vote
1answer
21 views

Solaris 11 - PAM application

I'm trying to compile an application which interacts with the PAM system on Solaris 11, however everytime I try compile the code I get "fatal error: security/pam_appl.h: No such file or directory" ...
0
votes
3answers
47 views

PAM doesn't block my account after 5 failed logins

I would like to block account after 5 failed password on login screen. I follow this article but it doesn't takes effect. I don't know why. This is the content of my /etc/pam.d/system-auth file : #%...
4
votes
2answers
337 views

Cron is trying (and failing) to open env file: /etc/environment

I'm using Devuan ASCII (which is more or less Debian 9, Stretch). Now, my /var/log/auth.log has a bunch of these entries: Jan 6 09:45:01 mybox CRON[20951]: pam_env(cron:session): Unable to open env ...
1
vote
0answers
32 views

pam_unix Module Not Allowing Random String Passwords in Ubuntu 18.10

I just installed Ubuntuy 18.10 on one of my computers, and am trying to understand why a series of passwords are not working, even though they are completely random character strings. I started by ...
1
vote
1answer
56 views

Centos PAM can't start httpd.service

I have OS CentOS Linux release 7.6.1810 (Core). I try just start almost pure httpd.service. I run command: systemctl start httpd.service I try run this from my user and from root - it is not ...
3
votes
0answers
45 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
3
votes
1answer
114 views

How to block shutdown or reboot in Debian xfce when other users logged in

I want to prevent users to start shutdown or reboot when another user is logged in. Users can be a TTY user (Ctrl+Alt+F3) or a ssh user from a client host. In OpenBSD, I use polkit org.xfce.session....
-2
votes
1answer
73 views

PAM conf files are insecure! [closed]

PAM configuration files located in /etc/pam.d/ are vulnerable to physical attack. That is they can be modified from an external system (bootable USB or take drive to another machine) Other than ...
2
votes
1answer
20 views

Password history restrictions are written to in system-auth(-ac), but not password-auth(-ac). Why, when every other policy gets written to both?

According to this STIG, password history is entered into /etc/pam.d/system-auth, but not /etc/pam.d/password-auth. Other policies, for example, account lockouts are applied to both files. Why isn't ...
1
vote
0answers
29 views

PAM File Modification for Google Authenticator

i use the google authenticator for the ssh authentication, but i use a publickey + authenticator or a password + authenticator (when no publickey is defined it should be ask only for password, but i ...
1
vote
2answers
236 views

fingerprint-gui on Linux Mint 19 “Tara” cinnamon works but not on first boot or in software center

On my Lenovo Thinkpad X1 Carbon 3rd. Gen., fingerprint-gui works fine when locking the screen or requesting sudo in terminal. It doesn't work when I freshly boot up the system at first login, and it ...
2
votes
1answer
19 views

Allow PAM module to always access a root only file

I have a custom PAM module that needs to access some sensitive information on the hard disk to perform its job. These files would ideally be stored with root access permissions only. I've been ...
0
votes
0answers
40 views

Require a yubikey AND (publickey OR password) for SSHD auth

I am attempting to configure OpenSSH on a Debian based system to always require a yubikey TOTP AND either a publickey OR password. I realise other combinations are possible through ...
0
votes
1answer
74 views

ssh & local root login works with invalid password in Debian 9

I am trying to login to Debian 9 machine with root username, locally and through ssh.  It logs in with any invalid password.  I want to access the machine with the correct password only.  Why does an ...
2
votes
0answers
32 views

Pam.d three files lightdm, lightdm-greater, lightdm-auth

What are the differences in the three files located in /etc/pam.d /etc/pam.d/lightdm-greeter /etc/pam.d/lightdm-auth /etc/pam.d/lightdm I assume they each serve a different role, what do they do?
1
vote
2answers
185 views

How is sendmail SMTP authentication logging controlled?

I get a ton of failed SMTP login attempts. I'd really like to defend against it, but the logging of those attempts is poor. I'm using sendmail 8.15, cyrus-sasl 2.1.26. The SASL setup is the simplest ...
0
votes
2answers
28 views

Unable to Login to Wok on Fedora Server 27 - Python and PAM

I just setup WOK and can't login via my root uname/pwd. I found a ticket on Github with a "solution" but I have no idea how to implement it. Does anybody have an idea how to translate this into ...
1
vote
1answer
38 views

Send an email when an incorrect password is entered

On the Debian workstations at work that I administrate I get an email whenever somebody tries to call sudo with the exact command that they have tried, the machine and their username. This is really ...
0
votes
2answers
78 views

why Linux server do not ask password in single user mode

Why doesn't RHEL server ask for a password in single user mode? Red Hat Enterprise Linux Server release 6.6 (Santiago), in case it's relevant. I had many cases where I had to reset root password in ...
0
votes
0answers
82 views

For rotating logs- Cronjob issue

Invoking logrotate every 15 mins. logrotate will rotate only after size threshold crosses 1M Working machine [root@machine1 output]# ls -l --block-size=1K total 296 -rw------- 1 root root 55 Oct ...
0
votes
1answer
42 views

directory listing command error after install google-authenticator on CentOS 7

Status CentOS 7.5.1804 (Core) Linux 3.10.0-862.14.4.el7.x86_64 Problem After I installed and setting google-authenticator packages, weird authentication related message keep shown when I use ...
6
votes
2answers
219 views

setting sudo password different from login password

I am attempting to use PAM to use a different password for sudo than I do for logging in. I worked off of this post originally Set sudo password differently from login one Unfortunately, every time ...
1
vote
1answer
175 views

GNOME: Different PAM configurations for lockscreen vs login

I recently purchased a U2F security key, and I have successfully configured my Ubuntu 18.04 machine to require authentication via the key as well as my usual password to log in. I am hoping to change ...
0
votes
0answers
42 views

case-preserving linux usernames and hostnames

Is there a way to set pam library to do case-preserving username validation? Is there a way to set useradd command to accept and preserve the case of usernames? I know usernames and URLs are not OS ...
0
votes
2answers
495 views

PAM Authentication Errors for one username. All other usernames log in properly

Red Hat Enterprise Linux 6.10 in VMWare virtual machine. We have several user accounts defined. One user account (user3) is unable to log in, either through SSH or the VMWare Console. It has logged in ...
0
votes
1answer
196 views

How to omit PAM log messages for specific user (pam_succeed_if quiet)

I'm using a monitoring agent (telegraf) to monitor fail2ban. Unfortunately, it requires SuperUser rights to execute fail2ban-client, which causes 24 system log messages every 10 seconds... Do the math,...
3
votes
0answers
173 views

Fedora 28: Generate kerberos ticket on login

I'm trying to generate kerberos ticket when I login on my computer(Fedora 28). I want to achieve it using PAM. my /etc/pam.d/system-auth looks like this: auth required ...
1
vote
1answer
153 views

PAM account interface vs /etc/shadow

According to the official Red Had documentation on pam for the account interface: account — This module interface verifies that access is allowed. For example, it checks if a user account has ...
1
vote
1answer
229 views

Deleted /etc/pam.d/common

I deleted all common-* files in /etc/pam.d folder and now I am locked out. I am running Ubuntu 14.04. I did backup all these files in a folder inside pam.d but now I can't even move them. If I try, ...
1
vote
1answer
256 views

password length with pam_cracklib.so

I ran a security scan in a RedHat Linux Server and got the following vulnerabilty: Incorrect System Default minimum password length or password complexity rules. Minimum password length should be ...
0
votes
1answer
26 views

Right place for user specific enviroment variables if you don't use a display manager

I recently purged my display manager in favor of starting xsessions with startx. I did this after setting up a new installation of ubuntu 18.04. Up to now I was used to use ~/.pam_environment to set ...
1
vote
0answers
18 views

Is it possible to pull additional info from LDAP during pam_ldap authentication?

I have additional ldap data that I'd like to store in the user's home when they first log into a client using pam_ldap. However, I can't seem to think of a way to make this work without prompting the ...
1
vote
1answer
193 views

Authenticate Linux<->LDAP Protocol<->AD(active directory): Fail to logon with password

Dears, I spent much time on this and even successfully verified (Auth)Linux-LDAP-openLDAP ok. But get blocked with AD.I can now switch to user from root account but can not log on with password(...
0
votes
0answers
42 views

journalctl -f is spamming “cannot create session” and “session opened for root user”, how can I get it to stop/fixed?

I'm using fedora 28. I don't understand why I'm getting these messages and would love some help so I can use journalctl -f for other things. This is a fresh terminal window and I hadn't tried su ...
2
votes
1answer
31 views

Is there a limit for line length in PAM config files?

How I got to this suspicion: I try to configure the proxy at my companies network. There are quite a few hosts that can only be reached without proxy, so I tried configuring $NO_PROXY in /etc/...
1
vote
0answers
262 views

pam_sss access denied with kerberos authentication ok [closed]

I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
1
vote
1answer
1k views

How do you add `cap_sys_admin` permissions to user in CentOS 7?

I tried adding cap_sys_admin permissions to user myroot. For this, I added these lines to /etc/security/capabilities: cap_sys_admin myroot none * and this line to /etc/pam.d/su: auth ...
3
votes
1answer
497 views

How do I allow crontab use for local accounts that don't allow interactive logins?

Ok, here's the situation (you're welcome for the earworm): I am running a multi-server RHEL 7 environment with SELinux enabled. Due to DoD STIG controls, I do not have root access, but I do have a ...
0
votes
1answer
290 views

How to stop Gnome Keyring from asking for Login password, like it used to?

Previously, Gnome Keyring only asked for the Default Keyring password when I attempted to launch Chrome. I tried playing around with settings in Seahorse to see if there was a work around for this, ...
7
votes
2answers
565 views

How to create a conditional PAM entry

I am testing PAM scenarios on RedHat 7.5 The pam module pam_succeed_if.so looks like the most basic level of conditional testing that PAM has to offer, and it is not meeting my needs. You can only ...
0
votes
2answers
1k views

(root) FAILED to authorize user with PAM (Permission denied)

When tailing /var/log/cron i noticed that the cron job is failing due to PAM permissions. In my access.conf i do have the following uncommented to make sure (or what i thought was making sure) that ...
1
vote
1answer
180 views

running pam_exec script after login complete

I'm parsing out the lastlog command into a custom file when a user logs in for use with another application that monitors SSH logins. In /etc/pam.d/sshd I have included the line and the very bottom: ...
3
votes
1answer
595 views

Using pam_exec.so to run a script as root when a user logs in (while extracting user information)?

Question How can I run a script as root when a user logs in with pam_exec.so (or otherwise)? The script requires information about the user to function. Problem and Environment I would like to run ...
0
votes
1answer
101 views

Regarding PAM via ldap

I have a question for the authentication between Linux and Windows. When I get an authentication from the OS system such as Linux, then I can use PAM by configuration of "/pam.d". However, it's the ...
0
votes
0answers
76 views

How to run custom script on local login failure in a screen locking program using PAM

I am trying to run a script every time a login failure occurs via a screen locking program (like SLiM, i3Lock, slock, etc.) I am running Arch. Also, to be clear, I am not talking about logging into ...
1
vote
1answer
723 views

How to make changes to pam config such that further execution of authconfig will not overwrite them?

I'm configuring a CentOS7 host (through ansible) running authconfig. Now I need to add/configure pam_exec module to the setup but it seems it is not supported by authconfig (cf. man authconfig and /...
1
vote
1answer
429 views

How does ssh or any other service work without pam?

I do not understand how ssh or any other service can work without pam. pam defines all the rules, if I understand correctly, calls other modules to set resources or restrictions etc. Can someone ...
3
votes
1answer
753 views

Ubuntu 16 Sudo SU Incorrect Password Attempts

I am using Ubuntu 16.04.3 LTS Server. I have a user with sudo privileges on it. When I attempt to switch from my current user to root, it asks for my password. I enter the correct password and it ...
1
vote
1answer
135 views

Is `pam_limits.so` used like a command?

From http://man7.org/linux/man-pages/man8/pam_limits.8.html SYNOPSIS top pam_limits.so [conf=/path/to/limits.conf] [debug] [set_all] [utmp_early] [noaudit] Does the ...