Questions tagged [pam]
Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.
665
questions
2
votes
1
answer
37
views
KRB5 autentication using sssd only checks first domain
I am using both RedHat and Ubuntu but I'll start with Ubuntu (18.04.6)
I want to authenticate with two KRB5 realms. (not joined to AD) Some users are in one some are in the other
I configured krb5....
- 320
0
votes
0
answers
25
views
How can I set capability to systemd user service?
I have a systemd user service (not system service with a User=), But I need grant NET_ADMIN to this service, how to do it?
I can use fcap, but I'm trying to find another way.
Thanks.
- 11
0
votes
0
answers
17
views
is it problematic to disable 'session optional pam_systemd.so' in etc/pam.d/common-session/ to execute one line to speed up boot time?
At boot im running following command:
su vis -c 'QT_QPA_PLATFORM=offscreen /usr/bin/browser --version'
/usr/bin/browser being a custom browser, which cannot be run as root. The script that is ...
- 1
0
votes
0
answers
22
views
How does CyberArk's password rotation mechanism interact with the Linux PAM module configuration?
I understand that CyberArk automatically rotates account passwords without requiring the current password, as would be the case in a manual change.
However, a recent update to the PAM module files has ...
- 11
2
votes
0
answers
36
views
Update password-auth Using Ansible
I would like to update /etc/pam.d/password-auth using Ansible to have the following line (or a similar one with the remember=5 argument added)
password requisite pam_pwhistory.so remember=5
If a ...
- 121
0
votes
2
answers
41
views
How do I get linux flavors, like Fedora, RHEL, Amazon Linux, and others that don't update motd on login to do so?
I am trying to get my Amazon Linux 2023 server to update the MOTD on login, not on a timer or by fiddling with the profile. I want a clean experience for users whether they re-exec their shell, or ...
- 111
2
votes
0
answers
29
views
Successor of pam_tally2
I am using pam_tally2 for some time to count failed logins.
/etc/pam.d/common-auth
auth optional pam_tally2.so onerr=succeed audit debug
I had integrated it into pam and when I needed the ...
- 625
0
votes
1
answer
57
views
Does updating password policy using PAM force existing users to change their password in the next login?
I plan to configure PAM config files on a SUSE server with the rule below:
Current rule is:
password required pam_cracklib.so dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=9
Rule after change ...
0
votes
0
answers
76
views
How to setup PAM fprint grosshack with GDM?
I was following the login configurations of fprint - ArchWiki, and I wanted to use pam-fprint-grosshack with GDM.
I couldn't find any information about it, because the wiki says at the beginning of ...
- 141
0
votes
1
answer
100
views
centos7 cron job pam_limit invalid line hard nproc skipped
I am getting the error:
May 29 19:15:02 vps3.domain.com crond[19846]: pam_limits(crond:session): invalid line 'user3 hard nproc ' - skipped
May 29 19:15:02 vps3.domain.com crond[19846]: pam_limits(...
- 115
0
votes
1
answer
116
views
How does the credit system work in pam_pwquality?
Something has been really bugging me in he manual for the pam module pwquality (see man pwquality.conf).
I quote:
minlen
Minimum acceptable size for the new password (plus one if ...
- 1
2
votes
1
answer
94
views
How to require manual approval for ssh logins
I would like to require a manual approval (by means of physical access, like GUI or framebuffer console) from the device being ssh'd to before letting in any connections. Presumably it would need to ...
- 139
1
vote
0
answers
79
views
Adding extra PAM modules on yocto
I'm new to yocto, I'm trying to add the 'pwquality' pam module to the image but I'm struggling with it, initially I have added this line to the local.conf file:
DISTRO_FEATURES:append = " pam&...
- 11
2
votes
1
answer
185
views
How to config SSH authentication with all 3 components: publickey, password and OTP
Update 1: I'm able to apply all publickey + password + OTP with this basic config in /etc/pam.d/common-auth.
auth [success=ok] pam_unix.so
auth [success=1] pam_google_authenticator.so nullok ...
- 21
0
votes
0
answers
149
views
How to change the timeout between incorrect password attempts in SDDM?
When entering a password, either in terminal or on login screen (in my case SDDM), the default timeout between incorrect attempts is around 2 or 3 seconds. I want to change it to something lower as I ...
- 101
1
vote
1
answer
279
views
Why is pam_unix.so set "required" even when LDAP is enabled?
On my Rocky Linux 9.3 machine, LDAP authentication is enabled by authselect and is working fine. I can ssh into this machine by both local accounts and LDAP-only accounts. However, my /etc/pam.d/...
- 13
0
votes
0
answers
53
views
Need password authentication while runing "systemctl stop .service"
I am looking for a way to add one more password authentication to run
systemctl stop abc.service
via root access.
I am using Rocky Linux.
I have no idea if it is even possible. Please help.
0
votes
0
answers
35
views
Override PAM module options
Is it possible to override PAM module options for a module that appeared earlier in the PAM stack?
For example, I have /etc/pam.d/sudo:
#%PAM-1.0
# Set up user limits from /etc/security/limits.conf.
...
- 626
0
votes
0
answers
16
views
ways to identify PAM prompts?
Is there a way to identify when PAM prompts on the terminal? something similar to sudo/doas which allows to set a prefix for all their messages, or override it entirely (e.g. env SUDO_PROMPT)
- 488
1
vote
0
answers
34
views
SSH Display custom message at login if correct password but no public key
We're moving a server (running Ubuntu Server 23.10) from "password or public-key" auth to "public-key only". I'm looking for a way to make ssh auth behave like this:
If public key ...
- 1,006
0
votes
1
answer
46
views
How to login as root user after deleting system-auth
I wanted to use an old password for my account.
I am using OpenEuler OS distribution.
After searching on Stack Exchange, I found this link.
How can I reuse an old password?
I followed the exact same ...
1
vote
1
answer
245
views
su : connect to another user with D-BUS activated [duplicate]
I created a user that run timers and service with systemctl --user. When I try to login via ssh, I have no issue with systemctl --user. But when I connect to this user with su, I have a bus error:
me@...
- 141
0
votes
1
answer
161
views
Can we use bi-key authentication with dovecot & thunderbird?
I run the dovecot imap server and use thunderbird as frontend.
The access is password protected, and I see zillion login attempts with leaked passwords. I would like to switch to bi-key authentication ...
- 211
0
votes
1
answer
140
views
Is "pam_unix(cron:session): session opened" misformulated? [duplicate]
$ journalctl -g sudo -S today
Jan 21 00:02:02 limbo sudo[3898480]: pam_unix(sudo:session): session opened for user root(uid=0) by seca(uid=1001)
Jan 21 00:02:02 limbo sudo[3898480]: pam_unix(sudo:...
- 177
0
votes
1
answer
550
views
Enable faillock on Debian 12
Can anyone tell my how to enable faillock on Debian 12?
I had a look to several tutorials but nothing worked for me.
This is what I get after installation - without comments.
/etc/pam.d/common-account
...
- 625
0
votes
1
answer
503
views
Debian 12: pam_tally2 gone?
I am using pam_tally2 on an old Debian 10 to cound failed logins.
Now I was trying to do the same on Debian 12. But it seems there is not pam_tally2 anymore.
Whats the idea to count (only count, not ...
- 625
0
votes
0
answers
144
views
Void Linux won't start past command line anymore after editing pam.d files
Asking for help as a last resort before just fully reinstalling. I'm running Void Linux and just installed it yesterday on my new laptop, however I can no longer boot.
This is what I did:
First i did ...
0
votes
1
answer
134
views
Why SSSD Service override_homedir triggers creation of home directory with wrong permissions?
I have a vendor application installed in an Ubuntu Jammy server that relies on SSSD v2.6.3 configured for LDAP integration for the authentication and creation of the home directory of the user in the ...
1
vote
2
answers
3k
views
Debian "Login Incorrect" for all users before entering password
I think I've got a dead system now, but I don't know how to recover.
I was updating from Buster to Bookworm with the standard method outlined here - https://wiki.debian.org/DebianUpgrade
After ...
- 141
2
votes
1
answer
566
views
How to unlock kdewallet with FIDO2 key
I am using a FIDO2 key to login into my KDE session, but then KDE wallet asks for a password. I am using it and find it quite useful to keep keys, ssh passwords, etc in one place.
Is there a way to ...
- 153
0
votes
1
answer
79
views
How to enable debug messages for pam_systemd_home.so?
The manual for pam_systemd_home states that debug messages can be enabled with debug=yes, but they don't state where to put it.
I tried adding the options to the relevant lines in pam.d/system-auth, ...
- 3
1
vote
0
answers
1k
views
PAM - Disabling "check pass; user unknown" syslog messages
TLDR: We use PAM with SSHD. CentOS and Ubuntu exist in the environment. For every SSHD failure of an unknown user, it creates two messages. One of the messages doesn't provide the unknown username and ...
2
votes
1
answer
79
views
pam_exec cannot call systemctl due to SELinux
I'm trying to execute a script every time an SSH session starts and ends, on CentOS 7. This script should start/stop a systemd service.
This is my setup:
In /etc/pam.d/sshd, I added the following ...
- 131
0
votes
0
answers
121
views
WSL Ubuntu sessions are never actually closed (unless I SIGKILL them)
I have a WSL Ubuntu instance on my Windows 10 machine. The Ubuntu instance has different users. If I reboot the Ubuntu instance, and log in as root, I can see (using w) that no sessions exist except ...
- 953
0
votes
0
answers
710
views
How to authenticate with password in terminal, with fprintd authentication enabled?
I enabled fingerprint authentication on my laptop running Debian 12 by following this guide:
$ doas apt install fprintd libpam-fprintd
$ fprintd-enroll -f right-middle-finger
$ fprintd-verify
$ doas ...
- 227
2
votes
0
answers
37
views
How to skip further PAM checking when breaking from a command (SIGINT / ctrl+c)?
I have a custom PAM setting for sudo, to use Howdy, an application using face recognition for authentication.
My current /etc/pam.d/sudo looks like this:
#%PAM-1.0
auth sufficient pam_unix.so ...
- 409
0
votes
2
answers
178
views
Run PAM script only when logging in using su
I have a script in /usr/local/bin that I reference in /etc/pam.d/su using:
session optional pam_exec.so stdout /usr/local/bin/script.sh
It runs as expected when I login to user from root using su ...
0
votes
0
answers
236
views
Allow sudo but no local login with pam access
Assume we have two servers A and B
A: Heavily locked down. Requires TOTP (google authenticator), password and valid public key. This server allows users to log into B
with their adm accounts (...
- 165
0
votes
0
answers
112
views
Account unlock is not happening even after unlock_time
I want to lock user account after 3 failed attempts, I am following this guide. I am using Ubuntu 14.04 (for jumphost purposes only). However, the automatic unlock is not happening after 10 minutes. ...
- 11
1
vote
0
answers
90
views
Shutdown after X failed login attempts
I have a laptop with Xubuntu 22.10, whose SSD is encrypted with LUKS, so if it's stolen when shut down, my data should be safe. But it's more likely to be stolen while it's switched on, and then only ...
- 11
0
votes
0
answers
164
views
pam_sss(sudo:auth): unknown option: minimum_uid:6000
I've recently tried to convert my Rhel7 configuration to my Rhel9 setup.
I'm running into some issues when it comes to authselect and system-auth configuration file.
For Rhel7 I used following:
auth ...
- 177
5
votes
0
answers
4k
views
How to setup passkey authentication in Linux?
I have setup the PAM module pam_u2f.so for FIDO2 as the primary authentication method on my LMDE 5 (based on Debian 11) machine.
Is there a way to integrate passkey support with this PAM module or ...
- 228
0
votes
0
answers
394
views
Configuring Sudo to use AD/LDAP password
Looking into the feasibility of configuring our VMs (RHEL 8) so users in the wheel group use their LDAP password to authenticate for Sudo
What I've done so far is configured sssd for LDAP ...
0
votes
0
answers
185
views
PAM: Master Password
I want to create a master password that can log into any user account on a system without needing root privileges (but we can use root to create and set up the master password). In other words, I need ...
- 1
0
votes
1
answer
633
views
pam_exec.so not running command or logging anything
I have created a new authselect profile with
sudo authselect create-profile login-hooks --symlink-meta --symlink-nsswitch --symlink-dconf --base-on=sssd
Then I appended the following line to /etc/...
- 1,249
1
vote
0
answers
202
views
SSH Authentication Prompts Twice for Password When Using PAM with Google Authenticator
I'm setting up two-factor authentication (2FA) on an Ubuntu server using libpam-google-authenticator. I've configured SSH to use PAM for authentication with the following /etc/pam.d/sshd configuration:...
- 11
1
vote
1
answer
87
views
How to prompt "su" to re-request a password on an incorrect entry?
Default su behaviour :
system@sword:/etc/pam.d$ su - test
Password:
su: Authentication failure
<su exits>
I need to configure "delay" when someone enters an incorrect password for ...
- 11
0
votes
1
answer
600
views
PAM password "minlen" setting not enforced
I installed Ubuntu 18.04 and manually modified /etc/security/pwquality.conf with the following settings:
minlen = 14
minclass = 4
(without # at the start of the line).
However, when I add a new user ...
- 369
0
votes
2
answers
2k
views
How to use PAM to allow 'root' access only from local terminal?
I am new to PAM and its quite complex to pinpoint a specific module or config file, thus asking this.
I want to allow root access only from the console i.e if someone is physically present on that ...
- 11
0
votes
2
answers
406
views
Difference between *LK* in /etc/shadow and /usr/sbin/nologon in /etc/passwd
What is the practical difference between setting *LK* in /etc/shadow and setting /usr/sbin/nologon in /etc/passwd?
When would we choose one over the other? When would we combine them?
- 113