Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

How to reset PAM files

I was recently trying to set up Yubikey with macOS, and somewhere along the lines, something went wrong. Whenever I use sudo, I get sudo: unable to initialize PAM: No such file or directory. I have ...
0
votes
0answers
51 views

pam_ldap: how to hide password hashes in getent output

My question is similar to this. I use pam_ldap for users auth. /etc/nsswitch.conf file contains: passwd: files ldap group: files ldap shadow: files ldap All seems to be OK, ...
0
votes
1answer
12 views

What is the purpose of the pam_stress module?

There is currently very little documentation for this Linux-PAM module, and I am struggling to understand what it might be used for? Reference The Linux-PAM System Administrators' Guide pam_stress ...
0
votes
1answer
20 views

Disable local user PAM, enable root user with LDAP

I am trying to setup a Linux machine with LDAP authentication and root account enabled. There is no issue with the LDAP server and everything works fine. I wanted to disable local users so I tried ...
0
votes
0answers
39 views

Use Network Namespace for SSH Tunnel

I have an Ubuntu 18.04 server in which I've created two virtual interface pairs (veth0a & veth0b) and assigned the end of one interface (veth0b) to a new network namespace (netns0): ip netns add ...
0
votes
1answer
27 views

Making wheel group membership sufficient for su on SLES 2015

I'm using SLES 2015. I want to make membership in the wheel group sufficient for root-privilege access via su. From Debian distributions, I'm used to uncommenting the command: auth sufficient ...
0
votes
1answer
50 views

Why is pam_env.conf ignored after I su into root user?

I'm trying to do: su -l and set environment variables like PAGER without success. How can I achieve this? This is what I have in /etc/pam.d/login: auth required pam_securetty.so auth ...
0
votes
1answer
85 views

Setting up a passwordless login with a U2F token (Yubikey 5)

I am trying to set up a passwordless login for Linux Mint 19.3, in order to be able to log in either with a Yubikey token or a password. I followed the instructions from Yubikey website and this ...
1
vote
1answer
35 views

pam_umask.so doesn't work

I try to configure pam.d on a centos 8. I wanted to configure system wide umask to 0077 in /etc/pam.d/postlogin. postlogin is included by several services under /etc/pam.d e.g. su, su-l My postlogin ...
0
votes
0answers
28 views

Can Samba use a file containing a blacklist of users?

I currently use pam_listfile.so to blacklist users trying to log in via ssh, with a line like this in /etc/pam.d/system-auth: auth required pam_listfile.so item=user sense=deny file=/etc/users....
2
votes
2answers
124 views

PAM — completely disable password login

I am trying to improve the Security of my overall IT Infrastructure, so I started out to use a smart card for login. I have managed to configure a PIV Smart Card with a private key and a x.509 ...
0
votes
0answers
32 views

Hook into private key authorization

I have a VPS with ubuntu 19. It only has one user with a password which can be used to ssh into it. I have modified /etc/pam.d/common-auth the following way: Before: # here are the per-package ...
0
votes
0answers
68 views

How to stop logging brute force attempts to login via SSH?

I have done the following: Changed the SSH port Automatically block recurring offenders Disable root login Only accept public key authentication But alas, these brute force attempts persist and I ...
1
vote
1answer
102 views

Why does this PAM code prevent all logins to a Debian system?

Why does adding this line to /etc/pam.d/common-auth: auth required pam_tally2.so deny=4 unlock_time=1200 even_deny_root and adding this line to /etc/pam.d/common-account: account ...
0
votes
2answers
90 views

“Xorg” process does not take limits from /etc/security/limits.conf

I have this in my /etc/security/limits.conf: #<domain> <type> <item> <value> root - memlock 65536 root - stack 524288 root ...
-1
votes
1answer
24 views

could a password policy be dynamic, depending on password lenght

I would like to set different password complexity depending for exemple on the password length. Is it possible to make conditions, so I can have a high level of complexity with password length=8 and ...
1
vote
1answer
132 views

What is the difference between pam_faillock and pam_tally2?

To block a user after a preset number of failed login attempts, one would use a module like pam_tally2 or pam_faillock. What is the difference between these two? Which one should I use when?
0
votes
0answers
17 views

pam/openssh disable ssh for a user but leave scp intact?

I've set up a user. I'm using pam_chroot.so in pam so that they are chrooted to a directory. They can currently ssh and scp to that location. How can I disable ssh for that user?
1
vote
0answers
55 views

Did I break my PAM configuration files? My user password is no longer accepted

I followed a guide online and installed some PAM modules: sudo apt-get install libpam-modules libpam-pwquality libpam-cracklib My standard user account "jon" has sudo privileges but now if I try to ...
0
votes
1answer
72 views

How can I hide failed ssh attempts for users that don't exist?

The Question How can I exclude inconsequential¹ failed SSH logins? Background For ambient awareness, I like to have little background windows showing system error logs on every GNU/Linux box I ...
2
votes
0answers
14 views

Why symlinking pam_unix.so to pam_unix_acct.so and other three files?

On CentOS, pam_unix.so is linked to the following 4 files: lrwxrwxrwx. 1 root root 11 Oct 11 2016 pam_unix_acct.so -> pam_unix.so* lrwxrwxrwx. 1 root root 11 Oct 11 2016 pam_unix_auth.so -&...
1
vote
1answer
35 views

Is it good or bad to use group in sudoers file instead of using user_aliases?

I have used user groups heavily while designing access control policies. I find user groups very convenient as it's very easy to implement with PAM. Another reason I have organized the users with ...
0
votes
1answer
72 views

How to stop PAM messages in auth.log for a specific script run with sudo?

I've set up a bash script to run automatically (from crontab) with sudo privileges using this visudo solution. Since the script requires multiple runs, it pollutes my /var/log/auth.log, so I disabled ...
0
votes
2answers
67 views

selinux prevents pam_exec command from being executed

I am trying to setup my computer to notify me every time a user logs in (via ssh, via gdm or tty). Right now I am setting up sshd and I added this to /etc/pam.d/sshd: session optional pam_exec.so /...
0
votes
0answers
76 views

How to unlock Gnome Keyring after passwordless login with Solokey (Yubiko)?

I experimented on a Ubuntu 19.04 system a bit and took a look here: https://schulz.dk/2019/08/23/using-solokey-for-linux-login/ and here: https://wiki.gnome.org/Projects/GnomeKeyring/Pam#...
0
votes
1answer
18 views

Linux PAM: Mapping between configuration and application

I have multiple files in /etc/pam.d. I think they slightly differ in name between different distributions. And I also do not see a direct connection between process-name and configuration (e.g. ...
0
votes
0answers
6 views

changing date format used by pam_lastlog.so

When I log in via ssh, the motd gets printed. Among other things: Last login: Mon Nov 4 06:53:02 2019 from 12.34.56.78 I believe thsi comes from the pam_lastlog.so as configured in /etc/pam.d/login:...
0
votes
0answers
61 views

pure-ftpd: (?@?) [ERROR] Unknown authentication method: pam

I am using CWP for VPS server, but FTP stops working after I restart the server. before that, I have upgraded MariaDB and change hostname.FTP was working even after I upgraded MariaDB and restart the ...
3
votes
2answers
408 views

/etc/pam.d/ rules for ssh and login

In /etc/pam.d/, the configuration files for sshd and login have some rules for selinux. Can I simply disable those lines, when I am not using selinux ? I would like to simplify the pam rules. ...
0
votes
0answers
13 views

Change the default mount option on encryptfs home during login - pam_mount

I've Linux Mint 18.3 Sylvia and I've set up the encrypted home. It works fine out of the box. It is mounted with these default options: mount | grep /home /dev/sda1 on /home type btrfs rw,noatime,...
1
vote
0answers
56 views

Debian 10: how to make faillog count

I have faillog installed by default and there is also /var/log/faillog. But the file is always empty. As far I found out I need to adjust some pam-files in /etc to enable it. I read about pam_tally, ...
0
votes
1answer
42 views

limits.conf is not working

I'm trying to set default niceness/priority for a user's processes on Ubuntu 18.04.3 LTS in limits.conf and everything I write in limits.conf is simply ignored. Hard nice, soft nice, hard priority, ...
0
votes
0answers
19 views

scan for values in system-auth-ac

I'm working on automating checking password values on my systems. Wondering the easiest way to grab the values on dcredit ucredit etc. from the system-auth-ac file using grep or something similar?
0
votes
1answer
74 views

How to achieve Linux privilege escalation by polkitd without password but with Yes/No prompt?

I want to implement Window's UAC like access control using polkit(d). So if I open Network manager or printers, it should ask me yes/no. No password prompt but window must be showed to user. I tried ...
0
votes
0answers
20 views

SSH Logins failing for all users, even when using correct password. Can only connect via console using root

So, I have a RHEL 7 server that is IPA joined. Users are not able to login, even when using the correct passwords. I can login through console, but only with root, none of the IPA accounts will work. ...
1
vote
2answers
539 views

PAM configuration with Kerberos authentication but without need of local accounts

I have a working Kerberos authentication tested with kinit on Debian Buster. Now I try to use it with PAM for login with Kerberos and installed libpam-krb5 and configured it with pam-auth-update. But ...
1
vote
0answers
69 views

pam_access won't work when logging in with SSH CentOS

I am working on configuring access for my machine with PAM. I am using CentOS 7.6.1810 (core). I really want to use PAM because it will allow me to set users that can log in in exactly one place once ...
0
votes
0answers
42 views

Configure PAM to ask for 2FA token even if password is incorrect

I have Google 2FA set up for ssh password logins. Works fine, but if possible I'd like to tighten a small security hole: if the password given is correct, it will then ask for the 2FA token. If the ...
0
votes
1answer
73 views

Differentiate during PAM authentication SSH session vs SSH inline commands

During authentication of SSH user, is there a way we can tell between SSH session vs SSH inline command? I have tried checking tty but they are coming up the same in both cases for me. In my scenario,...
0
votes
0answers
136 views

SSH Key Auth failed … sometimes with SSSD

I have an issue with one of my server I use keys to authenticate on my server with AD account, it works most of the time. SSSD module is used to authenticate AD user. Sometimes i can't authenticate ...
0
votes
0answers
109 views

How to enable TOTP-only authentication for SSH on Ubuntu 19.04?

I am trying to allow login to a server with only TOTP and I've installed libpam-google-authenticator and connected Google Authenticator app. Here are my relevant settings: /etc/ssh/sshd_config ...
0
votes
0answers
37 views

Xrdp login using MFA

I am trying to include mfa while xrdp login using AD user. I am looking for configurations to include both the password and the mfa(push notification or otp). For mfa i am using gemalto service. The ...
0
votes
1answer
83 views

GoogleAuthenticator PAM Module Permissions Issue — VPN with MFA in AWS EC2 running CentOS

Full Disclosure: I am writing this question to then answer it myself. I searched the internet for a full day at work and was not able to find a solution that worked for me. I even compiled my own ...
0
votes
1answer
197 views

Linux PAM rule “pam_unix.so” module above “pam_faillock”

I would like to know what this below PAM rule auth [success=1 default=bad] pam_unix.so above the pam_faillock.so rule is doing auth required pam_faillock.so preauth audit silent deny=5 unlock_time=...
0
votes
0answers
18 views

Where does Chef store credentials for Active Directory user accounts on Linux hosts?

From a security perspective, I'm looking into how Active Directory user accounts, for which folders are created in /home, are integrated into the Linux host. I would expect the account names of these ...
0
votes
0answers
16 views

Red Hat: Back-Off time during failed authentication attempts

I am searching for a way to configure some sort of back-off or wait time during failed authentication attempts. The idea is that after each failed authentication attempt, the user has to wait an ...
0
votes
1answer
58 views

cryptsetup and passphrae restrictions

I'm trying to encrypt a new HD to add to my Red Hat server. I have two other drives that are already encrypted with a passphrase. However, when I try to use the same passphrase on the new drive I get: ...
0
votes
1answer
47 views

Skip PAM authentication module for specific SSH certificates

I use Yubikey's PAM module as an extra layer of authentication on my server. I want to skip this authentication module when a device tries to authenticate using a specific SSH certificate. I know ...
1
vote
0answers
37 views

How to set up SSH 2FA with either publickey+token or password+token?

I have tried to set up PAM authentication for SSH to a Ubuntu 18.04 server (by modifying the instructions in this guide). I am attempting to set the login so that any of these two combinations is ...
0
votes
0answers
279 views

pam_tally2 not working as expected?

I have been using pam_tally2 to lock a user after certain number of failed attempts through ssh. In /etc/pam.d/common-auth added auth required pam_tally2.so deny=3 unlock_time=600 In /etc/pam.d/...

1
2 3 4 5
10