Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
94
votes
3answers
32k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
33
votes
2answers
16k views

How does one change the delay that occurs after entering an incorrect password?

After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?
56
votes
5answers
94k views

Allow user1 to “su - user2” without password

I need to allow user martin to switch to user martin-test without password su - martin-test I think this can be configured in /etc/pam.d/su. There are already some lines in that file which can be ...
31
votes
2answers
71k views

How do I force a user to change a password at the first time login using ssh?

I'm trying to force a newly created user to change a password at the first time login using ssh. For security reasons I want to give him a secure password until he logs in for the first time. I did ...
17
votes
4answers
23k views

How to stop sudo PAM messages in auth.log for a specific user?

I am using Zabbix for monitoring my environment and zabbix_agentd executes as user zabbix one custom script every 60 seconds; it uses sudo to run this script as root. In /var/log/auth.log I see every ...
13
votes
7answers
53k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
4
votes
1answer
9k views

Securest way to authenticate users against /etc/shadow using PHP?

This question became important to me, since I'm setting up a Horde environment and want to use the system accounts. Doing some search I found mainly 4 ways of doing that, which all seem to have some ...
12
votes
2answers
97k views

How to lock users after 5 unsuccessful login tries?

How to lock users after 5 unsuccessful login tries? I gathered a few distributions/versions to how to do it, but I can't test it. RHEL4: by adding the: auth required /lib/security/$ISA/...
4
votes
1answer
853 views

How to allow unauthenticated logins over ssh on FreeBSD?

I created an account ckurs on my FreeBSD 10 workstation. This account uses a custom shell-script as a login-shell that attaches the user to a tmux-session in read-only mode. I have sufficiently ...
11
votes
1answer
12k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
5
votes
1answer
2k views

Run Script at fail login attempt?

Lately, I've been trying to create a Bash script to capture a webcam photo when a fail attempt to login is registered. First of all, I found 2 guides related to this (links at the end), they explained ...
1
vote
1answer
949 views

How to add a user that accept any password as a valid password?

How to add a user that accept any password as a valid password? PS: I am aware of the security issue. The user will have a very restricted access (as the guest user in Ubuntu). related question: ...
3
votes
1answer
3k views

What is the difference between pam_unix and pam_systemd?

As I know, there are many pam modules #ll /usr/lib64/security/ | grep pam | wc -l 57 #ll /usr/lib64/security/ | grep pam_unix.so lrwxrwxrwx 1 root root 11 Apr 14 23:40 pam_unix_acct.so -> ...
1
vote
0answers
3k views

With pam_script, how do I pass PAM_AUTHTOK and PAM_USER in all cases?

I need to run a script whenever a user enters a password; the script should be able to reject that password, but shouldn't be sufficient. I placed the script in /etc/pamunlockscript/pam_script_auth ...
2
votes
1answer
1k views

sshd[5589]: error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session

I am working with a CentOS7 minimal install. I configured pam_radius with pam_script and was always able to ssh to the server using pubkey auth: that was on purpose. But after hardening the server ...
0
votes
2answers
3k views

newgrp and groups assigned via pam_group.so

For convenience reasons I tend to assign special group memberships like floppy, audio, plugdev, video etc. via /etc/security/group.conf (pam_group.so) mechanism instead of adding all users to this ...
20
votes
3answers
4k views

How to prevent shutdown when an SSH user is logged in?

I'm administrating a networked environment and I had an interesting situation arise yesterday. When a host is required to shutdown by a regular user, it refuses to do so if other users are logged in ...
12
votes
3answers
27k views

Expired password and SSH key based login with UsePAM yes

There is a SLES 11 machine. The users logs in via SSH and pubkey (mixed, some user uses password, some use ssh key) The sshd_config has: UsePAM yes PasswordAuthentication yes PubkeyAuthentication ...
7
votes
3answers
3k views

Use multiple PAM login methods at once?

I'm using pam-fprintd as a login method. Currently it works perfectly for logging into the cinnamon screensaver and sudo. Unfortunately you have to fail the fingerprint login a certain number of times ...
5
votes
1answer
3k views

How to achieve conditional PAM authentication?

I am currently using auth required pam_unix.so try_first_pass nullok auth optional pam_ssh.so use_first_pass (plus some other, probably irrelevant entries Arch Linux added by default), which means ...
14
votes
4answers
2k views

Groups differ from the local ones when logging in remotely

We store our users in LDAP, alongside some groups that have meaning across different systems (organizational roles including wheel). There are also groups local to workstations, e.g. audio or video ...
14
votes
2answers
5k views

Why does sudo -i not set XDG_RUNTIME_DIR for the target user?

XDG_RUNTIME_DIR is necessary for systemctl --user to work. I have set up ubuntu server 16.04 to run systemd user sessions. Now, when trying to administer them, I find that when changin a user via ...
5
votes
1answer
10k views

How does the (sd-pam) process get away with unprivileged `pam_session_close()`?

Is it a bug? https://github.com/systemd/systemd/blob/v234/src/core/execute.c#L1126 /* Drop privileges - we don't need any to pam_close_session * and this will make ...
4
votes
1answer
10k views

How do you add `cap_sys_admin` permissions to user in CentOS 7?

I tried adding cap_sys_admin permissions to user myroot. For this, I added these lines to /etc/security/capabilities: cap_sys_admin myroot none * and this line to /etc/pam.d/su: auth ...
6
votes
2answers
5k views

Disable password complexity check (PAM)

I installed a Linux based system with a blank password. I wanted to change password to something simple, but using passwd and setting the password to something like a single symbol gave an error of “...
4
votes
1answer
4k views

What is pam_unix2 / why doesn't it exist on some distributions?

Some documentations, blogs and forums and other examples on the web use pam_unix2 in /etc/pam.d/ configurations. An example taken from pam_winbind manpage: auth required pam_env.so auth ...
4
votes
2answers
7k views

How can I bypass Fedora's password complexity requirments?

On a fresh install of Fedora 19 I am attempting to change the password to something simple, like Password01 (this is just a simple testing VM, nothing fancy), but the password complexity requirements ...
4
votes
2answers
40k views

how to restart pam.d service after changing of common-account-pc or common-auth-pc

I am having trouble with a configuration line in common-account-pc & common-auth-pc that denies also root access: account required pam_tally2.so deny=10 onerr=fail unlock_time=600 ...
3
votes
1answer
506 views

How to block shutdown or reboot in Debian xfce when other users logged in

I want to prevent users to start shutdown or reboot when another user is logged in. Users can be a TTY user (Ctrl+Alt+F3) or a ssh user from a client host. In OpenBSD, I use polkit org.xfce.session....
2
votes
2answers
14k views

What does “Cannot make/remove an entry for the specified session” mean?

Instead of logging me in, PAM greets me with the message "Cannot make/remove an entry for the specified session" after I enter the password. What entry is it talking about (and what session)? The ...
1
vote
0answers
65 views

Did I break my PAM configuration files? My user password is no longer accepted

I followed a guide online and installed some PAM modules: sudo apt-get install libpam-modules libpam-pwquality libpam-cracklib My standard user account "jon" has sudo privileges but now if I try to ...
9
votes
1answer
1k views

What steps does the system go through when handling an SSH connection?

What steps does the system go through when handling an SSH connection? We try to log in via ssh sshd starts pam and pam module to authenticate us Depending on pam configuration, we need to provide ...
8
votes
4answers
7k views

Is it possible to change password database file(/etc/passwd) in linux?

Is it possible to change password database file(/etc/passwd) to some other file. How does this authentication mechanism work internally ? Does it depend on pam ?
5
votes
2answers
3k views

What are the reasons Slackware still refuses to include PAM?

I know that Pat Volkerding didn't include PAM back in the day when it was considered by some to be messy or inconsistent, although that doesn't really seem to be the case today with PAM being ...
5
votes
1answer
2k views

What SELinux context should the script have to be ran by pam_exec?

I just installed Fedora 22 on my VPS and tried to make trivial thing -- run my informer script on every ssh login via pam_exec. But I was confronted with unexpected difficulties: pam_exec failed with ...
1
vote
2answers
2k views

Ldap SSH Login not working - Same configs worked on 20+ other servers - Ubuntu

So I have setup LDAP Login on every server at my work successfully except one. Of course there has to be that one! And I want to close my jira ticket, but I can't figure out what the issue is. The ...
1
vote
1answer
507 views

hard vs - in limits.conf

What benefit is there in specifying "-" for limit type versus specifying "hard?" The man page for limits.conf on CentOS says of the limit type, "hard ... The user cannot raise his requirement of ...
1
vote
3answers
104 views

What is the exact definition for “logging in”

Radu's answer is extremely informative here https://askubuntu.com/questions/376932/why-who-command-does-not-shows-root-as-a-logged-in-user However this makes me wonder "what is the exact definition ...
0
votes
0answers
99 views

How can I add PAM functionality in netkit-rsh-0.17

I am using CentOS. In my project, that is working on a network, I need an rsh utility. I downloaded netkit-rsh-0.17 for that and until recently all worked fine. But now I found that this utility ...
-1
votes
2answers
194 views

Why rsh not opens and reads PAM modules and limits.conf?

I am working on a project, that uses rsh utility for remote connection. But my project needs some extra features for that, so I add that features. Till now, all the things are going fine. But when I ...