Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

202 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
1answer
636 views

Can SSH public key authentication use pam_group?

I'm configuring some servers to use LDAP (via PAM) to authenticate users. Additionally, I use pam_group to add all users to some system groups like audio/video/vboxusers/.... My PAM configuration ...
5
votes
1answer
918 views

Pass login messages to tmux

When I login, I connect to a tmux session (either by exec'ing tmux if there is no current session, or exec'ing tmux attach if there is). However this means I don't see the login messages (/etc/issue, /...
4
votes
0answers
493 views

WebDAV server with PAM auth and system file permissions?

Basically, what I'm looking for is Samba - except that I want it to be WebDAV in the front. The requirements are that the users can log in to the WebDAV dir with their system account, and files will ...
4
votes
0answers
2k views

Linux Authentication Flow (NSS -> PAM -> AD)

I am a new system administrator at an organization looking to understand the process flow of authentication in regards to how NSS, PAM and WINBIND work together. We've been having winbind related ...
3
votes
2answers
1k views

How to show “number of failed login attempts” on a successful ssh login?

I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this: Last failed ...
3
votes
1answer
156 views

How to prevent 'chpasswd' linux command by time or days with pam?

I have Ubuntu 18 OS and I am trying to prevent all users from running 'chpasswd' command after 17:00 o'clock. I need to use pam for this. My /etc/pam.d/chpasswd file: # The PAM configuration file ...
3
votes
0answers
405 views

Fedora 28: Generate kerberos ticket on login

I'm trying to generate kerberos ticket when I login on my computer(Fedora 28). I want to achieve it using PAM. my /etc/pam.d/system-auth looks like this: auth required ...
3
votes
1answer
519 views

Keyless, passwordless SSH login on localhost not possible, PAM relation assumed

I would like to login to 127.0.0.1 via SSH without using a public key and password. sshd_config and log files are provided below, so here's just a quick outline: The user accounts password is deleted ...
3
votes
1answer
206 views

Determine which name service created entry in database (eg passwd)?

On Linux and Unix-like systems the Name Service Switch is used to gather entries for the systems name databases. There are databases such as files, dns, nis and ldap. Is it possible to determine for ...
3
votes
0answers
364 views

Print list of all PAM modules traversed

Is there a way to print a list of all modules that PAM processed by tweaking a global config option? I have [success=1/2] for some modules and want to print the exact sequence of modules that were ...
3
votes
0answers
209 views

pam_winbind is logging passwords

Occasionally, a systemd unit using a pam module that uses pam_winbind logs a users password. Systemd unit log: Mar 25 15:47:41 display-server node[5969]: pam_succeed_if(grooming:auth): requirement "...
3
votes
0answers
276 views

How to report current usage for a user on ulimits aka pam_limits etc?

Every SA sooner or later runs into a user hitting a ulimit like open files or number of processes. There must be a simple mechanism to track and test against usage of these limits, or ulimits would ...
3
votes
1answer
1k views

How to login with both password and fingerprint?

How to configure PAM to require both password and fingerprint to log in? I can do a password / fingerprint login but not both by changing /etc/pam.d/common-auth For password only auth [success=...
3
votes
1answer
2k views

libpam-pwquality not working in Ubuntu 16.04

I installed libpam-pwquality: sudo apt-get install libpam-pwquality And configured /etc/pam.d/common-password: password requisite pam_pwquality.so retry=3 minlen=10 ...
3
votes
1answer
1k views

Freeradius PAM create user and home on login

At this moment i have installed freeradius and PAM radius properly. When i create an account on the system and set a password in /etc/raddb/users.conf the user can login. Sudo also works great with ...
3
votes
0answers
888 views

Unable to log into Cockpit server - could not set limit for 'nofile'

I have Cockpit installed on a Fedora 22 VPS that I use for educational purposes. I tried logging into Cockpit from my browser, but I was given a "Permission denied" message, despite using the correct ...
3
votes
1answer
1k views

Debian ignores PAM env variables (while Arch doesn't)

I have a weird issue with my Debian Sid system. I want to set a global environment variable in /etc/environment, which is supposed to be read by the pam_env module. Unfortunately, after having relogin ...
3
votes
2answers
3k views

Warn about password expiration without forcing change

It's pretty simple. I would like to figure out what combination of changes in /etc/login.defs and/or /etc/pam.d/system-auth-ac. I would need to perform to allow the following behavior: I want a user'...
3
votes
0answers
541 views

Is there way to print the entered password in PAM?

We are using CentOS 6.5. We have a perl script for our automation testing. One of the script login to the user as non-root user and test "su -" command. This test case passes most of the times but ...
3
votes
0answers
73 views

Is it possible to login to a Linux machine with AD credentials without the machine being member of the AD?

I'm asking because as far as I know this is not possible with Windows machines since it's mandatory that a Windows machine is known to the AD in order to login with AD credentials. Is it possible to ...
3
votes
0answers
735 views

SSH login from external authentication

Here is what I try to accomplish: I have a server with a git repository. I use ISPConfig as control panel for our websites and I want to integrate the ISPConfig API for email authentication as second ...
3
votes
0answers
3k views

Changing Samba/LDAP password with passwd

We've installed CentOS Directory Server (389 DS) and have Samba using it as a backend. This works great except that when enabling password syncing in the smb.conf it is only synced one way. I could ...
3
votes
0answers
177 views

Restrict usage of the same password during a time period

I need to configure a server with some requisites on the password changing: in addition to other requisites, I need to ensure that, on a password change, it is not repeated (last 5 passwords) and ...
3
votes
2answers
661 views

Deleted /etc/pam.d/common

I deleted all common-* files in /etc/pam.d folder and now I am locked out. I am running Ubuntu 14.04. I did backup all these files in a folder inside pam.d but now I can't even move them. If I try, ...
3
votes
1answer
1k views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
2
votes
2answers
97 views

How does id command on linux get user groups or which pam module is used?

We have sssd configuration as follows: id_provider = ad auth_provider = krb5 access_provider = ldap enumerate = false ignore_group_members = true; As you can see, we are not enumerating users and ...
2
votes
0answers
15 views

Why symlinking pam_unix.so to pam_unix_acct.so and other three files?

On CentOS, pam_unix.so is linked to the following 4 files: lrwxrwxrwx. 1 root root 11 Oct 11 2016 pam_unix_acct.so -> pam_unix.so* lrwxrwxrwx. 1 root root 11 Oct 11 2016 pam_unix_auth.so -&...
2
votes
0answers
328 views

PAM configuration to execute a shell script on every login failure

I would like to execute my shell script on every login failure. To do this I updated the file /etc/pam.d/common-auth: From (original body): auth required pam_env.so auth required ...
2
votes
0answers
422 views

How to start services (or targets) inside a session scope?

I use systemd to start most of my processes for a desktop session: xmonad (the window manager), emacs daemon, a tmux session, etc. Listing my users processes with loginctl user-status consequently ...
2
votes
1answer
162 views

Allow PAM module to always access a root only file

I have a custom PAM module that needs to access some sensitive information on the hard disk to perform its job. These files would ideally be stored with root access permissions only. I've been ...
2
votes
0answers
210 views

Pam.d three files lightdm, lightdm-greater, lightdm-auth

What are the differences in the three files located in /etc/pam.d /etc/pam.d/lightdm-greeter /etc/pam.d/lightdm-auth /etc/pam.d/lightdm I assume they each serve a different role, what do they do?
2
votes
1answer
119 views

Is there a limit for line length in PAM config files?

How I got to this suspicion: I try to configure the proxy at my companies network. There are quite a few hosts that can only be reached without proxy, so I tried configuring $NO_PROXY in /etc/...
2
votes
0answers
309 views

pam_tally2 add an extra failed login

I am trying to use pam_tally2 in /etc/pam.d galaxy I change sshd to the following content #%PAM-1.0 auth required pam_securetty.so auth required pam_tally2.so deny=3 unlock_time=...
2
votes
0answers
358 views

How to automount SSHFS shares for a user upon login?

My question is how to mount SSHFS shares as the user (not root) upon demand or upon user login using only tools that are in my distro's core repos. I'm using Arch. I don't mind writing a small script, ...
2
votes
1answer
2k views

What am I missing in PAM configuration for Redhat Apache?

I am trying to have PAM to use the hosting system's "passwd" and "shadow" file to authenticate a user who is using the web application. I am using RedHat 6, apache is 2.2, module mod_authnz_pam for ...
2
votes
2answers
2k views

Password: chsh: PAM: Authentication failure

Trying to run RUN chsh -s /bin/bash www-data (dockerfile) i tried to change it to /bin/zsh but still doesn't work. Docker file is too long, there is the offical repository with the file https://hub....
2
votes
1answer
95 views

Allow only specific users to interact with the local session

I have a Centos7 machine joined to an Active Directory domain. the problem is that if I login to the Centos7 server I can interact within the session with any username from the Active Directory domain....
2
votes
0answers
241 views

PAM: Sequences in Linux Login Password Being Flagged Unexpectedly

I am attempting to implement a password policy on Debian 8. I have the following in /etc/pam.d.common-passowrd: password requisite pam_cracklib.so difok=2 minlen=8 ...
2
votes
0answers
1k views

How to add all netgroup members to a group

I have multiple virtualized servers, all configured to use LDAP for their passwd/shadow (in nsswitch.conf) and authentication (PAM). I would like to have an easily configurable set of users who will ...
2
votes
0answers
551 views

How to local user login(PAM) with MySQL?

The MySQL server has already been configured and can be remotely accessed from the client. The client is debian and has installed 'libpam-mysql'. What additional settings should I set for the local ...
2
votes
0answers
89 views

RHEL7 PAM Password Length based on UID

I'm trying to configure password policy based on different UIDs. So for example: - UID 1000-1999 would have Password minimum lenght of 15 - UID 2000-2999 would have Password minimum lenght of 20 ... ...
2
votes
0answers
713 views

Audit and or monitor every command sent through an SSH connection?

I am writing because I need a way to monitor what my users send via ssh. I have a jumphost and I tried the following: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/...
2
votes
0answers
134 views

How will libpam-poldi work with ecryptfs

I'd like to authenticate myself to my machine using my PGP SmartCard. I'm under the impression that I can do this using libpam-poldi. However, I also have directories that are encrypted using ecryptfs ...
2
votes
0answers
765 views

/etc/pam.d configuration

This is an example of the /etc/pam.d/sshd configuration file on a FreeBSD 11.0 freshly-installed system: # # $FreeBSD: releng/11.0/etc/pam.d/sshd 197769 2009-10-05 09:28:54Z des $ # # PAM ...
2
votes
0answers
185 views

Error message on nonexistent home dir (pam.d/* settings)

I have a host running Debian 8. I set LDAP authentication, but the home directory is not created. I added in common-session: session optional pam_systemd.so skel=/etc/skel/ umask=0077 It ...
2
votes
0answers
621 views

Lock screen not locking with LDAP on CentOS 7

On my system some users authenticate with LDAP, others have their password stored locally (standard). The problem is that LDAP-users cannot lock the screen. When pressing Windows-Key + L the screen ...
2
votes
0answers
90 views

Disabling password expiry for auto login User Linux

I have a unattended system which runs under test login. Recently, I enabled password expiry for 90 days. All I am expecting is if someone login manually with user test after 90 days it should prompt ...
2
votes
0answers
622 views

/etc/pam.d/* How to pam_ldap output debug?

I would like to use pam authentication to connect ldap users without adding thoses user to the system. In /etc/pam.d/webmin : auth required pam_env.so debug auth sufficient ...
2
votes
1answer
87 views

Disable 2FA while at home

I have two factor authentication setup for login on my laptop using a Yubikey setup for U2F. Now, while I love the security, it is a pain to use the key while sitting at home. Is there a way for my ...
2
votes
0answers
459 views

ldap 389 server with sssd client, cannot modify password

I setup the 389 ldap server on a fedora system. I can authenticate against the system, but I cannot update/modify a password neither as root nor as user. user root gets a "Password reset by root is ...

1
2 3 4 5