Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
94
votes
3answers
32k views

Why is there a big delay after entering a wrong password?

I notice a weird (well, according to me) thing about passwords. For example, if I type an incorrect password during login, there will be a few seconds' delay before the system tells me so. When I try ...
56
votes
5answers
93k views

Allow user1 to “su - user2” without password

I need to allow user martin to switch to user martin-test without password su - martin-test I think this can be configured in /etc/pam.d/su. There are already some lines in that file which can be ...
32
votes
2answers
16k views

How does one change the delay that occurs after entering an incorrect password?

After entering an incorrect password at a login prompt, there s an approximately 3-second delay. How can I change that on a Linux system with PAM?
31
votes
2answers
70k views

How do I force a user to change a password at the first time login using ssh?

I'm trying to force a newly created user to change a password at the first time login using ssh. For security reasons I want to give him a secure password until he logs in for the first time. I did ...
21
votes
2answers
55k views

Effect of entries in /etc/securetty

By default on RHEL 5.5 I have [deuberger@saleen trunk]$ sudo cat /etc/securetty console vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 vc/7 vc/8 vc/9 vc/10 vc/11 tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 ...
20
votes
3answers
4k views

How to prevent shutdown when an SSH user is logged in?

I'm administrating a networked environment and I had an interesting situation arise yesterday. When a host is required to shutdown by a regular user, it refuses to do so if other users are logged in ...
18
votes
3answers
17k views

Escape hash mark (#) in /etc/environment

I am adding an env variable to /etc/environment but because the variable value contains # sign, string is striped. MYSQL_PWD="something#no" Now if I do env above code yields MYSQL_PWD=something. How ...
16
votes
4answers
23k views

How to stop sudo PAM messages in auth.log for a specific user?

I am using Zabbix for monitoring my environment and zabbix_agentd executes as user zabbix one custom script every 60 seconds; it uses sudo to run this script as root. In /var/log/auth.log I see every ...
14
votes
2answers
5k views

Why does sudo -i not set XDG_RUNTIME_DIR for the target user?

XDG_RUNTIME_DIR is necessary for systemctl --user to work. I have set up ubuntu server 16.04 to run systemd user sessions. Now, when trying to administer them, I find that when changin a user via ...
14
votes
2answers
10k views

PAM - required and sufficient control flag

I'm studying PAM, and I'm a bit clueless about the meaning of some combination of control flags. From the Red Hat documentation we have: required failure of such a PAM will ultimately lead to ...
14
votes
4answers
2k views

Groups differ from the local ones when logging in remotely

We store our users in LDAP, alongside some groups that have meaning across different systems (organizational roles including wheel). There are also groups local to workstations, e.g. audio or video ...
13
votes
7answers
52k views

vsftpd fails pam authentication

Moving a tried-and-true vsftpd configuration onto a new server with Fedora 16, I ran into a problem. All seems to go as it should, but user authentication fails. I cannot find any entry in any log ...
12
votes
2answers
97k views

How to lock users after 5 unsuccessful login tries?

How to lock users after 5 unsuccessful login tries? I gathered a few distributions/versions to how to do it, but I can't test it. RHEL4: by adding the: auth required /lib/security/$ISA/...
12
votes
3answers
27k views

Expired password and SSH key based login with UsePAM yes

There is a SLES 11 machine. The users logs in via SSH and pubkey (mixed, some user uses password, some use ssh key) The sshd_config has: UsePAM yes PasswordAuthentication yes PubkeyAuthentication ...
11
votes
1answer
12k views

What happens when your password expires and you're using key authentication?

on one of the boxes I don't control at work I use ssh keys to log in. Our passwords are set to expire after a few months. What happens if I don't reset my password and it expires? will I still be able ...
11
votes
1answer
3k views

unlock login gnome-keyring on i3wm autologin

Problem This question seems to have been asked a billion times, but I'm still completely unable to unlock my login keyring automatically. Background I automatically login, chvt and startx along ...
10
votes
5answers
61k views

Program for decrypt linux shadow file

Is there any program or script available for decrypt Linux shadow file ?
10
votes
1answer
10k views

PAM vs LDAP vs SSSD vs Kerberos

I am basically aware of what these services do separate from each other. What I want to know: what exactly happens on a successful login in a linux based network that uses all of these services? In ...
10
votes
3answers
26k views

Home Directories and pam.d using LDAP

Background: I'm not too familiar with the ins and outs of pam and LDAP authentication on a configuration side. I've used systems that use pam but I've only worked on applications, not systems ...
10
votes
2answers
41k views

PAM: Authentication failure, with valid password

Command pamtester -v auth pknopf authenticate pamtester: invoking pam_start(auth, pknopf, ...) pamtester: performing operation - authenticate Password: pamtester: Authentication failure journctl ...
9
votes
1answer
1k views

What steps does the system go through when handling an SSH connection?

What steps does the system go through when handling an SSH connection? We try to log in via ssh sshd starts pam and pam module to authenticate us Depending on pam configuration, we need to provide ...
9
votes
2answers
453 views

How to automatically enter sudo's grace period upon CLI login? [duplicate]

What I would like to do is be able to login and sudo commands immediately without entering a password again. It is very redundant to type my password twice in a row when I need to login and run a ...
9
votes
1answer
8k views

2 Factor Authentication in SSH using public key and PAM

I'm trying to setup 2 Factor Authentication. I want the user to login successfully if: The public private/public key matches (authentication method: publickey) or the password is correct My pam ...
9
votes
4answers
4k views

Restrict the times a user is allowed to log in

We have several Backbox 3.13 systems built on Ubuntu 12.04. One of my teenagers does not understand the concept of this thing called "sleep" and tends to get up to play on the computer. I'm trying to ...
8
votes
1answer
9k views

basic explanation on NSS , LDAP and PAM

can anyone give me a basic explanation on what are NSS , LDAP and PAM and what they used for and what is their relationship/differences ?
8
votes
4answers
7k views

Is it possible to change password database file(/etc/passwd) in linux?

Is it possible to change password database file(/etc/passwd) to some other file. How does this authentication mechanism work internally ? Does it depend on pam ?
8
votes
4answers
7k views

SSH authentication: either SSH keys or one time password

I have an Ubuntu 10.04 Linux server that I normally ssh into (from my home machine) using ssh key authentication. However, sometimes I need to ssh remotely from potentially insecure machines (like ...
8
votes
2answers
357 views

setting sudo password different from login password

I am attempting to use PAM to use a different password for sudo than I do for logging in. I worked off of this post originally Set sudo password differently from login one Unfortunately, every time ...
8
votes
1answer
205 views

How to add additional steps to login?

What I would like to achieve is an interactive program that runs either before or after asking the user for the password, but won't handle over the access to the computer unless it exited with success....
8
votes
1answer
2k views

Custom PAM modules and security considerations

I am writing my own PAM module that will be part of an application that I am developing, but I'm not sure exactly where to put it. My module basically does network-level authentication (with other ...
8
votes
4answers
2k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password ...
8
votes
2answers
8k views

Why does pam_mount ask for password?

I used the pam-auth-update tool in order to enable some pam configuration profiles: PAM configuration PAM profiles to enable: [*] encfs encrypted home directories [*] Unix ...
8
votes
1answer
4k views

First sudo always slow

The first sudo I enter on my Ubuntu 14.04 server is always slow. The password prompt displays immediately, but after I press enter it takes about 10-15 seconds until the output is printed. All sudo ...
7
votes
2answers
2k views

How to create a conditional PAM entry

I am testing PAM scenarios on RedHat 7.5 The pam module pam_succeed_if.so looks like the most basic level of conditional testing that PAM has to offer, and it is not meeting my needs. You can only ...
7
votes
2answers
2k views

When running 'su - username', pam_group doesn't add additional groups from /etc/security/group.conf but sshd login does?

I am having trouble determining why su doesn't behave as the PAM configuration would imply. In short, using su to become another user should load secondary groups according to PAM configuration, but ...
7
votes
3answers
3k views

Use multiple PAM login methods at once?

I'm using pam-fprintd as a login method. Currently it works perfectly for logging into the cinnamon screensaver and sudo. Unfortunately you have to fail the fingerprint login a certain number of times ...
6
votes
6answers
1k views

Identity Management with ActiveDirectory

What is the best, or most reliable, way to manage my Unix/Linux user accounts with ActiveDirectory? Or, is this even feasible?
6
votes
2answers
5k views

Disable password complexity check (PAM)

I installed a Linux based system with a blank password. I wanted to change password to something simple, but using passwd and setting the password to something like a single symbol gave an error of “...
6
votes
2answers
10k views

Can I create a local only guest account?

Is it possible to create a "guest" account in Linux? by "guest" account I mean an account that does not require a password to log in graphically. I want this account for when people come over and are ...
6
votes
3answers
114 views

different passwords depending on plugged-in devices

I would like to have different passwords for my account(s): When (e.g.) a certain USB stick is plugged in then an easy password is to be used. The idea is: If I leave my computer then I take the stick ...
6
votes
3answers
5k views

Restrict ssh login from LDAP to users who have a /home directory

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content ...
6
votes
1answer
170 views

Send only one warning when the private key is not available

For added security, I would like to require a private key to use sudo on my Ubuntu Server box. I've added private key authentication for sudo as described at https://superuser.com/questions/164078/how-...
6
votes
1answer
1k views

Default umask 077 not applied at session start

I cannot get the default umask for a session to be 0077. I have edited /etc/login.defs and set the value to 077 there: UMASK 077 Also I've made sure the following entry exists in /etc/pam....
6
votes
1answer
2k views

How to make a system lock when the USB pendrive with authentication key is removed?

Say, I have USB drive authentication up and working. So far, so hoopy. But now I want to take the next step, which is locking the machine when I eject the medium. I know there is udev I can script, ...
6
votes
1answer
1k views

Backing up and restoring a system user account

How would I go about completely backing up a user account and restoring it on a new system? The Home directory is just 'copy-and-paste'. But then what about things like the account password; and its ...
5
votes
4answers
1k views

Howto find and move a text line inside a file?

I need to change a text line position inside a file; from one line position to another one, underneath a defined text. For example, I have the following text block (on /etc/pam.d/system-auth file) ...
5
votes
1answer
3k views

pam: action on (unsuccessful) login

I know how to execute an action on login, by adding a line to /etc/profile. But that only gets executed, if the login was successful. I would like to have action executed even when login fails. For ...
5
votes
2answers
1k views

Cron is trying (and failing) to open env file: /etc/environment

I'm using Devuan ASCII (which is more or less Debian 9, Stretch). Now, my /var/log/auth.log has a bunch of these entries: Jan 6 09:45:01 mybox CRON[20951]: pam_env(cron:session): Unable to open env ...
5
votes
1answer
3k views

How to achieve conditional PAM authentication?

I am currently using auth required pam_unix.so try_first_pass nullok auth optional pam_ssh.so use_first_pass (plus some other, probably irrelevant entries Arch Linux added by default), which means ...
5
votes
2answers
182 views

Where does Linux check passwords?

I know that passwords are stored in /etc/shadow However, during the login process, I'm assuming that Linux take your username and password as an argument, encrypt your password with the same ...

1
2 3 4 5
10