Questions tagged [pam]

Pluggable Authentication Modules handle authentication tasks of applications or services running on the system.

Filter by
Sorted by
Tagged with
0
votes
1answer
504 views

Cent OS password rules not working

I wanted to set password rules for all users like min and max length , 1 digit and so on. So I modified /etc/pam.d/system-auth as below password required pam_cracklib.so try_first_pass retry=3 ...
1
vote
0answers
704 views

Authentication issue in KDE - su, sudo, screen unlocking

I have the following issue with a fresh arch-linux installation: in KDE/plasma with SDDM neither su or sudo work. I tried to use them in both konsole and xterm. What does also not work is ...
2
votes
2answers
1k views

Using openldap authentication only for some users

I am trying to set up a couple of Linux workstations (RedHat 7), and I am trying to figure out how to set up authentication against an LDAP server with some unusual requirements. I basically know how ...
3
votes
1answer
1k views

What is the purpose of the default /etc/securetty settings on Debian?

I created a Debian unstable container with debootstrap and ran it using systemd-nspawn.service. I can log in as root with machinectl login, but not more than once at the same time. When I run the ...
4
votes
2answers
40k views

how to restart pam.d service after changing of common-account-pc or common-auth-pc

I am having trouble with a configuration line in common-account-pc & common-auth-pc that denies also root access: account required pam_tally2.so deny=10 onerr=fail unlock_time=600 ...
1
vote
3answers
582 views

Unable to smuggle data in username using custom pam module - input_userauth_request: invalid user

I am trying to get data into a process invoked via ssh by adding it the supplied username, e.g. ssh user@smuggledata@host I've written a PAM module, however sshd has already decided the user is ...
2
votes
2answers
4k views

How to disable user specific tmpfs /run/user/1000, tmpfs

Is there any way to disable system creating user specific tmp mount /run/user/1000, tmpfs per each log-in session? I know this is a new feature, but I want to get the system running older way. -...
3
votes
0answers
208 views

pam_winbind is logging passwords

Occasionally, a systemd unit using a pam module that uses pam_winbind logs a users password. Systemd unit log: Mar 25 15:47:41 display-server node[5969]: pam_succeed_if(grooming:auth): requirement "...
2
votes
0answers
1k views

How to add all netgroup members to a group

I have multiple virtualized servers, all configured to use LDAP for their passwd/shadow (in nsswitch.conf) and authentication (PAM). I would like to have an easily configurable set of users who will ...
2
votes
1answer
4k views

Using pam_succeed_if.so to allow passwordless su for a given group

I have a service user srvuser and a group maintainers. How can I allow only group maintainers to become srvuser with su command? I tried editing /etc/pam.d/su: auth sufficient ...
5
votes
1answer
1k views

Why does pam_exec.so work with sudo, not with su?

I'm trying to allow root access from a regular user shell based on the successful execution of a special program, and the goal is to have both su and sudo respond to the new PAM configuration. The ...
1
vote
0answers
101 views

Log in as unix user using password stored in htpasswd

I know this is possible to log in vsftpd using htpasswd (libpam-pwdfile) but in every tutorials I read, they use virtual user. My users are not virtual, they are local user I added using "adduser" ...
1
vote
0answers
109 views

'Merging' Local Server and AD Accounts

I am investigating LDAP-bridge options, but have a hurdle to overcome: pre-existing local accounts. There are a large number of *nix servers (hundreds) with local accounts on them formatted in all ...
2
votes
0answers
550 views

How to local user login(PAM) with MySQL?

The MySQL server has already been configured and can be remotely accessed from the client. The client is debian and has installed 'libpam-mysql'. What additional settings should I set for the local ...
1
vote
1answer
2k views

How to correctly use PAM to execute a script upon login failure

I am trying to use the Pluggable Authentication Module to execute a script when login fails on my Arch Linux system. Arch Linux does not have a common-auth file and I decided not to create one either. ...
1
vote
0answers
66 views

pam options to skip a module FREEBSD

I am looking for something similar to what is posted here: How to achieve conditional PAM authentication? But the same does not seem to work on FreeBSD 10. Example [success=1] seems to be not a valid ...
2
votes
0answers
89 views

RHEL7 PAM Password Length based on UID

I'm trying to configure password policy based on different UIDs. So for example: - UID 1000-1999 would have Password minimum lenght of 15 - UID 2000-2999 would have Password minimum lenght of 20 ... ...
14
votes
2answers
5k views

Why does sudo -i not set XDG_RUNTIME_DIR for the target user?

XDG_RUNTIME_DIR is necessary for systemctl --user to work. I have set up ubuntu server 16.04 to run systemd user sessions. Now, when trying to administer them, I find that when changin a user via ...
2
votes
0answers
713 views

Audit and or monitor every command sent through an SSH connection?

I am writing because I need a way to monitor what my users send via ssh. I have a jumphost and I tried the following: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/...
2
votes
1answer
601 views

Using PAM config and SSHD config together

I have a server running openSUSE which uses PAM config files for authentication/lockout/password policy etc. I now need to limit the allowed list of SSH ciphers. Normally I'd just do this in the ...
1
vote
1answer
447 views

Debian and CentOS PAM rules matching

I need to configure PAM rules on Debian system to use LDAP authentification. Earlier I did it on CentOS and I'm not sure that I understand PAM rules matching on their systems right. On CentOS I've ...
1
vote
2answers
173 views

multiplatform change password

We are trying to standardize on passwd to change our *nix passwords. On linux, it's a simple matter of: printf "secret\nsecret\n" | passwd username But FreeBSD has re-written their version of ...
1
vote
1answer
601 views

How to authenticate Linux accounts with PAM using PHP without giving www-data shadow

Sort of as a follow up to this: Securest way to authenticate users against /etc/shadow using PHP? and because there hasn't been anything relevant that I've seen on Ubuntu 16.04. I'm trying to ...
1
vote
0answers
333 views

Enabling rsh / rlogin with pam in amazon linux

Please don't even think of suggesting to use ssh. I use ssh and I know how to use it. But sometimes I just want to use rsh! There are good reasons to do so, if you know what you are doing! actually I ...
3
votes
1answer
2k views

Running a shell script on n failed login attempts

I'd like to run a script if the login on my machine fails 3 times (not ssh, but someone in terminal trying to login, or someone trying to physically login). Also, is if it is possible to configure the ...
3
votes
1answer
2k views

Where does the pam_systemd.so line come from in system-auth and password-auth?

After converting a server to use SSSD for authentication the following line in /etc/pam.d/system-auth and /etc/pam.d/password-auth caused very long (10-20 second) hangs when SSHing into the server: -...
2
votes
0answers
107 views

How run an encrypted webcam capture at login? [closed]

I create a webcam video recording encrypted with a password situated at /root/private/password with ffmpeg -i plughw:0,0 -f video4linux2 -s vga -i /dev/video0 -f ogg - | openssl enc -k /etc/password -...
1
vote
3answers
808 views

Where is the official documentation for the files in /usr/share/pam-configs, in Ubuntu?

I'm trying to add some configuration to PAM in Ubuntu, and I'd like to do it using a file in /usr/share/pam-configs. Is there an official documentation for those files?
2
votes
1answer
12k views

PBIS auth.log requirement “user ingroup nopasswdlogin” not met by user “Administrator@domain.local”

I want to use my Windows AD credentials to login the Ubuntu 16.04 machine. I use PBIS (PowerBroker Identity Services) AD-bridge from Beyondtrust version 8.5.2.265. Windows version is Windows Server ...
1
vote
0answers
1k views

Kill idle login sessions

I'm looking for an effective way to kill idle login sessions (console, ssh, etc). There are tons of answers on the internet on how to do this, but they all cover only very basic use cases. The ...
2
votes
1answer
2k views

ulimit vs /etc/security/limits.conf

What is the difference between: a) using the ulimit command to set a limit on a resource? b) editing the /etc/security/limits.conf file for the same purpose? e.g. what is the entry that should be ...
3
votes
0answers
272 views

How to report current usage for a user on ulimits aka pam_limits etc?

Every SA sooner or later runs into a user hitting a ulimit like open files or number of processes. There must be a simple mechanism to track and test against usage of these limits, or ulimits would ...
10
votes
1answer
10k views

PAM vs LDAP vs SSSD vs Kerberos

I am basically aware of what these services do separate from each other. What I want to know: what exactly happens on a successful login in a linux based network that uses all of these services? In ...
1
vote
0answers
107 views

Override Default PAM Message Prompt

I'm using a YubiKey for ssh 2 factor authentication. I've directed the flow to pam.d/ssh and added the provided pam_yubico.so module. I would like to override the default prompt which displays: ...
0
votes
0answers
410 views

Cannot run sudo twice

I have the following statement in bacula: RunBeforeJob = "sudo /bin/mountpoint /backup/external || sudo /bin/mount /dev/mapper/bacula" But it fails: sudo: pam_unix(sudo:auth): conversation failed ...
0
votes
1answer
27 views

What are the folder that I cannot set as encrypted folders decrypted at login? [closed]

I want maximize the number of folders encrypted with ecryptfs and decrypted at login with the module pam_ecryptfs.so. Which folders cannot possibly be encrypted before login in? I guess a lsof ran ...
3
votes
1answer
1k views

How to login with both password and fingerprint?

How to configure PAM to require both password and fingerprint to log in? I can do a password / fingerprint login but not both by changing /etc/pam.d/common-auth For password only auth [success=...
1
vote
1answer
948 views

How to add a user that accept any password as a valid password?

How to add a user that accept any password as a valid password? PS: I am aware of the security issue. The user will have a very restricted access (as the guest user in Ubuntu). related question: ...
1
vote
0answers
265 views

Exempting root / users from radius 2fa login

I have setup PAM to allow radius authentication to a 2fa radius server. As per my configuration, I am the Radius authentication is working, but what we need to achieve is to exempt a user / group (...
5
votes
2answers
182 views

Where does Linux check passwords?

I know that passwords are stored in /etc/shadow However, during the login process, I'm assuming that Linux take your username and password as an argument, encrypt your password with the same ...
0
votes
1answer
78 views

How to display a video when a wrong password is entered

I want to display a video when a wrong password is entered (say only in GUI login screen or within the display manager). I have added a line to /etc/pam.d/common-auth to run my script /usr/local/bin/...
0
votes
1answer
466 views

Authorized authentication by public key ssh , when active directory disabled account [duplicate]

Good Morning , Why can I still authenticate with a public key via ssh while my account is disabled on active directory? My infrastructure is CentOS and authentication by active directory with ...
2
votes
2answers
2k views

How to stop sudo PAM messages in auth.log for a specific user on Ubuntu 16.04?

I'm on Ubuntu 16.04 and I'm trying to stop /var/auth.log being flooded by a script that checks if some hosts are alive on the network periodically. The script internally uses sudo with nmap. I have ...
1
vote
3answers
81 views

How to design a mutiple level password security for one user

I am wondering if it was possible to have an enhanced version of PAM that implement a login with multiple level passwords. For instance, I am interesting requiring not 1 but 3 different passwords to ...
3
votes
1answer
2k views

libpam-pwquality not working in Ubuntu 16.04

I installed libpam-pwquality: sudo apt-get install libpam-pwquality And configured /etc/pam.d/common-password: password requisite pam_pwquality.so retry=3 minlen=10 ...
4
votes
2answers
7k views

How can I bypass Fedora's password complexity requirments?

On a fresh install of Fedora 19 I am attempting to change the password to something simple, like Password01 (this is just a simple testing VM, nothing fancy), but the password complexity requirements ...
1
vote
0answers
32 views

Remove Option From Include File In PAM

I use google-authenticator with PAM and it is added in the config file /etc/pam.d/system-login. Up until recently I was using Cinnamon and my setup was perfect as I only needed to enter my ...
1
vote
0answers
342 views

What defines pam password hashing?

I have been running into an issue with pam password hashing. It seems no matter what I do on my RHEL based systems they always hash passwords based on MD5. My goal here is to have ldap users who use ...
0
votes
6answers
274 views

How do I “lock” my Linux box for few hours?

Since I over-use my computer, I would like to block it for few hours, for example every day from 23 to 7, so that I cannot use it in that time frame. Currently, I am using crontab to suspend/shutdown ...
2
votes
1answer
101 views

Change login failure message

I want to change login failure message in Debian 8 x64 login: root password: login incorrect - /this/ login: Can you tell me how to do that? P.S.: and for more - how to set number of login attempts?...

1
3 4
5
6 7
10