99

The new openssh version (7.0+) deprecated DSA keys and is not using DSA keys by default (not on server or client). The keys are not preferred to be used anymore, so if you can, I would recommend to use RSA keys where possible. If you really need to use DSA keys, you need to explicitly allow them in your client config using PubkeyAcceptedKeyTypes +ssh-dss ...


98

You can do this using the PermitRootLogin directive. From the sshd_config manpage: Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or “no”. The default is “yes”. If this option is set to “without-password”, password authentication is disabled for root. The following will accomplish ...


75

Add the following lines underneath the pam_rootok.so line in your /etc/pam.d/su: auth [success=ignore default=1] pam_succeed_if.so user = martin-test auth sufficient pam_succeed_if.so use_uid user = martin These lines perform checks using the pam_succeed_if.so module. See also the Linux-PAM configuration file syntax to learn more about ...


64

Start with creating a user: useradd -m -d /home/username -s /bin/bash username Create a key pair from the client which you will use to ssh from: ssh-keygen -t dsa Copy the public key /home/username/.ssh/id_dsa.pub onto the RedHat host into /home/username/.ssh/authorized_keys Set correct permissions on the files on the RedHat host: chown -R username:...


36

I finally got it to work by enabling Google 2-step verification and using an app-specific password for mutt. More detail: I enabled 2-step verification on my Google account, which means that when I log in to Google, I have to enter a pin number from either a text or from the Google Authenticator app. Then I had to get an app-specific password for mutt. ...


36

The problem is the fact that file and directory permissions do not meet the requirements of StrictModes, which in OpenSSH is yes by default and should not be changed. Try setting the permissions of authorized_keys to 0600 and the .ssh directory to 0700. # chmod 0700 .../.ssh/ # chmod 0600 .../.ssh/authorized_keys Note that the ... will differ based on ...


29

The sshd server will disconnect if the client doesn't try to authenticate in a certain period of time, as documented in the -g option. -g login_grace_time Gives the grace time for clients to authenticate themselves (default 120 seconds). If the client fails to authenticate the user within this many seconds, the server ...


28

As one of the comments says it looks like Google have moved to blocking apps that are using IMAP/SMTP PLAIN authentication by default and you can read official blogs stating that Google strongly recommends IMAP/SMTP protocol users switch to OAuth 2.0 (as XMPP is also listed I wonder if (older?) OSX iChat will stop working with GTalk at some point). Elsewhere,...


26

This is not a limitation on the part of your SSH server, this is a limitation on the part of your server's password hash algorithm. When hashing passwords on Unix, the crypt() function is called. This may use one of many backends, a possibility is using DES, or another limiting algorithm (for this particular case, I will assume your server is using DES). ...


24

In your comment, you said that /bin/su has the following mode/owner: -rwxrwxrwx. 1 root root 30092 Jun 22 2012 /bin/su There are two problems here. it needs to have the set-uid bit turned on, so that it always runs with root permissions, otherwise when an ordinary (non-root) user runs it, it will not have access to the password info in /etc/shadow nor the ...


23

On Ubuntu you can add the user with: adduser --disabled-password <username> Then create .ssh/authorized_keys file in their home directory with their public key.


22

Somewhat similar to @user37161's answer. If the shared account is running a custom shell and the shell needs to know what user is there, then running the "wrapper" script might not be sufficient, since information there isn't passed into the custom shell except through methods that could cause race conditions. Instead you can use the environment= option in ...


22

You can do any one of these four things: Log in as a user that is in the wheel group and fix it from there Log in as root from the console/ILO Boot off of a CD, mount /etc and fix /etc/group Restore /etc/passwd and /etc/shadow from the most recent backup


22

If you force there to exist multiple users with the same username, then there will be multiple entries in /etc/{shadow,passwd} with the same name: $ cat /etc/passwd ... a:x:1001:1002::/home/a:/bin/bash a:x:1002:1003::/home/b:/bin/bash # cat /etc/shadow a:...:17702:0:99999:7::: a:...:17702:0:99999:7::: If you try to log in as that user, you'll log in as ...


21

Maybe. Can you obtain a ticket for your principal on your client system either as part of the standard login process or manually (kinit, MIT Kerberos for Windows)? Does the server has a kerberos principal or can you give it one? It should be of the form host/server.example.com@EXAMPLE.COM. Is GSSAPI authentication enabled on your client? Does your client ...


20

I suspect you're OS is using DES password encryption, which only supports a maximum of 8 characters. https://serverfault.com/questions/361591/ssh-accepts-only-the-half-password From man crypt(3) GNU EXTENSION The glibc2 version of this function has the following additional features. If salt is a character string starting with the ...


18

You will get this behaviour if the file mode of the user's home directory on the destination host is not set correctly. It's not just the mode of the .ssh directory that has to be correctly set! ssh to the host and give your password to login, then chmod 755 ~ logout Then ssh again and assuming you have everything else set up correctly (see the other ...


17

On modern linux systems, the reason is that pam_unix.so imposes such a delay. As previously reported, this can be configured down to two seconds by changing FAIL_DELAY in /etc/login.defs. If you want to reduce the delay further, you have to give pam_unix.so the "nodelay" option. For example, on my system, if you trace the includes starting from /etc/pam.d/...


17

LDAP is a directory service (a type of database) along with a protocol that describes what information is stored, how to search it, etc. All kinds of things can be stored there, but in this case it'd be Unix user and group info. Very loosely, an alternative to /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. Or to NIS. NSS is glibc's name service ...


17

Just like hostnames and domain names, the username is not strictly a Unix thing but can and often does span a wider range of OS types. Whether they will be considered case sensitive depends then on the standard used to specify them. Hostnames and domain names are clearly case insensitive by the DNS standard (see RFC4343). Usernames stored on a local ...


15

If redirect page does not load, and reconnecting does not fix the issue, then the easiest next step is to address the router directly. Try 192.168.1.1. That is the most common default address, and is often not changed. Addressing the router should send you to the redirect page.


14

In my case, these messages appeared in /var/log/secure when I was experiencing Host key verification failed. errors on the ssh client side. This is one of the cases that would result in a connection without a login attempt.


14

PAM proceeds through the items on the stack in sequence. It only keeps the memory of what state it's in (success or denied, with success meaning success so far), not of how it reached that state. If an item marked sufficient succeeds, the PAM library stops processing that stack. This happens whether there were previous required items or not. At this point, ...


14

The logs tell you: Someone with the IP 218.10.19.134 and from port 4627 was trying several times to login as user root with a password. But: user root is invalid anyway, the logs is just informing you of the login attempts the attempted login method was password authentication (not public key or anything else) the source port was 4627, the destination port ...


13

If you don't want to change groups or use sudo, use a pam module called pam_exec to execute external scripts in a pam stage. Add a line in your /etc/pam.d/su after the pam_rootok.so line: auth sufficient pam_exec.so quiet /path/to/script /path/to/script has the permissions 755 (rwxr-xr-x) and the following content: #!/bin/bash if [ "$PAM_TYPE" == "...


13

You seem pretty close with your PAM conf line: session [success=1 default=ignore] pam_succeed_if.so service in sudo quiet uid = 0 Looking at the manual page for pam_succeed_if, I think you want to test that the requesting user (ruser) is zabbix. So I suggest: session [success=1 default=ignore] pam_succeed_if.so quiet uid = 0 ruser = zabbix That will ...


12

After creating the account with the command useradd you need to run the following command as root to set a password for this newly created account: $ passwd <username> Sudo If you're absolutely positive that you, (userZ), want to become another user (userX) without providing userX's password, AND you don't want to have to become root first then you'...


12

1. wheel group? This is likely because your useid is not in the wheel group. On Red Hat distros you can explicitly disallow users who are not in this group from running the su command. Here's what the su PAM configuration looks like by default: $ more /etc/pam.d/su #%PAM-1.0 auth sufficient pam_rootok.so # Uncomment the following line to ...


12

PowerBroker is a full-featured solution with a rich suite of security options. Because of these features, PowerBroker can be much more complicated to set up if all the security options are used. In a strict comparison with sudo however; using only the features available to sudo, the installation and maintenance is no more complicated. Sudo can be an ...


12

Yes. The password is sent over the encrypted connection, but it's in plaintext to the remote server. The usual way to authenticate is for the server to calculate a hash of the password and to compare it to a value saved on the server. There are several ways of saving hashes, and with current implementations, the client doesn't know what the server uses. (...


Only top voted, non community-wiki answers of a minimum length are eligible