Skip to main content
Share Your Experience: Take the 2024 Developer Survey
22 votes
Accepted

PAM vs LDAP vs SSSD vs Kerberos

The sssd daemon acts as the spider in the web, controlling the login process and more. The login program communicates with the configured pam and nss modules, which in this case are provided by the ...
Johan Myréen's user avatar
22 votes
Accepted

PAM: Authentication failure, with valid password

Your system installation appears to be broken. For some reason, the file /sbin/unix_chkpwd has lost the privilege bits I would expect to see. Fix the permissions by running the following command as ...
Chris Davies's user avatar
20 votes

X11 connection rejected because of wrong authentication

Since many people will come here with the same error message, not realising it's unrelated to the use of su, I'd like to point out that similar symptoms now occur for a very different reason: Anything ...
Heath Raftery's user avatar
18 votes
Accepted

How can I bypass Fedora's password complexity requirments?

As root you can bypass the requirements. Your example shows this happening: # passwd justincase Changing password for user justincase. New password: BAD PASSWORD: The password fails the dictionary ...
Chris Davies's user avatar
17 votes
Accepted

How do you add `cap_sys_admin` permissions to user in CentOS 7?

I believe the file is called /etc/security/capability.conf not /etc/security/capabilities. I was able to get this working like so: $ cat /etc/security/capability.conf cap_sys_admin user1 And then ...
slm's user avatar
  • 371k
16 votes

how to restart pam.d service after changing of common-account-pc or common-auth-pc

There is no PAM daemon. You do not need to reload anything for the changes to take effect.
cdosborn's user avatar
  • 550
14 votes

sudo: unable to initialize PAM: No such file or directory

You can also reveal the /etc/pam.d/sudo file in the Finder and change the permissions there. open /etc/pam.d/ Make sure to reset the permissions afterwards again.
Sebastian Hojas's user avatar
14 votes
Accepted

Why does sudo -i not set XDG_RUNTIME_DIR for the target user?

I have replicated this issue on my Fedora 25 system. I found a very suspicious condition in the source code. https://github.com/systemd/systemd/blob/f97b34a/src/login/pam_systemd.c#L439 It looks as ...
sourcejedi's user avatar
  • 50.6k
13 votes

How to disable fingerprint authentication when laptop lid is closed?

To disable fingerprint authentication when the laptop lid is closed, and re-enable when it is reopened, we will use acpid to bind to the button/lid.* event to a custom script that will stop and mask ...
user000001's user avatar
  • 3,645
11 votes

Why does sudo -i not set XDG_RUNTIME_DIR for the target user?

What I'm really wondering, though, is how come the session is set up correctly with ssh, but not with su or sudo -i? https://github.com/systemd/systemd/issues/7451#issuecomment-346787237 Sorry, ...
sourcejedi's user avatar
  • 50.6k
11 votes
Accepted

What does pam_systemd.so do?

pam_systemd is the plug-in that makes the difference between the classic (pre-systemd) login process and the systemd-aware one. Without it, the login process works as it did with SysVinit: if a user ...
telcoM's user avatar
  • 98.1k
10 votes

Cannot recover from typo in /etc/pam.d/sudo

You can also reveal the file in the folder and change the permissions there. open /etc/pam.d/ Make sure to reset the permissions afterwards again.
Sebastian Hojas's user avatar
9 votes

How to stop sudo PAM messages in auth.log for a specific user?

Based on Toby's answer, I found a way to configure this in a slightly different way on Debian/Ubuntu. For context, see: https://manpages.debian.org/stretch/libpam-runtime/pam-auth-update.8.en.html ...
thom_nic's user avatar
  • 557
9 votes

Allow user1 to "su - user2" without password

This might be the possible best way. su is not meant to do that -- sudo is. Open /etc/sudoers.d/custom and write the following: user-a ALL=(user-b:user-b) NOPASSWD:ALL This means: whenever user-a ...
champion-runner's user avatar
9 votes
Accepted

How does the (sd-pam) process get away with unprivileged `pam_session_close()`?

Yes. It is a systemd bug that has been open (at the time of writing this) for the last two years in fact, which systemd people have, going by the bug report, entirely ignored. Going by Ben Collins' ...
JdeBP's user avatar
  • 69.2k
9 votes
Accepted

How does ssh or any other service work without pam?

If you set UsePam no, then sshd itself will do the job of the PAM modules, as best as it can. Since sshd is running as root, it can use getspnam(3) function to get the user's password hash and other ...
telcoM's user avatar
  • 98.1k
8 votes
Accepted

pam_limits.so making problems for sudo

This is a bug in the pam_limits module, causing authentication to fail. I think it only affects RHEL/Centos 7. It affects sudo users who have an unlimited or very high nofiles setting (bigger than ...
Steve Shipway's user avatar
8 votes
Accepted

Stop excessive logging of SUDO & SSH logins to syslog & wtmp for a specific user account

There are 2 choices. TL;DR 1. Syslog Filters Using rsyslog filters is by far the quickest solution but not as comprehensive as using PAM. At the top of your rsyslog default conf file, add the keywords ...
Tony Barganski's user avatar
7 votes
Accepted

What is the difference between pam_faillock and pam_tally2?

Since Linux-PAM 1.4.0 (8th June, 2020) pam_tally and pam_tally2 were deprecated and pam_faillock was introduced, version 1.5.0 (10th November, 2020) removed pam_tally and pam_tally2 If your distro ...
mcmx's user avatar
  • 121
7 votes
Accepted

Why does this PAM code prevent all logins to a Debian system?

There are two parts for this answer. The first adds pam_tally2 to auth. The second adds it to account. You need both parts for pam_tally2 to work correctly. Let's look at your common-auth, auth [...
Chris Davies's user avatar
6 votes

Expired password and SSH key based login with UsePAM yes

An option was added to pam_unix.so (around Feb-2016) called no_pass_expiry (source code change here or man page here). Basically it tells pam_unix to ignore an expired password if something other ...
Todd's user avatar
  • 61
6 votes

Home Directories and pam.d using LDAP

In Ubuntu 14.04 system-login is not present, but another file named as common-session is present. I went there and put: root@GW:~# vim /etc/pam.d/common-session # session optional ...
Mansur Ul Hasan's user avatar
6 votes
Accepted

"SSH Virtual Kiosk". Does "PermitEmptyPasswords yes" work? - How to make ssh user with empty password, so random users can use it?

You need to tell PAM also that you want to allow empty passwords. There is some outdated tutorial describing that. But in short: sudo sed -i 's/nullok_secure/nullok/' /etc/pam.d/common-auth should ...
Jakuje's user avatar
  • 21.4k
6 votes
Accepted

PAM failing to authenticate sudo, after successfully contacting ssh-agent

Configuration is OK, but you need to have some identities in your ssh-agent to be able to authorize the sudo operation. You can verify that your agent has some identities using ssh-add -L It should ...
Jakuje's user avatar
  • 21.4k
6 votes
Accepted

What is the difference between NSS and PAM?

Yes, PAM is concerned with authentication and authorization but not identification: "... you should know that PAM does not handle identification. Systems that rely on PAM normally use Name ...
thrig's user avatar
  • 35k
6 votes

Disable password complexity check (PAM)

I found out my system (as most modern Linux) use PAM (Pluggable Authentication Modules) and pam_cracklib module within it. pam_cracklib enforces minimum length of 6 symbols regardless of parameters, ...
Alex Martian's user avatar
  • 1,055
6 votes
Accepted

Why do we use optional in PAM even if it'll be ignored?

Important note: optional modules won't be ignored, they will be processed, their results will be ignored, i.e., even if they fail, the authentication process won't be aborted. There are many ...
Marcelo's user avatar
  • 3,581
6 votes

GNOME: Different PAM configurations for lockscreen vs login

GNOME uses gdm-password as the PAM service name for both logins and unlocks, so it's not possible to distinguish them in PAM. To do so, you'd have to create a custom build of GNOME Shell, specifically ...
Joseph Sible-Reinstate Monica's user avatar
6 votes

setting sudo password different from login password

You could use the targetpw option in sudoers, which would make sudo ask not for your own password, but for the password of the user you want to execute the command as (which in most cases is root). ...
Wüstengecko's user avatar
6 votes

PAM conf files are insecure!

Physical access is root access. If you're able to change any part of the boot process, you're able to compromise the system. It always depends on your attack scenario. If you believe that an attacker ...
Zeta's user avatar
  • 1,029

Only top scored, non community-wiki answers of a minimum length are eligible