Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
0answers
8 views

How to make Exceed-on-demand reload the PAM configuration?

after a change in the PAM configuration, I'd like to have Exceed-on-demand reload the PAM config, as it seems it not automatic... Is there a way to do it without killing all the running sessions?
0
votes
0answers
18 views

How to get rid of “Authenticated with partial success” message when using two factor authentication

On my linux machine I am writing a PAM module for two factor authentication (https://github.com/kb100/signal-authenticator). It works on an opt in basis so if a user doesn't have a ....
0
votes
1answer
28 views

What PAM service name does useradd use?

The title says everything, but to show that I did my research, I will say that I spent almost half of the day yesterday trying to find the answer for that question. I have run into one page where it ...
1
vote
0answers
59 views

Force OpenSSH server to accept nonexistent usernames?

Can sshd be configured to accept a nonexistent username and log in as a predefined user, such as guest? For example, if I enter ssh nxuser123@localhost, sshd should save "nxuser123" in an environment ...
0
votes
1answer
37 views

Disable expired password change dialog in PAM

I try to find a way to switch off the password change dialog you get when you login with a expired password. """ WARNING: Your password has expired. You must change your password now and login again! ...
0
votes
1answer
150 views

PAM SSSD Allow Local Users

I've got a default SSSD configuration with PAM. I can login fine as any LDAP user. However, when I create a local user on a server: adduser test1 passwd test1 and then try to login as that user I ...
0
votes
1answer
35 views

Debian wheezy pam and samba

I installed a Debian server into a Windows controlled domain. I then tried to give to LDAP users from this domain access to my Debian via Samba, Winbind and Kerberos, which works almost perfectly. In ...
2
votes
1answer
202 views

Public key authentication for LDAP users using local authorized_keys

We are using LDAP for account information. The environment is configured as follows ... A CentOS 7 OpenLDAP directory server A CentOS 7 client configured to use the directory server authconfig has ...
0
votes
0answers
133 views

Autologin and mount encrypted volume in KDE 5

On my machine, I have Fedora 23 (Server) and KDE 5.19. SELinux is deactivated. Furthermore, I have an encrypted home volume (using LUKS). As soon as the user logs in on the SDDM greeter, the encrypted ...
1
vote
0answers
168 views

Mount encrypted partition after login (LUKS/pam_mount)

During the installations of Fedora 23 I have chosen the option to encrypt the /home partition. As expected, I am asked now to enter the passphrase before the login appears. Now, I have to achieve that ...
0
votes
0answers
99 views

Loading kerberos keytab from root cron

When I run a script (see below) to load a kerberos keytab from a users cron it works just fine. Running it from root cron however a password is asked for the keytab and it aborts with: kinit: Generic ...
0
votes
0answers
33 views

How to force users to change password according to policy standard in Debian Linux

In Linux how do I force users to change password according to standard only (that defined in /etc/pam.f/passwd)? I read that pam_cracklib.so only tells user that password is not according to standard ...
0
votes
0answers
85 views

How to determine the source(s) of PAM authentication attempts?

I see persistent authentication attempts in /var/log/messages: Jan 13 02:00:05 ns1 saslauthd[912]: do_auth : auth failure: [user=manager] [service=smtp] [realm=] [mech=pam] [reason=PAM auth ...
0
votes
0answers
12 views

PAM select authentication

Is there an existing mechanism for allowing a user to choose one of various authentication means? Suppose I have a 2FA system set up: Password Second factor TOTP U2F device Possibly other 2nd ...
0
votes
1answer
199 views

passwd fails with passwd: pam_start() failed, error 26 in tahr puppy 6.0.2

From the messages log: Dec 17 08:08:28 puppypc30098 authpriv.err passwd[8265]: PAM _pam_load_conf_file: unable to open /etc/pam.d/common-password The file /etc/pam.d/common-passwd is indeed missing:...
0
votes
0answers
108 views

Centos 7 pam_tally2 not working

I have edited /etc/pam.d/password_auth to block users logging in from ssh with 3 fails: I have added the pam_tally2.so lines: #%PAM-1.0 # This file is auto-generated. # User changes will be ...
0
votes
0answers
19 views

Pam.d not enforcing

I am having an issue with pam.d, I configured the system-auth file with: password requisite pam_cracklib.so try_first_pass retry=3 minlen=x difok=x lcredit=x ucredit=x dcredit=x ocredit=x type=...
0
votes
1answer
56 views

Ubuntu Trusty not showing “System restart required” on first login after unattended-upgrades

I'm running ubuntu 14.04.3 with unattended-upgrades configured to install security updates only. This works as expected, with email notifications as follows when a reboot is required: Unattended ...
1
vote
1answer
319 views

Minimum password length is not working in Linux (RHEL7)

I have set minimum password length to 3 on my RHEL 7 system. Still while using passwd I get error: BAD PASSWORD: The password is shorter than 5 characters. I have changed following parameters: ...
0
votes
0answers
12 views

Adding groups on the fly using PAM

I am using Ubuntu and I've modified group.conf file adding the following line xsh;tty*;username;Al0900-2100;group but I am not getting added to this group. Why is that? Should I do anything else?
0
votes
1answer
58 views

Authentication working with partial password

I have a 13 character long password and my system is allowing me to authenticate with only 8, why? I have no clue at all, so please give me some guide on what to add to my question, for instance ...
1
vote
2answers
2k views

Crontab command cannot be executed. Error PAM configurations

Here's the command that I would like to execute but it seems not to work. [mdubois@veloce ~]$ crontab -l Autorisation refusée You (mdubois) are not allowed to access to (crontab) because of pam ...
2
votes
0answers
179 views

ConsoleKit reports active/is-local only on the second+ login

Running KDE Frameworks 5, Plasma 5, using sddm as a display manager. ConsoleKit and PAM-linux are both installed. Upon login (using the sddm login screen), ck-list-sessions returns FALSE for both is-...
0
votes
1answer
496 views

pam_exec.so doesn't write password to script when expose_authtok is enabled

We are using PAM for authenticating with external radius server. We have the following line in /etc/pam.d/common-auth auth [success=6 default=ignore] pam_exec.so expose_authtok /home/cliuser/...
2
votes
0answers
3k views

Samba, winbind and AD authentication: username is invalid on this system

I am trying to set up a file server with Active Directory authentication using Samba and Winbind. Domain controller is Windows 2000 SP4 (don't judge). File server is Debian 7.7 (latest stable). This ...
2
votes
0answers
357 views

Samba sync password with Unix

I'm trying to set up Samba to sync passwords with Unix (i.e. when someone changes their password via passwd their Samba password is also changed). I've tried following the "Password Synchronization ...
0
votes
1answer
494 views

unable to lock a non-root RHEL account using pam_tally2.so PAM module

I have RHEL 5.5 and making the below change in /etc/pam.d/system-auth file: auth required pam_env.so auth required pam_tally2.so deny=3 onerr=fail auth ...
1
vote
0answers
130 views

Ulimit is set on second login, not first

I'm using Debian Jessie and I have a strange error connected with setting the limit of open files per process. I want to increase the default limit for certain user (me), so I added to /etc/security/...
1
vote
1answer
586 views

Where does Debian take the default umask from?

With a fresh ssh login: $ umask 0007 But: $ find . -maxdepth 1 -name '.*' -type f | xargs grep 007 | less $ # grep 007 /etc/profile # # grep -i umask /etc/login.defs # UMASK ...
1
vote
2answers
127 views

Is it possible to define a custom basepath for proftpd home directories?

I know the DefaultRoot ~ setting that you can use to jail users into their home directories but I need to customize this. When authenticating with proftpd I get the user's home-directory from ldap ...
1
vote
0answers
1k views

Can't perform Kerberos login

I can't do a Kerberos login. I've tweaked rsyslog to record *.debug to /var/log/debug, whose output is below. If I attempt to log in with ssh, I get: Jun 6 23:13:05 foo-machine sshd[13965]: ...
0
votes
1answer
166 views

Change order of two-factor-authentication

I am testing two-factor-authentication for ssh logins on some CentOS containers in our testing environment. I compiled my own rpms from github's source, installed and configured everything and have ...
0
votes
0answers
48 views

ec2 enable su for user ubuntu

I am trying to enable rstudio-server login with ubuntu on ec2, but it fails. I think it uses the same auth mechanism as su. So I did sudo passwd su someotheruser su ubuntu But even though I know ...
0
votes
1answer
155 views

Deploy PAM system-auth file from Configuration Server (Spacewalk)

I have my pam.d system-auth file set up correctly on a laptop to set password complexity requirements. If the contents of the file are copied directly into the /etc/pam.d/system-auth location (or the /...
2
votes
0answers
76 views

using pam_mount in WLAN setting

I thought this should be a simple exercise here, but obviously I couldn't find a solution, yet. I use KDE on Ubuntu 12 LTS. I want to use libpam-mount to mount a nfs share to a directory within user's ...
1
vote
1answer
425 views

pam_tally2 does not show address of the failing user

See this output below: # pam_tally2 -u Login Failures Latest failure From root 1 04/16/14 16:44:16 10.4.1.189 greg 2 04/16/14 16:35:57 unknown ...
0
votes
1answer
362 views

Why shadow password hashed with sha512 contains 99 instead of 129 characters?

My Linux is configured to use sha512. Yet, the /etc/shadow file contains hashed password with 99 characters only. Why 99 and not 129 (64*2+1)? Note that I had changed password after making sure the ...
1
vote
0answers
52 views

Does sequence matter in case of pam_env.so and pam_tally2.so together?

Very short question. auth required pam_env.so auth required pam_tally2.so deny=3 even_deny_root unlock_time=120 or auth required pam_tally2.so deny=3 ...
2
votes
1answer
1k views

Debian disable su to root user

I am currently using Debian 7 (Wheezy) and I am trying to disable the su command only when the target user is root and not a privileged user. For example, let's suppose the following users exist: ...
2
votes
1answer
3k views

Is there a way to force all Linux users to change their passwords on first login?

I am looking for a way to configure Linux machine so any time a new user is created, he/she will have to set a new password on first login. To clarify the task here are assumptions: I am not ...
1
vote
0answers
511 views

xrdp with two factor authentication (libpam-google-authenticator)

I'm trying to setup a Debian VM that uses two factor authentication for logins via google-authenticator's PAM plugin. The google-authenticator part is working great through regular console logins or ...
4
votes
1answer
2k views

PAM Authentication / Login

I'm having a little issue on Ubuntu where any commands that require root privileges takes longer to execute than normal. I managed to identify the culprit to the cause after checking my /var/log/auth....
0
votes
1answer
816 views

Can't login with KDM and SSSD but the login works fine from the console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 10:...
2
votes
0answers
3k views

How to trace LDAP authentication failures?

1) I have a working LDAP server which I've confirmed can be used with LDAP clients, running on ec2 via jumpbox. 2) I've run authconfig to setup ldap based authentication, to point to the server: ...
1
vote
1answer
195 views

Authentication Failure Upon Successful Login

I was reveiwing the logs when I was successful in logging into a workstation - however in the in the var/log/secure log it is logged as > gnome-screensaver-dialog:pam_unix(gnome-screensaver:auth): ...
2
votes
1answer
577 views

How can I set path for non-interactive user authenticated using LDAP?

On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here: http://...
0
votes
2answers
1k views

lsuser substitute in Linux?

Is there a way I can get information on the password for a particular user like what is the minimum length and minalpha and etc.? In AIX we have a command called lsuser: lsuser -a minlen username ...
1
vote
1answer
966 views

Restricting access with PAM - sufficient vs. required

I'm trying to restrict SSH access to certain groups, plus the users specified in a file. The groups are listed in /etc/ssh/user.allow, and the groups in /etc/ssh/group.allow. I've tried using the ...
0
votes
1answer
516 views

How to have a user who can 'su' to another user but not allowed to 'su' root

In my server, I have 2 groups: ssh-users and su-users ssh-users hold users I ssh to the box with. User sshu is a member of ssh-users. Once logged in to the server, I want ssh-users members to be able ...
1
vote
0answers
1k views

CIFS share via LDAP + SSL

I have NAS drive which is bound to an Open Directory LDAP server for authentication with SSL enabled. The NAS allows for CIFS shares to be accessed via LDAP authentication. (in this case the NAS is a ...