The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
3 views

pam_tally2 does not show address of the failing user

See this output below: # pam_tally2 -u Login Failures Latest failure From root 1 04/16/14 16:44:16 10.4.1.189 greg 2 04/16/14 16:35:57 unknown ...
0
votes
1answer
22 views

Why shadow password hashed with sha512 contains 99 instead of 129 characters?

My Linux is configured to use sha512. Yet, the /etc/shadow file contains hashed password with 99 characters only. Why 99 and not 129 (64*2+1)? Note that I had changed password after making sure the ...
1
vote
0answers
6 views

Does sequence matter in case of pam_env.so and pam_tally2.so together?

Very short question. auth required pam_env.so auth required pam_tally2.so deny=3 even_deny_root unlock_time=120 or auth required pam_tally2.so deny=3 ...
2
votes
1answer
30 views

Debian disable su to root user

I am currently using Debian 7 (Wheezy) and I am trying to disable the su command only when the target user is root and not a privileged user. For example, let's suppose the following users exist: ...
2
votes
1answer
41 views

Is there a way to force all Linux users to change their passwords on first login?

I am looking for a way to configure Linux machine so any time a new user is created, he/she will have to set a new password on first login. To clarify the task here are assumptions: I am not ...
0
votes
0answers
37 views

How to connect Linux machines to a Windows Active Directory with different user rights?

I have a Windows Active Directory Setup with Windows Clients. So far our Linux machines did not authenticate against the AD, I used root to login. Now I wanted to add those Linux machines to the AD ...
0
votes
0answers
25 views

How to change limits of non-interactive process?

I am trying to change the RTPRIO limit of a process that's run at startup. I have found 3 ways to change process interactively: setrlimit ulimit /etc/security/limits.conf However these only seem ...
1
vote
0answers
70 views

xrdp with two factor authentication (libpam-google-authenticator)

I'm trying to setup a Debian VM that uses two factor authentication for logins via google-authenticator's PAM plugin. The google-authenticator part is working great through regular console logins or ...
3
votes
0answers
198 views

PAM Authentication / Login

I'm having a little issue on Ubuntu where any commands that require root privileges takes longer to execute than normal. I managed to identify the culprit to the cause after checking my ...
0
votes
0answers
30 views

Is pam_url limited only to HTTPS?

As you probably are aware, pam_url has almost no documentation. I am trying to use pam_url to authenticate my users against ArangoDB database. Here is my /et/pam_url.conf file: # pam_url ...
0
votes
1answer
124 views

Can't login with KDM and SSSD but the login works fine from the console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 ...
0
votes
0answers
76 views

How to trace LDAP authentication failures?

1) I have a working LDAP server which I've confirmed can be used with LDAP clients, running on ec2 via jumpbox. 2) I've run authconfig to setup ldap based authentication, to point to the server: ...
1
vote
0answers
32 views

Authentication Failure Upon Successful Login

I was reveiwing the logs when I was successful in logging into a workstation - however in the in the var/log/secure log it is logged as > gnome-screensaver-dialog:pam_unix(gnome-screensaver:auth): ...
1
vote
1answer
147 views

How can I set path for non-interactive user authenticated using LDAP?

On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here: ...
0
votes
2answers
224 views

lsuser substitute in Linux?

Is there a way I can get information on the password for a particular user like what is the minimum length and minalpha and etc.? In AIX we have a command called lsuser: lsuser -a minlen username ...
0
votes
1answer
93 views

Restricting access with PAM - sufficient vs. required

I'm trying to restrict SSH access to certain groups, plus the users specified in a file. The groups are listed in /etc/ssh/user.allow, and the groups in /etc/ssh/group.allow. I've tried using the ...
0
votes
1answer
140 views

How to have a user who can 'su' to another user but not allowed to 'su' root

In my server, I have 2 groups: ssh-users and su-users ssh-users hold users I ssh to the box with. User sshu is a member of ssh-users. Once logged in to the server, I want ssh-users members to be able ...
1
vote
0answers
243 views

CIFS share via LDAP + SSL

I have NAS drive which is bound to an Open Directory LDAP server for authentication with SSL enabled. The NAS allows for CIFS shares to be accessed via LDAP authentication. (in this case the NAS is a ...
0
votes
3answers
2k views

How do I disable or modify pam's password requirements?

I'm using Fedora 19. By default it's setup with pam to disable bad passwords, like "password". This is good. Trying to change this default is infuriating. This is a box for testing internal stuff, not ...
0
votes
0answers
110 views

pam_unix: account has expired

I have setup my Ubuntu 13.4 machine with LDAP authentication. However when I try to send email, I am getting the following message: auth: pam_unix(dovecot:account): account has expired (account ...
0
votes
0answers
113 views

FTP upload : Authentication failed

I failed to upload files by pure-ftpd with MySQL support. In pure-ftpd server log I saw the following: pure-ftpd: (?@mail.somedomain.com) [INFO] New connection from mail.somedomain.com pure-ftpd: ...
0
votes
0answers
113 views

How to use OpenLDAP to centrally authenticate multiple users on multiple Linux machines

Background: I've successfully set up OpenLDAP on Ubuntu 12.04 (UB1) to centralise and remotely administer authentication of users on a single Linux machine using PAM. I can give each user arbitrary ...
2
votes
3answers
293 views

How can I determine if a client SSH connection has a tty associated with it?

Im writing a PAM module to handle authentication (server side - sshd) and I have to know if an ssh client is a tty (interactive) or not (non interactive). Does anyone have a clue?
1
vote
0answers
169 views

Is there a size limit for pam modules run by vsftpd?

I'm writing a pam module to let users authenticate against a PostreSQL database linked to a Django site. It works fine when I let sshd use it, but whenever I try it with vsftpd I get the following ...
1
vote
1answer
757 views

Setting User Password Policy as per their group Linux?

I wanted to set a password restriction policy , like minlen , maxage , minage etc . I know the way to do it system wide , Can we do it for a particular group of users . I mean only users under ...
4
votes
1answer
188 views

Root account locked/suspended?

I'm shipping ts7800 boards running debian 6.07. After programming, some boards do not run their cron jobs, complaining that they do not recognise the user root. This happened on 2 out of 12 ...
0
votes
1answer
78 views

Could SSH client connect to SSHServer and create user if not exists?

My question is the next, Could I create users in server (on sshd), when ssh client connect to the server and in this moment create account in server with a spectific group and permissions for this ...
0
votes
0answers
75 views

Google authenticator doesn't seem to work

I followed these instructions and got google-authenticator setup on an Ubuntu LiveCD for test purposes. And it doesn't work. I've tried running google-authenticator probably ten times and maybe I'm ...
1
vote
1answer
597 views

Using OpenSSH Server without local user

Currently I've noticed when I use the OpenSSH Server with PAM and for instance RADIUS while I can get the user to authenticate successfully with PAM, I still need a local user account in /etc/passwd, ...
0
votes
1answer
125 views

Using virtual users with pam gives error

I get this error from PAM using mysql with vsftpd: PAM unable to dlopen(/lib/security/pam_mysql.so): /lib/security/pam_mysql.so: undefined symbol: make_scrambled_password From what I understand ...
0
votes
1answer
130 views

unix_chkpw run before access.conf via pam - security risk

I have RHEL 6.3 systems that have PAM's access.conf correctly configured and running. However, it seems in a less than ideal state, after analysis of a root-hack attempt, and I'm wondering if there's ...
2
votes
1answer
1k views

Linux user issues with PAM?

Had setup a user to use instead of root. Was working fine and dandy till I started playing with user settings. Now all users (apart from root) borked. Can't login (ssh) with other users, even after ...
1
vote
1answer
102 views

Running multiple vsftpd daemons with multiple PAM files

If I am running multiple vsftpd daemons on a single machine, is it possible to specify the pluggable authentication module for each one? In other words, can two vsftpd server instances run on ...
2
votes
1answer
312 views

Prevent linux user from changing their password in ssh

How can I prevent users from changing their passwords? I still want to be able to change the passwords as root if necessary but keep the user from changing their password.
0
votes
1answer
370 views

Mac OS X: Make home directory at login via SSH

I have LDAP server on Ubuntu 12.04 and Mac OS X 10.7.5 client configured via Directory Service. The NFSHomeDirectory property mapped to #/Users/$uid$. LDAP users can login to Mac via login screen or ...
1
vote
1answer
818 views

How do I build openvpn without libpam?

Since I have no root privilege to install libpam, I failed to run ./configure. So is there any method with which I can build openvpn without libpam? checking for OPENSSL_CRYPTO... yes checking for ...
1
vote
0answers
138 views

Without pam (Pluggable Authentication Modules) how linux system will behave?

Suppose if we create nologin file under /etc then only root can login, but if we comment on all pam_nologin.so line in every file under /etc/pam.d/ then other user also login. That means these ...
2
votes
0answers
336 views

Alternative (pref. mature) Linux PAM authentication methods?

I'm looking for alternative, non-keyboard-password authentication methods to unlock my laptop. Whatever authentication it is, it should be quick and convenient to perform and relatively secure. Yes, ...
0
votes
0answers
463 views

ssh login with mail address

I have an Ldap Server configured an running and another server listen to this users database. (Ldap client) I need to force users login on ssh with user as email (dc: mail=myself@anymail.com) ...
0
votes
2answers
359 views

How can I avoid hard-coding YubiKey user identities into the PAM stack?

The Yubico PAM Module seems to require changes to the PAM stack for each user that will be authenticated with a YubiKey. Specifically, it seems that each user's client identity must be added to the ...
0
votes
0answers
46 views

Switching user in openssh using PAM

I'm trying to write a PAModule which will use compare the inserted username against a file. If the username exists in the file, it will change the username to root (since the username does not really ...
4
votes
2answers
2k views

How do I permanently delete /var/log/lastlog?

My /var/log/lastlog file is huge. I know it's really only a few kilobytes, but tar isn't smart enough to know that, so when I image a virtual machine, my restore fails because it thinks I'm trying to ...
1
vote
1answer
503 views

Use user-installed shell? [duplicate]

How do I change my shell to one installed in my home directory? I installed a new zsh in my home directory, which is picked up: >> which zsh >> /home/myname/bin/zsh It's not listed in ...
3
votes
3answers
5k views

Why won't vsftpd let me log in with a virtual user account?

I would like to use vsftpd with virtual users and pam_pwdfile.so. I installed vsftpd and added two users (ramon and dragon) via htpasswd to my file /etc/vsftpd.passwd. The /etc/pam.d/vsftpd is ...
3
votes
0answers
503 views

limits.conf ulimits not being applied to chrooted processes

We allow users to execute scripts on our servers. Our security model involves chrooting them. We want to be able to apply ulimit restrictions to them, and the best way to do it would seem to be in ...
2
votes
1answer
3k views

How can i block su access to some users only in linux

I want to configure pam in a way so that my some users can su to only some user. In RHEL4, I used /etc/pam.d/su auth required /lib/security/$ISA/pam_stack.so service=system-auth auth ...
0
votes
2answers
1k views

authenticating linux client with active directory

I am attempting to setup a linux client to authenticate with active directory. I tried following this article, but have had no luck authenticating: ...
1
vote
0answers
169 views

Single sign on with remote SSH server

Is it possible to authorize user based on provided login and password by connecting to remote SSH server? If connection is successfully established and login-password pair is logged on the remote ...
0
votes
1answer
671 views

Using pam_exec.so for openvpn authentication

I've set up a PAM authentication config for OpenVPN. auth required pam_exec.so debug expose_authtok /opt/openvpn/bin/pamauth The script pamauth returns 0 on success. I verify this is true by also ...
1
vote
2answers
2k views

pam mount - my password prompt now says pam_mount password:

I am using pam_mount to mount users' home directory upon successfully logging into the system. It works; however, the password prompt says: pam_mount password: Instead of just: password: How can ...