Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

6
votes
4answers
10k views

How do I disable or modify pam's password requirements?

I'm using Fedora 19. By default it's setup with pam to disable bad passwords, like "password". This is good. Trying to change this default is infuriating. This is a box for testing internal stuff, not ...
5
votes
3answers
9k views

Why won't vsftpd let me log in with a virtual user account?

I would like to use vsftpd with virtual users and pam_pwdfile.so. I installed vsftpd and added two users (ramon and dragon) via htpasswd to my file /etc/vsftpd.passwd. The /etc/pam.d/vsftpd is ...
4
votes
3answers
5k views

How do I permanently delete /var/log/lastlog?

My /var/log/lastlog file is huge. I know it's really only a few kilobytes, but tar isn't smart enough to know that, so when I image a virtual machine, my restore fails because it thinks I'm trying to ...
4
votes
2answers
1k views

Prevent linux user from changing their password in ssh

How can I prevent users from changing their passwords? I still want to be able to change the passwords as root if necessary but keep the user from changing their password.
4
votes
1answer
408 views

Root account locked/suspended?

I'm shipping ts7800 boards running debian 6.07. After programming, some boards do not run their cron jobs, complaining that they do not recognise the user root. This happened on 2 out of 12 ...
4
votes
1answer
2k views

PAM Authentication / Login

I'm having a little issue on Ubuntu where any commands that require root privileges takes longer to execute than normal. I managed to identify the culprit to the cause after checking my ...
3
votes
1answer
801 views

limits.conf ulimits not being applied to chrooted processes

We allow users to execute scripts on our servers. Our security model involves chrooting them. We want to be able to apply ulimit restrictions to them, and the best way to do it would seem to be in ...
3
votes
2answers
10k views

/etc/security/limits.conf for setting program limits in Linux

I have the following inside /etc/security/limits.conf (I have specified root separately because * will not include it.) user2 - core unlimited * - core 0 root ...
3
votes
0answers
734 views

Alternative (pref. mature) Linux PAM authentication methods?

I'm looking for alternative, non-keyboard-password authentication methods to unlock my laptop. Whatever authentication it is, it should be quick and convenient to perform and relatively secure. Yes, ...
3
votes
1answer
6k views

How can i block su access to some users only in linux

I want to configure pam in a way so that my some users can su to only some user. In RHEL4, I used /etc/pam.d/su auth required /lib/security/$ISA/pam_stack.so service=system-auth auth ...
2
votes
1answer
3k views

Is there a way to force all Linux users to change their passwords on first login?

I am looking for a way to configure Linux machine so any time a new user is created, he/she will have to set a new password on first login. To clarify the task here are assumptions: I am not ...
2
votes
1answer
1k views

Use user-installed shell? [duplicate]

How do I change my shell to one installed in my home directory? I installed a new zsh in my home directory, which is picked up: >> which zsh >> /home/myname/bin/zsh It's not listed in ...
2
votes
1answer
1k views

Debian disable su to root user

I am currently using Debian 7 (Wheezy) and I am trying to disable the su command only when the target user is root and not a privileged user. For example, let's suppose the following users exist: ...
2
votes
1answer
4k views

Linux user issues with PAM?

Had setup a user to use instead of root. Was working fine and dandy till I started playing with user settings. Now all users (apart from root) borked. Can't login (ssh) with other users, even after ...
2
votes
1answer
2k views

How do I build openvpn without libpam?

Since I have no root privilege to install libpam, I failed to run ./configure. So is there any method with which I can build openvpn without libpam? checking for OPENSSL_CRYPTO... yes checking for ...
2
votes
2answers
995 views

Linux (Ubuntu) USB Auth

I want to be able to authenticate with PAM using a USB drive with a file on it. I've read about how to do this with a PAM module that reads the specific USB hardware ID of a device, but if the device ...
2
votes
1answer
84 views

Public key authentication for LDAP users using local authorized_keys

We are using LDAP for account information. The environment is configured as follows ... A CentOS 7 OpenLDAP directory server A CentOS 7 client configured to use the directory server authconfig has ...
2
votes
0answers
164 views

ConsoleKit reports active/is-local only on the second+ login

Running KDE Frameworks 5, Plasma 5, using sddm as a display manager. ConsoleKit and PAM-linux are both installed. Upon login (using the sddm login screen), ck-list-sessions returns FALSE for both ...
2
votes
0answers
2k views

Samba, winbind and AD authentication: username is invalid on this system

I am trying to set up a file server with Active Directory authentication using Samba and Winbind. Domain controller is Windows 2000 SP4 (don't judge). File server is Debian 7.7 (latest stable). This ...
2
votes
0answers
344 views

Samba sync password with Unix

I'm trying to set up Samba to sync passwords with Unix (i.e. when someone changes their password via passwd their Samba password is also changed). I've tried following the "Password Synchronization ...
2
votes
0answers
71 views

using pam_mount in WLAN setting

I thought this should be a simple exercise here, but obviously I couldn't find a solution, yet. I use KDE on Ubuntu 12 LTS. I want to use libpam-mount to mount a nfs share to a directory within user's ...
2
votes
0answers
3k views

How to trace LDAP authentication failures?

1) I have a working LDAP server which I've confirmed can be used with LDAP clients, running on ec2 via jumpbox. 2) I've run authconfig to setup ldap based authentication, to point to the server: ...
2
votes
1answer
555 views

How can I set path for non-interactive user authenticated using LDAP?

On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here: ...
2
votes
3answers
1k views

How can I determine if a client SSH connection has a tty associated with it?

Im writing a PAM module to handle authentication (server side - sshd) and I have to know if an ssh client is a tty (interactive) or not (non interactive). Does anyone have a clue?
2
votes
2answers
1k views

how to allow a certain group of useres to only login via LDAP while others can use LDAP or local login?

I managed to set up my system to use either LDAP or the local password (by adding "password sufficient pam_ldap.so" to PAM and calling "pam_unix2.so" afterwards). However I would like to restrict a ...
1
vote
2answers
510 views

How can I avoid hard-coding YubiKey user identities into the PAM stack?

The Yubico PAM Module seems to require changes to the PAM stack for each user that will be authenticated with a YubiKey. Specifically, it seems that each user's client identity must be added to the ...
1
vote
1answer
929 views

Restricting access with PAM - sufficient vs. required

I'm trying to restrict SSH access to certain groups, plus the users specified in a file. The groups are listed in /etc/ssh/user.allow, and the groups in /etc/ssh/group.allow. I've tried using the ...
1
vote
2answers
3k views

pam mount - my password prompt now says pam_mount password:

I am using pam_mount to mount users' home directory upon successfully logging into the system. It works; however, the password prompt says: pam_mount password: Instead of just: password: How can ...
1
vote
1answer
203 views

Minimum password length is not working in Linux (RHEL7)

I have set minimum password length to 3 on my RHEL 7 system. Still while using passwd I get error: BAD PASSWORD: The password is shorter than 5 characters. I have changed following parameters: ...
1
vote
1answer
2k views

Using OpenSSH Server without local user

Currently I've noticed when I use the OpenSSH Server with PAM and for instance RADIUS while I can get the user to authenticate successfully with PAM, I still need a local user account in /etc/passwd, ...
1
vote
2answers
2k views

GPG smartcards handling 4096-bit keys

are there smartcards that handle 4096-bit keys supported both by GPG and Enigmail (PAM would be additional benefit)? Preferably on USB.
1
vote
1answer
524 views

Where does Debian take the default umask from?

With a fresh ssh login: $ umask 0007 But: $ find . -maxdepth 1 -name '.*' -type f | xargs grep 007 | less $ # grep 007 /etc/profile # # grep -i umask /etc/login.defs # UMASK ...
1
vote
1answer
416 views

pam_tally2 does not show address of the failing user

See this output below: # pam_tally2 -u Login Failures Latest failure From root 1 04/16/14 16:44:16 10.4.1.189 greg 2 04/16/14 16:35:57 unknown ...
1
vote
0answers
105 views

Mount encrypted partition after login (LUKS/pam_mount)

During the installations of Fedora 23 I have chosen the option to encrypt the /home partition. As expected, I am asked now to enter the passphrase before the login appears. Now, I have to achieve that ...
1
vote
2answers
2k views

Crontab command cannot be executed. Error PAM configurations

Here's the command that I would like to execute but it seems not to work. [mdubois@veloce ~]$ crontab -l Autorisation refusée You (mdubois) are not allowed to access to (crontab) because of pam ...
1
vote
0answers
120 views

Ulimit is set on second login, not first

I'm using Debian Jessie and I have a strange error connected with setting the limit of open files per process. I want to increase the default limit for certain user (me), so I added to ...
1
vote
2answers
121 views

Is it possible to define a custom basepath for proftpd home directories?

I know the DefaultRoot ~ setting that you can use to jail users into their home directories but I need to customize this. When authenticating with proftpd I get the user's home-directory from ldap ...
1
vote
0answers
1k views

Can't perform Kerberos login

I can't do a Kerberos login. I've tweaked rsyslog to record *.debug to /var/log/debug, whose output is below. If I attempt to log in with ssh, I get: Jun 6 23:13:05 foo-machine sshd[13965]: ...
1
vote
0answers
50 views

Does sequence matter in case of pam_env.so and pam_tally2.so together?

Very short question. auth required pam_env.so auth required pam_tally2.so deny=3 even_deny_root unlock_time=120 or auth required pam_tally2.so deny=3 ...
1
vote
0answers
464 views

xrdp with two factor authentication (libpam-google-authenticator)

I'm trying to setup a Debian VM that uses two factor authentication for logins via google-authenticator's PAM plugin. The google-authenticator part is working great through regular console logins or ...
1
vote
1answer
179 views

Authentication Failure Upon Successful Login

I was reveiwing the logs when I was successful in logging into a workstation - however in the in the var/log/secure log it is logged as > gnome-screensaver-dialog:pam_unix(gnome-screensaver:auth): ...
1
vote
0answers
1k views

CIFS share via LDAP + SSL

I have NAS drive which is bound to an Open Directory LDAP server for authentication with SSL enabled. The NAS allows for CIFS shares to be accessed via LDAP authentication. (in this case the NAS is a ...
1
vote
0answers
345 views

Is there a size limit for pam modules run by vsftpd?

I'm writing a pam module to let users authenticate against a PostreSQL database linked to a Django site. It works fine when I let sshd use it, but whenever I try it with vsftpd I get the following ...
1
vote
1answer
2k views

Setting User Password Policy as per their group Linux?

I wanted to set a password restriction policy , like minlen , maxage , minage etc . I know the way to do it system wide , Can we do it for a particular group of users . I mean only users under ...
1
vote
1answer
200 views

Running multiple vsftpd daemons with multiple PAM files

If I am running multiple vsftpd daemons on a single machine, is it possible to specify the pluggable authentication module for each one? In other words, can two vsftpd server instances run on ...
1
vote
0answers
174 views

Without pam (Pluggable Authentication Modules) how linux system will behave?

Suppose if we create nologin file under /etc then only root can login, but if we comment on all pam_nologin.so line in every file under /etc/pam.d/ then other user also login. That means these ...
1
vote
0answers
182 views

Single sign on with remote SSH server

Is it possible to authorize user based on provided login and password by connecting to remote SSH server? If connection is successfully established and login-password pair is logged on the remote ...
0
votes
1answer
343 views

Why shadow password hashed with sha512 contains 99 instead of 129 characters?

My Linux is configured to use sha512. Yet, the /etc/shadow file contains hashed password with 99 characters only. Why 99 and not 129 (64*2+1)? Note that I had changed password after making sure the ...
0
votes
2answers
1k views

authenticating linux client with active directory

I am attempting to setup a linux client to authenticate with active directory. I tried following this article, but have had no luck authenticating: ...
0
votes
1answer
53 views

Authentication working with partial password

I have a 13 character long password and my system is allowing me to authenticate with only 8, why? I have no clue at all, so please give me some guide on what to add to my question, for instance ...