Questions tagged [pam]
Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
135
questions
0
votes
0
answers
42
views
PAM updates for mounting an encrypted user's home at login (GNOME 40.4.0)
I would like to decrypt my LUKS encrypted /home directory at login on Rocky Linux 9.1. I have been trying to adapt this Arch Linux guide (https://wiki.archlinux.org/title/Dm-crypt/Mounting_at_login; ...
- 1
0
votes
0
answers
11
views
Can authconfig/authselect only be used with PAM modules known by authconfig/authselect?
I have a machine running CentOS 7 with a PAM setup which has been modified without using authconfig and am looking at reproducing a similar setup on a machine running AlmaLinux 8.
My understanding of ...
- 121
1
vote
1
answer
86
views
PAM authentication problems
I am trying to set up PAM authentication along side public key authentication in SSH inside of a LXD arch container. when i connect and give the proper code, i get this information in the journal on ...
- 11
0
votes
0
answers
56
views
How to use getty and /bin/login together with pam_gdm?
Problem statement
I have a bit of a journey behind me. I have a single user setup with full disk encryption on arch linux and use swaylock as lock method. So a window manager appears to be unnecessary....
0
votes
0
answers
99
views
Why am I able to login into Cockpit web UI even though I disabled PAM and password authentication?
I have these settings on my remote machine under /etc/ssh/sshd_config
PermitRootLogin no
PermitRootLogin prohibit-password
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
The ...
- 1
0
votes
1
answer
100
views
OpenSSH: allow nonexistent user to login
I'm trying to login using SSH on a OpenSSH Linux server with nonexistent unix logins that will be authenticated through to a external webservice using PAM module pam_exec and create a local account on ...
- 33
0
votes
1
answer
69
views
I think I broke gdm3 login by sudo pam-auth-update --force
I was trying to solve a problem where the software updater would give me a message saying I was not permitted to use it, though I could do it from the terminal fine, and so I tried a remedy that ...
1
vote
0
answers
96
views
Slackware 15: Google Authenticator configuration issue / Access Denied
I am trying to install Google Authenticator on Slackware 15 and I seem to be stuck.
My steps were:
Installed google authenticator
Added in /etc/pam.d/ssh the following line at the top of the file
...
- 11
0
votes
1
answer
1k
views
Automatically add AD users to linux group
I need to add users to a specific group on Linux automatically to allow running some programs from another user with no password prompt like:
su nopswduser -c 'echo Hello'
I'm adding group to local ...
0
votes
1
answer
569
views
ssh public key authentication with PAM
My Ubuntu servers are using kerberos auth for ssh with password failover using PAM. I'd like to add public key authentication as well. As I read that doesn't really work.
Has anyone implemented this ...
- 1
1
vote
1
answer
261
views
sssd only authenticates against first domain in domains list unless domain specified in login
I am currently moving from using pam_krb5 to pam_sss as pam_krb5 is no longer available at CentOS/RHEL 8
We currently use two AD domains each with unique user names. In the old pam configuration we ...
0
votes
1
answer
152
views
Does pam_cifscreds module work with sudo access?
I have an RHEL (7.9) server with a remote drive mounted as a multiuser CIFS volume. With multiuser CIFS shares, users need to execute an additional command (cifscreds add) in order to access it. This ...
- 101
1
vote
0
answers
181
views
php-pam for php7.3 and php7.4 in parallel?
I have both php7.4 and php7.3 in use on my Debian 10 (buster) system as I have dependencies on both. (From https://deb.sury.org/ php apt repos.)
But the pam module is not available as a version-...
- 878
1
vote
1
answer
114
views
How to configure different authentication methods for different OpenSSH processes
I have an SFTP server on CentOS 7. On this server, I run 2 OpenSSH processes with different configuration.
one is standard SSH on port 22 for administration purpose
the other is only SFTP on port ...
- 131
1
vote
1
answer
276
views
Why does `sudo` fail in a simple container on Fedora 32?
I am scratching my head trying to figure this one out.
Under a freshly installed Fedora 32, the following minimal container does not execute properly:
FROM centos:7
RUN yum install -y sudo && ...
- 111
0
votes
0
answers
239
views
How to create a .bashrc file when the user has a remote directory
I am trying to configure a custom prompt for RHEL 8 users. It works very nice when the users have local home directories.
However, I'm mounting home directories via pam_mount (nfs4). When ssh'ing to ...
- 101
0
votes
1
answer
375
views
xrdp and tigervnc for Manjaro
There have been greater changes concerning tigervnc and pam/pambase in the last months. Since then, my setup does not work anymore. Does someone have a guide for setting up xrdp + tigervnc + pam for
...
2
votes
1
answer
2k
views
SSH server asking for password, but PasswordAuthentication is disabled
what you will see is the current state of a problem I am trying to solve.
I restarted sshd before filling the body this question.
What I am trying to do:
I need to use ssh keys with a yubikey ...
- 71
0
votes
1
answer
247
views
remote execution of command failing due to sudo issue
i am running a command from my server which would remotely ssh to by client machine as root and sudo as olcne user and run few commands for validation. I have added the olcne user in sudoer list. i ...
1
vote
1
answer
12k
views
sudo: PAM account management error: Permission denied
I'm trying connect a Linux machine to AD and I made some changes in some files below:
/etc/krb5.conf
/etc/pam.d/system-auth
/etc/samba/smb.conf
After these changes I connected the server to AD with ...
- 755
1
vote
1
answer
1k
views
Issues with SSH from an external IP
So I've been trying to have an accessible SSH server from home, and I opened the SSH port so that It would be accessible from the internet. When I log in through my LAN IP address, everything goes ...
- 13
0
votes
0
answers
58
views
Issues SSHing into my machine
So I've been trying to have an accessible SSH server from home, and I opened the SSH port so that It would be accessible from the internet. When I log in through my LAN IP address, everything goes ...
- 13
0
votes
1
answer
995
views
GPG autologin with pam, pinentry
Recently I started using Neomutt with Luke´s mutt-wizward and therefore I have to setup pass and gpg, which were both new to me. I know how public and private key encryption works but after playing/...
3
votes
0
answers
567
views
LDAP, PAM, and expiring accounts
I'm using LDAP on a Debian 9.8 system. After receiving a
Your account has expired; please contact your system administrator
for one of my users, I tried unsuccessfully several of the solutions ...
- 31
0
votes
1
answer
232
views
SSSD: Multiple machines using a single LDAP bind
I have configured SSSD on my company’s machines to authenticate against AD. We have approximately 15,000 machines that are going to be switched on to use SSSD. When we enabled SSSD, our network went ...
- 1
-2
votes
1
answer
141
views
Where to get PAM auth DLL for win64
My python pack (Python-pam package) needs PAM auth lib DLL.
libpam=CDLL(find_library("pam"))
libc=CDLL(find_library("c"))
Where to get those dlls.
3
votes
1
answer
2k
views
Using PAM to unlock pass (gpg-preset-passphrase)
I'm using pass as my password manager with the browserpass plugin and passmenu. Currently I have to unlock my GPG keys manually in the console before I can use the plugin on a website (otherwise it ...
- 131
3
votes
1
answer
14k
views
pam_sss(sshd:account): Access denied for user AD
sssd.conf:
[sssd]
domains = corp.com
config_file_version = 2
services = nss, pam
[domain/corp.com]
ad_domain = corp.lecapam.com
krb5_realm = CORP.COM
realmd_tags = manages-system joined-with-samba
...
- 51
0
votes
1
answer
161
views
How do I require MFA only when it has been set up?
I'd like to require every user to use MFA with Google Authenticator. Each time I add a new user, I want to allow them to log in using their SSH key only once, and upon login require them to create a ...
- 222
2
votes
1
answer
599
views
sshd seems to ignore pam auth section when authorizing through private key
I configure ssh authorization to drop some users with rules, defined in script, and also give them some extended capabilities when they login. I use two pam modules - pam_script and pam_cap and change ...
- 155
1
vote
0
answers
408
views
Pam.exec exit code 8
I'm trying to use pam.d to execute a script on user login. Right now I'm editing the /etc/pam.d/su file. Every time I log in to a user I get "Exit code 8".
The command I put in there is:
session ...
- 11
1
vote
0
answers
14
views
Issue in JBOSS BPM Process Execution
I have setup the JBOSS PAM Server and try to run some sample project, but I keep getting the following error:
Org.jboss.resteasy.spi.UnhandledException : java.lang.NoClassDefFoundException : org/...
0
votes
1
answer
770
views
How can I audit su access through pam.d in RHEL 7
I am a system auditor with very limited knowledge of Linux OS. I am currently auditing a RHEL 7 server and found out that a group of users are authenticating through LDAP and using 'su' through PAM. I'...
0
votes
0
answers
255
views
What is difference of pam.d config ubuntu and redhat?
While handling pam.d setting on Ubuntu and RedHat,
I saw something like this on Ubuntu
auth [success=3 default=ignore] pam_krb5.so minimum_uid=1000
auth [default=ignore] pam_unix....
- 211
2
votes
1
answer
288
views
re-requiring sudo prompt for a password?
By default sudo seems to cache passwords for like 5 or so minutes. ie. You do sudo something once and you're prompted for the password and then any subsequent sudo command you do for 5 minutes doesn't ...
- 6,545
1
vote
0
answers
506
views
PAM SSH authentication pam_exec
I am trying to bypass SSH password authentication if some shell script return success code (0).
this is my configuration. Please help to fix this if possible or suggest me if need change solution
...
- 113
0
votes
0
answers
616
views
Smart card issue with OpenSC (pklogin_finder debug) only on CentOS
I'm trying to use a smart card on CentOS but I'm stuck. I'm using OpenSC, and I need to implement a special module to use my smart card (libgtop11dotnet).
It doesn't work on CentOS, but I tested on ...
- 11
0
votes
1
answer
698
views
Create user with password and without ssh key on redhat
I have a very simple question, I have created an instance with aws AMI. I can log into it using my key. But I want to login using a username and password.
useradd username -p password
This has ...
- 13
2
votes
1
answer
9k
views
pam_sss access denied with kerberos authentication ok
I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
- 33
0
votes
1
answer
37
views
Removed some /usr/include/rpcscv headers and .x files by mistake and libnsl.so
I use archlinux and removed some /usr/include/rpcscv headers and .x files by mistake and libnsl.so.
I know it is stupid, but I don't know how to find them and put them back.
These files are related ...
- 798
3
votes
1
answer
1k
views
Which pam module is used for gnome admin password requests?
I have added the yubikey pam module to my sudo pam config, and I like the results—no one can get superuser access through sudo or su without a yubikey.
Setting aside the fact that this is possibly ...
- 133
0
votes
1
answer
2k
views
pam faillock preauth -- what does it do?
I have a file /etc/pam.d/password-auth that says this (in part). I have added line numbers that aren't in the original file.
1 auth required pam_env.so
2 auth required pam_faillock.so preauth audit ...
- 1,211
3
votes
3
answers
4k
views
Locked out of sudo by erroneous PAM config causing PAM bad jump in stack
While trying to mitigate some spammy PAM messages in /var/log/auth.log, following this post, I tried various combinations in /etc/pam.d/sudo. Unfortunately, the last line I tried, completely locked me ...
- 1,902
0
votes
1
answer
421
views
jump to root (su -) with google authentication for one specific user
in my test servers (with debian or centos) I need to be able to jump from only once user to root with google authentication.
to understand the problem, for example on the server I have two users
bob ->...
- 1
1
vote
1
answer
1k
views
Gnome keyring does not auto-unlock and nextcloud does not recognise it at all
I tried installing gnome-keyring so that I would not have to input my password for programs all the time when I start my computer.
I installed gnome-keyring.x86_64 and gnome-keyring-pam.x86_64 and ...
- 164
0
votes
2
answers
1k
views
LDAP user invalid for chown
My setup is as follows: I have a web application that creates user entries in an LDAP directory. Then, it calls a script which makes the created user the owner of a file.
I have set up an LDAP, and ...
- 225
0
votes
1
answer
1k
views
Mail Server pam_authenticate failed
In both cases smtp and smtps, When i try to send email using mail-client or login to smtp remotely i get in mail.log:
SASL LOGIN authentication failed: authentication failure
And when i use the ...
- 135
0
votes
1
answer
76
views
Will `account` modules get checked if `auth` succeeded or failed?
In the following PAM configuration for the file /etc/pam.d/system-auth
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite ...
- 1,265
4
votes
0
answers
112
views
linux remembers passwords of deleted accounts
When an account is deleted the line in /etc/security/opasswd for that account is not deleted. Intermittently, we are unable to re-create that account with error "password has been used".
Why is the ...
- 141
7
votes
1
answer
4k
views
Why do we need `required` when we have `requisite` in `PAM`?
I was wondering why do we need required in PAM when we have requisite. I know that required will allow to keep going through auth stack, but the authentication process will fail anyway finally. So why ...
- 1,265