Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

0
votes
0answers
13 views

{Key or TOTP} and password

I'm setting up multi-factor authentication on a Linux box. I have successfully been able to tell the box to accept key-and-password or TOTP-and-password, but I'd like it to allow clients to do either. ...
0
votes
0answers
26 views

denied rodc password replication group, screen splashes when login

I am trying to login in my domain using the users screen in ubuntu. After entring username it asks for password then it splashes and again go back to users option in thee lock screen menu. smb.conf ...
0
votes
1answer
38 views

How can I audit su access through pam.d in RHEL 7

I am a system auditor with very limited knowledge of Linux OS. I am currently auditing a RHEL 7 server and found out that a group of users are authenticating through LDAP and using 'su' through PAM. I'...
0
votes
0answers
18 views

What is difference of pam.d config ubuntu and redhat?

While handling pam.d setting on Ubuntu and RedHat, I saw something like this on Ubuntu auth [success=3 default=ignore] pam_krb5.so minimum_uid=1000 auth [default=ignore] pam_unix....
1
vote
1answer
24 views

re-requiring sudo prompt for a password?

By default sudo seems to cache passwords for like 5 or so minutes. ie. You do sudo something once and you're prompted for the password and then any subsequent sudo command you do for 5 minutes doesn't ...
1
vote
0answers
82 views

PAM SSH authentication pam_exec

I am trying to bypass SSH password authentication if some shell script return success code (0). this is my configuration. Please help to fix this if possible or suggest me if need change solution ...
0
votes
0answers
19 views

SuSE pam.d Configuration to Monitoring With SCOM

I want to monitor a SuSE server by SCOM. The server has a SCOM user and SCOM server knows the username and password. But the SCOM tries to login with that user and Failures count on pam_tally2 always ...
0
votes
0answers
55 views

Smart card issue with OpenSC (pklogin_finder debug) only on CentOS

I'm trying to use a smart card on CentOS but I'm stuck. I'm using OpenSC, and I need to implement a special module to use my smart card (libgtop11dotnet). It doesn't work on CentOS, but I tested on ...
0
votes
1answer
37 views

Create user with password and without ssh key on redhat

I have a very simple question, I have created an instance with aws AMI. I can log into it using my key. But I want to login using a username and password. useradd username -p password This has ...
0
votes
1answer
313 views

pam_sss access denied with kerberos authentication ok

I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
0
votes
1answer
19 views

Removed some /usr/include/rpcscv headers and .x files by mistake and libnsl.so

I use archlinux and removed some /usr/include/rpcscv headers and .x files by mistake and libnsl.so. I know it is stupid, but I don't know how to find them and put them back. These files are related ...
0
votes
1answer
135 views

Which pam module is used for gnome admin password requests?

I have added the yubikey pam module to my sudo pam config, and I like the results—no one can get superuser access through sudo or su without a yubikey. Setting aside the fact that this is possibly ...
0
votes
1answer
195 views

pam faillock preauth — what does it do?

I have a file /etc/pam.d/password-auth that says this (in part). I have added line numbers that aren't in the original file. 1 auth required pam_env.so 2 auth required pam_faillock.so preauth audit ...
2
votes
2answers
170 views

Locked out of sudo by erroneous PAM config causing PAM bad jump in stack

While trying to mitigate some spammy PAM messages in /var/log/auth.log, following this post, I tried various combinations in /etc/pam.d/sudo. Unfortunately, the last line I tried, completely locked me ...
0
votes
1answer
143 views

jump to root (su -) with google authentication for one specific user

in my test servers (with debian or centos) I need to be able to jump from only once user to root with google authentication. to understand the problem, for example on the server I have two users bob ->...
1
vote
1answer
473 views

Gnome keyring does not auto-unlock and nextcloud does not recognise it at all

I tried installing gnome-keyring so that I would not have to input my password for programs all the time when I start my computer. I installed gnome-keyring.x86_64 and gnome-keyring-pam.x86_64 and ...
0
votes
1answer
290 views

LDAP user invalid for chown

My setup is as follows: I have a web application that creates user entries in an LDAP directory. Then, it calls a script which makes the created user the owner of a file. I have set up an LDAP, and ...
0
votes
1answer
305 views

Mail Server pam_authenticate failed

In both cases smtp and smtps, When i try to send email using mail-client or login to smtp remotely i get in mail.log: SASL LOGIN authentication failed: authentication failure And when i use the ...
0
votes
1answer
33 views

Will `account` modules get checked if `auth` succeeded or failed?

In the following PAM configuration for the file /etc/pam.d/system-auth auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite ...
4
votes
0answers
91 views

linux remembers passwords of deleted accounts

When an account is deleted the line in /etc/security/opasswd for that account is not deleted. Intermittently, we are unable to re-create that account with error "password has been used". Why is the ...
2
votes
1answer
417 views

Why do we need `required` when we have `requisite` in `PAM`?

I was wondering why do we need required in PAM when we have requisite. I know that required will allow to keep going through auth stack, but the authentication process will fail anyway finally. So why ...
1
vote
0answers
121 views

CentOS7 based SSH rkt container: PAM session setup fails

I am unable to login into a SSH host running in a CentOS7 based rkt container because the PAM session setup never completes - even with logging set to DEBUG3 there's no error message - logs just end ...
0
votes
1answer
245 views

pam_time.so configuration is ignored, how to debug it?

I'm trying to use the pam_time.so module to restrict the times at which some users may use sudo. However, my configuration changes seem to have no effect. How can I debug this issue? Is it possible ...
0
votes
1answer
382 views

su in Debian chroot gives critical error (embedded system)

I'm trying to install Debian jessie inside a chroot on a embedded system (QNAP NAS with kernel 2.6.33.2). I successfully run debootstrap to install the base system and the chroot works correctly ...
0
votes
1answer
424 views

Sftp server logs “Failed password for <xxxx> from xxxx”

I use Java sftp client JSCH to connect sftp server, and the client throws "Auth failed" exception occasionally, and the sshd log shows "Failed password for from xxxx" occasionally too. I have ...
0
votes
1answer
132 views

What “-” (minus signal) means as a value for “type” in /etc/security/limits.conf file

I've seen on the documentantion the following about the type field of /etc/security/limits.conf: - for enforcing both soft and hard resource limits together. Note, if you specify a type of '-' ...
3
votes
0answers
177 views

Linux capability - non-root user child process to access files created by other users

I am running a process with root privileges which fork child process. Child process changes its uid and gid to user and group without root privileges. Would like to assign capability to this child ...
0
votes
1answer
247 views

TELNET -l username option is not working

Telnet man page says username present in -l option is passed to telnet server via ENVIRON variable. If telnet server accepts this ENVIRON, it won't prompt for username. https://linux.die.net/man/1/...
0
votes
0answers
132 views

root cannot access cron

I'm getting the following error when I try run crontab on my CentOS 7 server. # crontab -l You (root) are not allowed to access to (crontab.relink.1461708277) because of pam configuration. I have ...
0
votes
1answer
288 views

Google Authenticator in Yast

I've successfully added 2FA with Google Authenticator package on openSUSE Leap 42.1 for Display Manager, login, sudo and su. I have to enter a verification code from Android app every time I use these ...
1
vote
1answer
187 views

Use hard-coded password with PAM

I have an application that prompts for the password of the logged in user using PAM as an authentication source. The current PAM configuration for that application reads: @include common-auth @...
2
votes
0answers
778 views

SSH Failing with User not known for local user

I added a local user to my server (CentOS 6.5) but when I attempt to login as that user I'm getting denied by SSSD with the following error: I can connect with my LDAP credentials fine but can't ...
3
votes
1answer
2k views

How to get rid of “Authenticated with partial success” message when using two factor authentication

On my linux machine I am writing a PAM module for two factor authentication (https://github.com/kb100/signal-authenticator). It works on an opt in basis so if a user doesn't have a ....
1
vote
1answer
1k views

What PAM service name does useradd use?

The title says everything, but to show that I did my research, I will say that I spent almost half of the day yesterday trying to find the answer for that question. I have run into one page where it ...
1
vote
0answers
117 views

Force OpenSSH server to accept nonexistent usernames?

Can sshd be configured to accept a nonexistent username and log in as a predefined user, such as guest? For example, if I enter ssh nxuser123@localhost, sshd should save "nxuser123" in an environment ...
2
votes
1answer
970 views

Disable expired password change dialog in PAM

I try to find a way to switch off the password change dialog you get when you login with a expired password. """ WARNING: Your password has expired. You must change your password now and login again! ...
1
vote
2answers
9k views

PAM SSSD Allow Local Users

I've got a default SSSD configuration with PAM. I can login fine as any LDAP user. However, when I create a local user on a server: adduser test1 passwd test1 and then try to login as that user I ...
0
votes
1answer
305 views

Debian wheezy pam and samba

I installed a Debian server into a Windows controlled domain. I then tried to give to LDAP users from this domain access to my Debian via Samba, Winbind and Kerberos, which works almost perfectly. In ...
3
votes
2answers
3k views

Public key authentication for LDAP users using local authorized_keys

We are using LDAP for account information. The environment is configured as follows ... A CentOS 7 OpenLDAP directory server A CentOS 7 client configured to use the directory server authconfig has ...
0
votes
0answers
749 views

Autologin and mount encrypted volume in KDE 5

On my machine, I have Fedora 23 (Server) and KDE 5.19. SELinux is deactivated. Furthermore, I have an encrypted home volume (using LUKS). As soon as the user logs in on the SDDM greeter, the encrypted ...
1
vote
0answers
1k views

Mount encrypted partition after login (LUKS/pam_mount)

During the installations of Fedora 23 I have chosen the option to encrypt the /home partition. As expected, I am asked now to enter the passphrase before the login appears. Now, I have to achieve that ...
0
votes
1answer
1k views

passwd fails with passwd: pam_start() failed, error 26 in tahr puppy 6.0.2

From the messages log: Dec 17 08:08:28 puppypc30098 authpriv.err passwd[8265]: PAM _pam_load_conf_file: unable to open /etc/pam.d/common-password The file /etc/pam.d/common-passwd is indeed missing: ...
0
votes
1answer
141 views

Ubuntu Trusty not showing “System restart required” on first login after unattended-upgrades

I'm running ubuntu 14.04.3 with unattended-upgrades configured to install security updates only. This works as expected, with email notifications as follows when a reboot is required: Unattended ...
1
vote
2answers
5k views

Minimum password length is not working in Linux (RHEL7)

I have set minimum password length to 3 on my RHEL 7 system. Still while using passwd I get error: BAD PASSWORD: The password is shorter than 5 characters. I have changed following parameters: In ...
0
votes
1answer
228 views

Authentication working with partial password

I have a 13 character long password and my system is allowing me to authenticate with only 8, why? I have no clue at all, so please give me some guide on what to add to my question, for instance ...
4
votes
3answers
9k views

Crontab command cannot be executed. Error PAM configurations

Here's the command that I would like to execute but it seems not to work. [mdubois@veloce ~]$ crontab -l Autorisation refusée You (mdubois) are not allowed to access to (crontab) because of pam ...
2
votes
0answers
272 views

ConsoleKit reports active/is-local only on the second+ login

Running KDE Frameworks 5, Plasma 5, using sddm as a display manager. ConsoleKit and PAM-linux are both installed. Upon login (using the sddm login screen), ck-list-sessions returns FALSE for both is-...
2
votes
2answers
2k views

pam_exec.so doesn't write password to script when expose_authtok is enabled

We are using PAM for authenticating with external radius server. We have the following line in /etc/pam.d/common-auth auth [success=6 default=ignore] pam_exec.so expose_authtok /home/cliuser/...
2
votes
0answers
5k views

Samba, winbind and AD authentication: username is invalid on this system

I am trying to set up a file server with Active Directory authentication using Samba and Winbind. Domain controller is Windows 2000 SP4 (don't judge). File server is Debian 7.7 (latest stable). This ...
3
votes
0answers
842 views

Samba sync password with Unix

I'm trying to set up Samba to sync passwords with Unix (i.e. when someone changes their password via passwd their Samba password is also changed). I've tried following the "Password Synchronization ...