Skip to main content

Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

pwquality_pam.so is not behaving as the man page example says

The following is an example usage of pwquality_pam.so (Link to manpage). #%PAM-1.0 # # These lines allow a md5 systems to support passwords of at least 14 # bytes with extra credit of 2 for digits and ...
Hamidreza's user avatar
0 votes
0 answers
33 views

Cannot setup pam_oath with Yubikey: OTP not authorized to login as user

So, what I want is to login to system with Yubikey as a second factor or the only factor. I use Linux Mint 21.3, my Yubikey is 5C NFC. My /etc/pam.d/common-auth: auth [success=1 default=ignore] ...
MPEI_stud's user avatar
3 votes
1 answer
376 views

TACACS+ server authorization issues: Authentication is functioning correctly, but I’m encountering challenges in enabling shell command authorization

I have established a TACACS+ server and a PAM TACACS client using the resources available here. I am using TACACS+ to authenticate Linux users using pam_tacplus.so. Upon user SSH access to the TACACS ...
Teresa's user avatar
  • 31
0 votes
0 answers
28 views

Validating Changes to pam.d (like visudo)

I'm working on an Ansible task for setting fingerprint sudo usage in MacOS. This is done through a custom rule in /etc/pam.d/sudo_local. Is there a method to pre-validate edits to PAM for safer ...
Excalibur's user avatar
  • 131
0 votes
1 answer
131 views

Adding password history and password complexity to Linux PAM library

I am upgrading to Linux PAM version 1.5.3 from version 1.1.4 and would like to get more details on adding password history and password complexity to the Linux PAM library. Previously I used cracklib ...
AllenM's user avatar
  • 11
0 votes
0 answers
71 views

Need a loop device for pam_mount

I set up pam_mount to automatically mount a disk image on login, the image contains a luks2 encrypted filesystem, very similar to the example in the Arch Wiki. My use case requires a loop device to be ...
Kitsune's user avatar
0 votes
1 answer
430 views

How to allow Linux PAM Authentication for non-Local users

I'm trying to implement a SFTP server on Ubuntu where the users should be authenticating via an external identity provider (they provide a REST API to validate user credentials). I've done a POC using ...
Jonny Marotte's user avatar
1 vote
1 answer
295 views

AD Samba file server, PAM, set quota when user connect for the first time

I am trying to set quota on some directories when the user connect for the first time to the samba box (that runs on Rocky Linux 8). So, before being able to use the samba share, the user has to ...
Venix's user avatar
  • 37
0 votes
0 answers
300 views

PAM updates for mounting an encrypted user's home at login (GNOME 40.4.0)

I would like to decrypt my LUKS encrypted /home directory at login on Rocky Linux 9.1. I have been trying to adapt this Arch Linux guide (https://wiki.archlinux.org/title/Dm-crypt/Mounting_at_login; ...
Mitch's user avatar
  • 1
1 vote
1 answer
2k views

PAM authentication problems

I am trying to set up PAM authentication along side public key authentication in SSH inside of a LXD arch container. when i connect and give the proper code, i get this information in the journal on ...
rayjay's user avatar
  • 11
1 vote
1 answer
1k views

Why am I able to login into Cockpit web UI even though I disabled PAM and password authentication?

I have these settings on my remote machine under /etc/ssh/sshd_config PermitRootLogin no PermitRootLogin prohibit-password PasswordAuthentication no ChallengeResponseAuthentication no UsePAM no The ...
orr's user avatar
  • 11
1 vote
1 answer
609 views

OpenSSH: allow nonexistent user to login

I'm trying to login using SSH on a OpenSSH Linux server with nonexistent unix logins that will be authenticated through to a external webservice using PAM module pam_exec and create a local account on ...
Joel Guzmán's user avatar
0 votes
1 answer
263 views

I think I broke gdm3 login by sudo pam-auth-update --force

I was trying to solve a problem where the software updater would give me a message saying I was not permitted to use it, though I could do it from the terminal fine, and so I tried a remedy that ...
Rob Frohne's user avatar
1 vote
0 answers
202 views

Slackware 15: Google Authenticator configuration issue / Access Denied

I am trying to install Google Authenticator on Slackware 15 and I seem to be stuck. My steps were: Installed google authenticator Added in /etc/pam.d/ssh the following line at the top of the file ...
John J's user avatar
  • 11
1 vote
1 answer
3k views

Automatically add AD users to linux group

I need to add users to a specific group on Linux automatically to allow running some programs from another user with no password prompt like: su nopswduser -c 'echo Hello' I'm adding group to local ...
Mikhail Kulikov's user avatar
0 votes
1 answer
1k views

ssh public key authentication with PAM

My Ubuntu servers are using kerberos auth for ssh with password failover using PAM. I'd like to add public key authentication as well. As I read that doesn't really work. Has anyone implemented this ...
Sparky's user avatar
  • 1
1 vote
1 answer
558 views

sssd only authenticates against first domain in domains list unless domain specified in login

I am currently moving from using pam_krb5 to pam_sss as pam_krb5 is no longer available at CentOS/RHEL 8 We currently use two AD domains each with unique user names. In the old pam configuration we ...
Michael Phillips's user avatar
0 votes
1 answer
250 views

Does pam_cifscreds module work with sudo access?

I have an RHEL (7.9) server with a remote drive mounted as a multiuser CIFS volume. With multiuser CIFS shares, users need to execute an additional command (cifscreds add) in order to access it. This ...
Kamlesh Gallani's user avatar
1 vote
0 answers
303 views

php-pam for php7.3 and php7.4 in parallel?

I have both php7.4 and php7.3 in use on my Debian 10 (buster) system as I have dependencies on both. (From https://deb.sury.org/ php apt repos.) But the pam module is not available as a version-...
Chaos_99's user avatar
  • 928
1 vote
1 answer
459 views

How to configure different authentication methods for different OpenSSH processes

I have an SFTP server on CentOS 7. On this server, I run 2 OpenSSH processes with different configuration. one is standard SSH on port 22 for administration purpose the other is only SFTP on port ...
Dunatotatos's user avatar
1 vote
1 answer
413 views

Why does `sudo` fail in a simple container on Fedora 32?

I am scratching my head trying to figure this one out. Under a freshly installed Fedora 32, the following minimal container does not execute properly: FROM centos:7 RUN yum install -y sudo && ...
choeger's user avatar
  • 111
0 votes
0 answers
430 views

How to create a .bashrc file when the user has a remote directory

I am trying to configure a custom prompt for RHEL 8 users. It works very nice when the users have local home directories. However, I'm mounting home directories via pam_mount (nfs4). When ssh'ing to ...
francisaugusto's user avatar
0 votes
1 answer
492 views

xrdp and tigervnc for Manjaro

There have been greater changes concerning tigervnc and pam/pambase in the last months. Since then, my setup does not work anymore. Does someone have a guide for setting up xrdp + tigervnc + pam for ...
user1239016's user avatar
3 votes
1 answer
4k views

SSH server asking for password, but PasswordAuthentication is disabled

what you will see is the current state of a problem I am trying to solve. I restarted sshd before filling the body this question. What I am trying to do: I need to use ssh keys with a yubikey ...
ungeblauscht's user avatar
0 votes
1 answer
285 views

remote execution of command failing due to sudo issue

i am running a command from my server which would remotely ssh to by client machine as root and sudo as olcne user and run few commands for validation. I have added the olcne user in sudoer list. i ...
user1115980's user avatar
1 vote
2 answers
22k views

sudo: PAM account management error: Permission denied

I'm trying connect a Linux machine to AD and I made some changes in some files below: /etc/krb5.conf /etc/pam.d/system-auth /etc/samba/smb.conf After these changes I connected the server to AD with ...
Jo Shepherd's user avatar
1 vote
1 answer
1k views

Issues with SSH from an external IP

So I've been trying to have an accessible SSH server from home, and I opened the SSH port so that It would be accessible from the internet. When I log in through my LAN IP address, everything goes ...
mama moss's user avatar
0 votes
0 answers
69 views

Issues SSHing into my machine

So I've been trying to have an accessible SSH server from home, and I opened the SSH port so that It would be accessible from the internet. When I log in through my LAN IP address, everything goes ...
mama moss's user avatar
0 votes
1 answer
1k views

GPG autologin with pam, pinentry

Recently I started using Neomutt with Luke´s mutt-wizward and therefore I have to setup pass and gpg, which were both new to me. I know how public and private key encryption works but after playing/...
braunbearded's user avatar
3 votes
0 answers
771 views

LDAP, PAM, and expiring accounts

I'm using LDAP on a Debian 9.8 system. After receiving a Your account has expired; please contact your system administrator for one of my users, I tried unsuccessfully several of the solutions ...
Pato's user avatar
  • 31
0 votes
1 answer
480 views

SSSD: Multiple machines using a single LDAP bind

I have configured SSSD on my company’s machines to authenticate against AD. We have approximately 15,000 machines that are going to be switched on to use SSSD. When we enabled SSSD, our network went ...
Wesley's user avatar
  • 1
-2 votes
1 answer
176 views

Where to get PAM auth DLL for win64

My python pack (Python-pam package) needs PAM auth lib DLL. libpam=CDLL(find_library("pam")) libc=CDLL(find_library("c")) Where to get those dlls.
Codesiddhar's user avatar
3 votes
1 answer
4k views

Using PAM to unlock pass (gpg-preset-passphrase)

I'm using pass as my password manager with the browserpass plugin and passmenu. Currently I have to unlock my GPG keys manually in the console before I can use the plugin on a website (otherwise it ...
Dennis Hein's user avatar
3 votes
1 answer
20k views

pam_sss(sshd:account): Access denied for user AD

sssd.conf: [sssd] domains = corp.com config_file_version = 2 services = nss, pam [domain/corp.com] ad_domain = corp.lecapam.com krb5_realm = CORP.COM realmd_tags = manages-system joined-with-samba ...
scripter's user avatar
0 votes
1 answer
228 views

How do I require MFA only when it has been set up?

I'd like to require every user to use MFA with Google Authenticator. Each time I add a new user, I want to allow them to log in using their SSH key only once, and upon login require them to create a ...
Kyle's user avatar
  • 222
2 votes
1 answer
814 views

sshd seems to ignore pam auth section when authorizing through private key

I configure ssh authorization to drop some users with rules, defined in script, and also give them some extended capabilities when they login. I use two pam modules - pam_script and pam_cap and change ...
aryndin's user avatar
  • 155
1 vote
0 answers
461 views

Pam.exec exit code 8

I'm trying to use pam.d to execute a script on user login. Right now I'm editing the /etc/pam.d/su file. Every time I log in to a user I get "Exit code 8". The command I put in there is: session ...
Kirby127's user avatar
1 vote
0 answers
17 views

Issue in JBOSS BPM Process Execution

I have setup the JBOSS PAM Server and try to run some sample project, but I keep getting the following error: Org.jboss.resteasy.spi.UnhandledException : java.lang.NoClassDefFoundException : org/...
gomathinayagam's user avatar
0 votes
1 answer
974 views

How can I audit su access through pam.d in RHEL 7

I am a system auditor with very limited knowledge of Linux OS. I am currently auditing a RHEL 7 server and found out that a group of users are authenticating through LDAP and using 'su' through PAM. I'...
Faizan Farooqi's user avatar
0 votes
0 answers
318 views

What is difference of pam.d config ubuntu and redhat?

While handling pam.d setting on Ubuntu and RedHat, I saw something like this on Ubuntu auth [success=3 default=ignore] pam_krb5.so minimum_uid=1000 auth [default=ignore] pam_unix....
ruseel's user avatar
  • 211
2 votes
1 answer
906 views

re-requiring sudo prompt for a password?

By default sudo seems to cache passwords for like 5 or so minutes. ie. You do sudo something once and you're prompted for the password and then any subsequent sudo command you do for 5 minutes doesn't ...
neubert's user avatar
  • 7,194
1 vote
0 answers
674 views

PAM SSH authentication pam_exec

I am trying to bypass SSH password authentication if some shell script return success code (0). this is my configuration. Please help to fix this if possible or suggest me if need change solution ...
aze2201's user avatar
  • 113
0 votes
0 answers
754 views

Smart card issue with OpenSC (pklogin_finder debug) only on CentOS

I'm trying to use a smart card on CentOS but I'm stuck. I'm using OpenSC, and I need to implement a special module to use my smart card (libgtop11dotnet). It doesn't work on CentOS, but I tested on ...
Lesuno's user avatar
  • 11
0 votes
1 answer
1k views

Create user with password and without ssh key on redhat

I have a very simple question, I have created an instance with aws AMI. I can log into it using my key. But I want to login using a username and password. useradd username -p password This has ...
user3407570's user avatar
2 votes
1 answer
11k views

pam_sss access denied with kerberos authentication ok

I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
Charles's user avatar
  • 43
0 votes
1 answer
42 views

Removed some /usr/include/rpcscv headers and .x files by mistake and libnsl.so

I use archlinux and removed some /usr/include/rpcscv headers and .x files by mistake and libnsl.so. I know it is stupid, but I don't know how to find them and put them back. These files are related ...
NanoPish's user avatar
  • 868
3 votes
1 answer
2k views

Which pam module is used for gnome admin password requests?

I have added the yubikey pam module to my sudo pam config, and I like the results—no one can get superuser access through sudo or su without a yubikey. Setting aside the fact that this is possibly ...
Mike D's user avatar
  • 133
0 votes
1 answer
3k views

pam faillock preauth -- what does it do?

I have a file /etc/pam.d/password-auth that says this (in part). I have added line numbers that aren't in the original file. 1 auth required pam_env.so 2 auth required pam_faillock.so preauth audit ...
hymie's user avatar
  • 1,266
3 votes
3 answers
5k views

Locked out of sudo by erroneous PAM config causing PAM bad jump in stack

While trying to mitigate some spammy PAM messages in /var/log/auth.log, following this post, I tried various combinations in /etc/pam.d/sudo. Unfortunately, the last line I tried, completely locked me ...
not2qubit's user avatar
  • 2,355
0 votes
1 answer
442 views

jump to root (su -) with google authentication for one specific user

in my test servers (with debian or centos) I need to be able to jump from only once user to root with google authentication. to understand the problem, for example on the server I have two users bob ->...
raisam's user avatar
  • 1