Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

752 questions
0
votes
1 answer

LDAP SSH + PubKey auth Fallback

I have followed this guide here : https://github.com/jirutka/ssh-ldap-pubkey In order to setup a LDAP server that allows authentication requesting both Password and Public Key in order to login. Now while all this seems like a very good idea, ssh…
Stacknerd
  • 43
  • 5
0
votes
1 answer

Ssh + ldap not asking for private/public key

I have fully configured a LDAP server which works perfectly for authenticating users across my multiple nodes. I wanted to add an extra layer of security with the usual two factor public private key. I followed this guide :…
Stacknerd
  • 43
  • 5
0
votes
1 answer

changing where pam_mkhomedir makes a directory

I want to create user directories for an LDAP user (389-ds) If they don't exist so I am using pam_mkhomedir . How do I create these directories on a different mount point say /nfs/home instead . I know there is a previous Question on this But I…
user3314672
  • 3
  • 2
0
votes
1 answer

SunLDAP Schema Extensions to support Linux/Unix Authentication + Sudo

We are running SunLDAP (Sun/Oracle Directory server 11), and would like our Linux/Unix machines to authenticate against LDAP and also use LDAP for storing SUDO policies. What Schema Extensions are required for this?
Saqib Ali
  • 428
  • 2
  • 7
  • 21
0
votes
1 answer

Server allows logging in without supplying a password and no ssh keys were exchanged, what could be the reason?

I'm trying to secure an outbound server with Google 2FA solution. For the time being, I'm first configuring everything on a local Vagrant machine and once everything works as intended I'll run it as an Ansible playbook on the remote outbound…
Itai Ganot
  • 10,644
  • 29
  • 93
  • 146
0
votes
1 answer

Dovecot auth-worker permission denied to PAM and even /dev/log

Problem I have a problem dovecot authenticating users via pam_sss.so (in an LXC container, which may be related or may be not). # doveadm auth login semenov Password: passdb: semenov auth failed extra fields: user=semenov # tail…
Ilya Semenov
  • 191
  • 1
  • 8
0
votes
1 answer

how to control ldap users access using groupdn?

I am using openldap, nslcd and nss-pam-ldapd. I want to restrict users login to ldap client. I have configured this in CentOS 6.5 without any problem using groupdn. but in CentOS 7, there is no pam_ldap.conf file. I tried to do it by adding the…
rahele
  • 1
  • 2
0
votes
1 answer

Using SSHA via pam_ldap on CentOS authenticating against ApacheDS

I'm struggling to get CentOS to authenticate users via ApacheDS when the userPassword is encrypted with SSHA or SHA. Crypt works fine but due to restrictions of other services I really need this authd by SSHA. Has anyone else had this problem? I'm…
edstafford
0
votes
2 answers

openvpn pam authentication failure

I am trying to setup PAM authentication on my openVPN instance running on Ubuntu Server 15.04 but i keep getting an authentication failed error, am i missing anything? server.conf port 1194 proto udp dev tun sndbuf 0 rcvbuf 0 ca ca.crt cert…
Paul Goggin
  • 1
  • 1
  • 3
0
votes
1 answer

Nonsystem authentication for unprivileged sftpd

I am creating a test system that needs to be able to briefly act as a sftp server on a nonprivalaged port. The test system runs as a normal user. So I'm thinking as running sshd with the sftp subsystem configured to use the port and the host key I…
Q the Platypus
  • 121
  • 4
0
votes
0 answers

do not allow multiple sessions if user have different IPs

I am running Red Hat Enterprise Linux 6.6 and for authentication we use LDAP authentication. We have running application on a server (doesn't really matter which one it is) and the way application work is it basically uses OS just to authenticate…
zuboje
  • 123
  • 1
  • 6
0
votes
1 answer

configure a PAM module to be required for all but certain users for which it should be sufficient

I'd like to be able to configure /etc/pam.d/sshd so that: for all users except those in group "admin", module pam_radius is required. for those users in group admin, module pam_radius is sufficient. How to do this?
Michael Martinez
  • 2,645
  • 3
  • 24
  • 35
0
votes
1 answer

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that comes. Here is the attached log screenshoot :- In…
zealvora
  • 81
  • 2
  • 9
0
votes
1 answer

ldap-overlay with fixed default attributes

i'm having a largish user-base (>>1000) which should be able to collectively use some sharing service. the user base is slowly but constantly changing. esp. we are not interested in privilege separation (all users are equal), so from a privilege pov…
umläute
  • 499
  • 1
  • 7
  • 26
0
votes
1 answer

pam_groupdn doesn't work at all. always all users allowed to log in

i have tried to install pam, ldap on fedora23. i have configured pam.d/system-auth as follows: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so …
rahele
  • 1
  • 2
1 2 3
…
50 51