Pluggable authentication modules (PAM)

learn more… | top users | synonyms

52
votes
3answers
5k views

How can I use a passcode generator for authentication for remote logins?

I would like to strengthen the authentication of my SSH logins by adding another factor: a passcode generator device, or a passcode generation application on my mobile phone. The only obvious options ...
17
votes
1answer
2k views

Setup for mounting kerberized nfs home directory - gssd not finding valid kerberos ticket

Our home directories are exported via kerberized nfs, so the user needs a valid kerberos ticket to be able to mount its home. This setup works fine with our existing clients & server. Now we want ...
13
votes
2answers
20k views

How do you set requirements (such as minimum length) on passwords?

Is there any way to set up minimum passcode requirements, such as a minimum length, requirement of mixed case alphanumerics and at least 1 symbol in the passcode, and enforce that at passcode changes? ...
10
votes
1answer
1k views

Custom mount points in gvfs

Is there a way to attach gvfs mount to a custom directory? So instead of ~/.gvfs/sftp for leon on filezzzz.tim-online.nl/ something like: ~/mounts/filezzzz.tim-online.nl/? I thought about using ...
8
votes
9answers
23k views

Desktop login fails, terminal works

I have a freshly setup 12.04 LTS pc system (120 GB SSD, 1 TB HDD, 16 GiB RAM); since a few days, I can't login to the graphical desktop anymore: there is very short flashing shell window which ...
8
votes
1answer
606 views

Use one password for administration and another for system login

How can I give a user one password for normal usage when logging in, and another password for system administration and sudo access? I want one user to have two passwords.
7
votes
1answer
4k views

How to Run Pam Face Authentication

I am using Ubuntu 11.10. I went to the following URL to download the software Pam Face Authentication and downloaded the version for natty narhwall. I installed the software using the following ...
6
votes
2answers
1k views

MOTD is updated very rarely

I understand that pam_motd updates the MOTD upon login, but sometimes MOTD just doesn't get updated for days and I'm puzzled what might be the reason. I'd like to add uptime and who outputs to the ...
6
votes
0answers
94 views

How to force user to run quiz after login and before displaying desktop

I have a kid and I want to allow him to use the computer only after he solves a certain quiz at logon. I can write a quiz application itself. What I don't know is how to set it up in the way, that ...
5
votes
1answer
5k views

How do I enforce a password complexity policy?

I need to configure an Ubuntu server to follow a strict company password policy that specifies the following: at least one upper case at least one lower case at least one digit at least one special ...
5
votes
1answer
3k views

how to setup two factor authentication in Ubuntu for Ubuntu users using Google authenticator?

How to setup two factor authentication in Ubuntu for Ubuntu users using Google authenticator (It can also be setup for non Google accounts)?
5
votes
1answer
3k views

Login on local terminal without password

I have a virtual guest of Ubuntu on a KVM Machine, I've setup the machine so I can type virsh console and be dropped into a console. I realise the security considerations here, but is it possible to ...
5
votes
1answer
2k views

“CRON: Module is unknown” after upgrading to 10.04

I just upgraded our server to Ubuntu 10.04 and cron just stopped working. I tried to restart the server, restart cron but nothing worked for me. It just reports in /var/log/syslog: May 12 16:32:01 ...
5
votes
1answer
2k views

Permanently raising nofile limits in Ubuntu 14.04 LTS

I cannot seem to figure out what exactly is needed to allow the maximum number of file descriptors to be raised permanently for all users. /etc/security/limits.conf: root hard nofile ...
4
votes
1answer
2k views

Enable ecryptfs for all new users, even those authenticating through kerberos and ldap

How do I make sure that all users have their home directory encrypted when the login for the first time? I have setup pam to use Kerberos authentication and LDAP authorization (which I think should ...
4
votes
3answers
14k views

Where are passwords stored?

How do you figure out where are user's passwords stored, for users that can login? I know the system is using LDAP for users (username, home path, etc.), but it doesn't contain any kind of passwords. ...
4
votes
1answer
3k views

I cannot login into any TTYs

My system is Ubuntu 11.10 (installed from 0, without upgrades/updates). When I enter into any tty (1, 2, 3..) it ask me my login name and password but I can not move forward. When I enter an user ...
4
votes
1answer
699 views

SSSD + Encrypted /home, no longer automounts at login

I've switched a few boxes over to SSSD, so they now authenticate against a central LDAP server, and cache the credentials when I'm offline. This works fine, and the Ubuntu packages installed fine. ...
4
votes
1answer
696 views

How do I enable a specific pam config in the lockscreen?

In Trusty, there is a new lockscreen that fits the look and feel of lightdm, and shares some config files, especially for pam. I am using libpam-fprintd to allow using my fingerprint reader when ...
4
votes
1answer
226 views

How to use PAM to restrict HTTP access for some users?

I've read that PAM can be used to restrict HTTP access for some users, but I can't figure out how to do it in Ubuntu 12.04. The /etc/security/time.conf man page contains this example: All users ...
4
votes
2answers
2k views

Can't log in to Samba PDC with domain account

I have a problem. I like to login on a Samba Server with my Ubuntu 10.04/11.04 PC. On my Samba Server there are some accounts with data, but I couldn't connect to it. I have done this: aptitude -y ...
4
votes
1answer
202 views

How to properly invoke motd for SSH connections with PAM disabled

I have configured a nice motd message that shows me lots of relevant infos when I login to my VPS via SSH. As password authentication is disabled in sshd_config I would also prefer to disable PAM as ...
4
votes
0answers
695 views

How can I set up radius authentication properly?

On all of our linux workstations, we have configured the PAM modules to use radius authentication. This works well for all of the various things like login on the console, login using ssh, sudo, etc. ...
4
votes
0answers
2k views

Synchronize SSHFS mount with local filesystem

I've got a directory called "secure" that I mount on my laptop via sshfs whenever the server is in reach. While this server is in reach I want to keep it in two-way sync with a directory called ...
3
votes
3answers
9k views

Type password into login screen, hit enter - nothing happens

I first install Ubuntu 13.10 a few weeks ago and its been going great. I'm still pretty new to Linux, so I haven't been doing a whole lot. The past couple days I've tried installing LAMP, then ...
3
votes
1answer
218 views

How to validate passwords with pam

I have got a bash script which asks for your password, and then needs to validate the password using pam, I have installed libpam0g-dev as I understand I need it for this, but how exactly do I go ...
3
votes
1answer
572 views

How to use pam_blue with lightdm, and unity-greeter?

I want lightdm to skip asking for my password if my phone is nearby. How is that possible with lightdm, and unity-greeter? Also I'm interested in knowing whether its secure, because it doesn't seem ...
3
votes
2answers
7k views

How to configure pam.d files for ldap over ssh on 12.04?

I'm trying to set up an Ubuntu 12.04 server so that users with a valid account in a remote ldap server can login to the ubuntu server. I've followed this guide closely: ...
3
votes
0answers
91 views

I locked myself out from using su or sudo. I'd like to understand what I did there

In an attempt to increase the numer of files my domino server is allowed to handle, I changed /etc/security/limits.conf, adding following lines. notes soft nofile 60000 notes hard nofile 60000 ...
3
votes
0answers
69 views

Biometric Enrollment

I am interested in developing a Match-on-card Logon functionality (biometric enrollment) for users on Ubuntu. I've searched through PAM modules, in Ubuntu Software Center, and with Google, and found ...
3
votes
0answers
141 views

In /etc/pam.d/sshd, what does “# [1]” mean?

In the PAM configuration file /etc/pam.d/sshd, there are a few lines ending in # [1]; for example: session optional pam_motd.so # [1] This doesn't seem to appear in any of the other PAM ...
3
votes
1answer
2k views

What causes “pam_unix … conversation failed” in auth.log

There are thousands of entries in my auth.log like this: sudo: pam_unix(sudo:auth): conversation failed What causes these to occur? I'd like to fix whatever it is but I'm a bit mystified as to ...
2
votes
2answers
937 views

sudo fails because of `pam_mount.c` assertion

I just upgraded to Kubuntu 12.04 from 11.10. Now when I use sudo I almost always get: sudo: pam_mount.c:417: modify_pm_count: Assertion `user != ((void *)0)' failed. It makes the command fail. ...
2
votes
1answer
33 views

how to check what incorrect password as attempted

In /var/logs/auth.log I can see the unsuccessful login attempts. They are like lines below: Oct 16 05:04:02 myMachine unix_chkpwd[15793]: password check failed for user (user1). Now is there a way ...
2
votes
1answer
2k views

Why is sssd an unrecognized service, even though it is installed and can be restarted?

Why is sssd an unrecognized service, even though it is installed and can be restarted? BTW: This concerns Ubuntu 14.04.1 LTS, it was not like that in 12.04 I will show what I mean below, I think it is ...
2
votes
2answers
3k views

Pam_mount won't automount encrypted partiton

As usual, when I install a new version of Ubuntu I install pam_mount to automount my with LUKS encrypted partition on login. However, for Ubuntu 11.10, I followed the same procedure as usual, but I ...
2
votes
2answers
6k views

14.04 Not authenticating on chsh command

I am trying to change my default shell to zsh. I have the entry placed correctly in /etc/shells file. Each attempt I have made with this command has ended with the same error message: chsh -s ...
2
votes
1answer
256 views

sed permission denied when using pam_exec with su

I'm using pam_mount.so to automatically mount a CIFS share for users on an Ubuntu 14.04 client. pam_mount uses a local conf in every users home directory. I'm running a bash script with pam_exec that ...
2
votes
2answers
174 views

pam_tally2 doesn't count fails over ssh

I have added line auth required pam_tally2.so deny=3 unlock_time=180 to my /etc/pam.d/login file, and that's fine and dandy in tty, after 3 attempts testuser gets suspended. However, that very ...
2
votes
1answer
710 views

Show a notification at login using pam_exec

This simple script will show a Zenity notification when the user logs in: case "$PAM_TYPE" in 'open_session' ) if [ "$PAM_SERVICE" = "lightdm" ] ; then DISPLAY=:0 sudo -u ...
2
votes
1answer
1k views

After Upgrade to 12.04 the Login takes forever

I recently upgraded from Xubuntu 11.10 to 12.04. Since then it takes a very long time for me to Login. The time it takes to get to the login screen is normal but after I type in my password it takes ...
2
votes
1answer
209 views

“AND Operator” in PAM

I need to prevent users from authenticating through Kerberos when the encrypted /home/users has not yet been mounted. (This is to avoid corrupting the ecryptfs mountpoint) Currently I have these ...
2
votes
0answers
182 views

SSH with PAM Google

I have a server with Google Authenticator enabled. It worked fine, and one day I tried to login, and suddenly I'm not able to. Fortunately, I do have Ajenti installed with a terminal, so it's not a ...
2
votes
0answers
101 views

How does LightDM treat PAM?

I use XFCE as my desktop, and I wanna know how LightDM works with PAM. when I use normal kernel arguments, LightDM starts and then XFCE is started by LightDM. When I add "text" to kernel parameter, ...
2
votes
0answers
383 views

How do we implement requirements of password policy?

This question might look similar but I could not find a solution to this which covers all the below requirements of the policy, Hence please help me: - Incorrect pass lockout (after 3 incorrect ...
2
votes
0answers
1k views

Can't authenticate against LDAP. /etc/nsswitch.conf seems to be ignored

Running ubuntu 14.0.4.1 on a BananaPi (ARM). I've had a lot of luck getting LDAP authentication to work under 14.0.4 on x86, but something about this just isn't working. If you run getent passwd | ...
2
votes
0answers
217 views

How to enforce LDAP group membership with libpam_ldap for SSHD

I am running 14.04 servers that I have install the ldap authentication package ldap-auth-client on and configured to connect to our LDAP servers. I have the authentication part working as well as the ...
2
votes
0answers
198 views

lubuntu completely ignoring ldap setup. Followed guide, no contact with ldap server

We have LDAP authentication working on every other server and lxc container in our enterprise, but when we try and have a brand spankin new Lubuntu 14.04 installation do the same, it's completely ...
2
votes
1answer
79 views

how to manage ubuntu users from php

I have an Ubuntu 12.04 server machine in a local net, and I would like to log in my user through php. I have tried with pam_auth() but it wasn't configured neither activated for php. I tried a ...
2
votes
0answers
117 views

Accidentally removed /etc/pam.d/common-* files

I accidentally removed /etc/pam.d/common-* files on Ubuntu 12.04 through ssh. I have a backup of the files however, I am unable to use sudo nor log back in. Is there a way to fix this?