Questions tagged [pam]
Pluggable authentication modules (PAM)
238
questions
1
vote
1answer
25 views
Sudo Broken - critical error PAM
I just got a Yubikey and tried to set it up to use it to login to my computer.
I followed the instructions by hackerb9 in this post.
Passwordless login with Yubikey 5 NFC
It worked perfectly, but I ...
0
votes
0answers
131 views
Restricting login with pam_access.so
I've recently moved from RHEL to Ubuntu and am having an issue getting access.conf to work. On RHEL I would add "account required pam_access.so" to the system_auth and password_auth pam.d ...
0
votes
0answers
15 views
Kerberos password prompt banner
Has anyone been able to customise the pam_krb5 password prompt text (banner)?
The man page suggests one should be able to do this either in the PAM module as an option:
banner=foo
(no whitespace), or ...
1
vote
0answers
17 views
Ask for google authenticator before password
I recently configured my server to use the google authenticator pam alongside user passwords.
In order to protect users that reuse passwords is it possible to ask for the users TOTP before asking the ...
1
vote
0answers
30 views
Understanding /var/log/auth.log - Confusion about “pam_unix” and “polkit”
I am having an hard time understanding some lines inside my auth.log file from Ubuntu. Can you help me breaking down the pieces of this one?
pkexec: pam_unix(polkit-1:session): session opened for ...
9
votes
2answers
297 views
Change the delay that occurs after entering an incorrect password in the gdm3 login-screen?
I am very impatient, when I unfortunately mistype my login-password on my laptop (Ubuntu 20.04), I don't want to wait three seconds to retry. (A delay of 0.3 seconds would be enough to prevent ...
0
votes
0answers
19 views
Strange behavior with pam_mount
i have a strange behavior with pam_mount on an Ubuntu 20.04 (firsch installed). The client authenticates to an ADS (UCS server 4.4) with Kerberos. The client has joined the domain and I can login with ...
0
votes
1answer
22 views
Can pam_tally2 log into auditd?
By default, pam logs into auditd failed login attempts. My issue is that when someone tries to log in with a non-existent user, the audit message contains acct="UNKNOWN".
I would like, instead, the ...
2
votes
0answers
33 views
How to make a script execute on failed physical login?
So I have setup the PAM for my laptop in such way that if there is a failed login attempt, a bash script is executed by which webcam takes a shot and on three consecutive failed login attempts a siren ...
0
votes
1answer
69 views
Password cannot be accepted or input in non-graphical mode
I use Ctrl + Alt + F1 to switch to non-graphical mode. I only input my username called bryan and click Enter. The screen automatically shows that:
Ubuntu 16.04.6 LTS bryan-5810 tty1
bryan-5810 login:...
0
votes
0answers
13 views
when and at what time pam locks the user?
Is there a way to figure out when and at what time a pam locks the user because of so many authentication failures ?
Thanks
Lokesh
0
votes
1answer
22 views
Not able to Login after editing login.defs, common-auth and common-password
After editing login.defs, common-auth, and common-password I am unable to login.
The goal was to set password restrictions ...
I then used recovery mode and I restored the login.defs and common-auth ...
0
votes
0answers
59 views
Use Network Namespace for SSH Tunnel
I have an Ubuntu 18.04 server in which I've created two virtual interface pairs (veth0a & veth0b) and assigned the end of one interface (veth0b) to a new network namespace (netns0):
ip netns add ...
0
votes
0answers
121 views
Domain > Local User Mapping with Samba and Winbind
I have an Ubuntu 18.04 Server joined to an AD domain. This is working well for authentication only (SSO) using winbind and logging into the server with domain admin accounts works well, with autorid ...
0
votes
0answers
17 views
Suddenly getting thousands of cron_session PAM log alert emails. What is sending them and how to stop? [duplicate]
I think I had set up login alerts but now a cron change or some update has lead to thousands of emails flooding my account. I would still like the login alert emails but don't really want cron ...
2
votes
1answer
171 views
How to disable pam_mount if no password is provided (i. e. authentication with an ssh-key)?
I'm using pam_mount to automatically mount SMB/CIFS shares on login of a user and this works so far, but when someone authenticates without a password (via ssh-key) the mount fails because there is no ...
2
votes
1answer
161 views
Ubuntu 16.04LTS - pwquality.conf & pam_pwquality registering incorrect passwords, but approves them anyway
I'm working on implementing password quality requirements in Ubuntu Server 16.04LTS. I have configured 'pwquality.conf' with the requirements and '/etc/pam.d/common-password' to add pam_pwquality.so ...
0
votes
0answers
21 views
Does calling a program with the setuid bit evoke PAM authentication?
If you run a program with setuid bit, will it evoke PAM?
0
votes
0answers
181 views
Modifying /etc/pam.d/sudo to disable access to certain users
Tried modifying sudo file this way:
#%PAM-1.0
auth required pam_wheel.so deny group=nosu
session required pam_env.so readenv=1 user_readenv=0
session required pam_env.so readenv=1
...
0
votes
0answers
107 views
Slow login with home drive on LUKS mounted through pam_mount
I have a separate LUKS encrypted disk on my laptop where my home directory is stored and mounted at login with pam_mount. I've been using this for years and it worked reliably on EXT4. Some time back ...
4
votes
1answer
257 views
18.04 KDE screenlocker showing full username for Local Users, but not for remote (LDAP authenticated) users
I've got an issue where my KDE screenlocker will not show the full username for the logged in user (for this session) if that user is LDAP authenticated.
This means that when the screen is locked, you ...
0
votes
1answer
88 views
Auth Log shows successful login from disabled user accounts
We are using Ubuntu 16.04 and have commented out few users in passwd configuration but the authentication log shows successful login attempts from those users.
The point is we have specifically ...
0
votes
0answers
68 views
passwd not using SHA512
I noticed odd behavior this evening on my Ubuntu 18.04.3 LTS system. When trying to "sudo" a command, I found that I only needed the first 8 characters of my password. Digging deeper, I found that my ...
1
vote
0answers
99 views
How can I configure Ubuntu to require answers to random math problems in place of a password?
For the home Linux laptop (running Ubuntu 18.04), for the kids, I would like to be able to configure the computer to require answer(s) to randomly selected math problems to log in, rather than ...
1
vote
0answers
52 views
Should login be allowed if we can't cd to the home directory? (login.defs configuration)
While reading through the /etc/login.defs configuration file, I found the following entry:
# Should login be allowed if we can't cd to the home directory?
# Default is no.
DEFAULT_HOME yes
This ...
1
vote
1answer
115 views
google auth with lightdm
I am trying to configure google-authentication on a Xubuntu host via lightdm. I only want to use the OTP code to login (i.e. the user does not supply a password, only their google auth code).
I ...
-1
votes
1answer
145 views
How can I request a package for “authselect” on Ubuntu?
I find authselect (link to project on GitHub) a very convenient piece of software. How can I request that it be packaged for Ubuntu?
0
votes
0answers
411 views
Validity VFS301 Fingerprint scanner scans only once
I've searched countless forums about fingerprint scanner support with ubuntu, I've gotten the system settings to show the fingerprint login prompt. It lets you scan once, but after that it refuses to ...
2
votes
1answer
830 views
KdeWallet auto unlock at login
Just installed ubuntu 19.04 minimal with apt install plasma-desktop sddm dolphin konsole kdeconnect --no-install-recommends and apt install kwin kleopatra kwalletmanager libpam-kwallet5. All good. ...
0
votes
0answers
31 views
Pam.d reporting incorrect $RHOST in script
I've implemented a login-notify script in /etc/ssh
The script will notify me via Microsoft Teams when there is a login to my VM, with the user, host and service
However - it appears the rhost is ...
1
vote
0answers
221 views
pam_access.so is not working when listsep is specified
I ran into a strange issue with configuring PAM trying to restrict ssh logins by pam_access.so with package libpam-modules_1.1.8-3.6ubuntu2.18.04.1.
contents of /etc/security/access.conf
+ : root : ...
0
votes
1answer
2k views
“Failed to start OpenBSD Secure Shell server” error after adding users to PAM section
When I add users in the PAM section of sshd_config:
UsePAM yes
Match User employee_1
PasswordAuthentication yes
I cannot restart the SSH service and get the message below (Why? pls help):
root@ip-...
0
votes
1answer
905 views
AD (PAM) authentication stopped working after security update
I have an Ubuntu 16.04 GIT server with AD authentication configured. Authentication stopped working yesterday while nothing on GIT server or AD has changed. Here's the error message:
pam_winbind(...
1
vote
1answer
763 views
su: Cannot make/remove an entry for the specified session
When im trying to do "sudo su -" in my ubuntu 16.04.6 server getting following error. I done few changes in pam.d config files.
Error - su: Cannot make/remove an entry for the specified session
If ...
0
votes
1answer
47 views
Ubuntu 16: Menu Bar and Dash do not appear for users
We have a cluster of Ubuntu 16 LTS machines that authenticate off of LDAP and have their home directories in a separate filer. Users can log into the terminal (Ctrl-Alt-F1) and can also log into the ...
0
votes
1answer
28 views
Different groups for same user
I am using Ubuntu 16.04 with a remote active directory server. To login on my Ubuntu machine, I use the username and password from active directory.
I recently had to run pam-auth-update because it ...
1
vote
1answer
722 views
Finding pam module
I've started to read the documentation on pam and it says that the available modules should be stored in /lib/security or /lib/security64 for the examples they give to be applicable. My problem is ...
0
votes
1answer
141 views
Extremely slow graphical desktop startup process Ubuntu 18.10
I have experienced a stubborn issue after upgrading my Ubuntu from 18.04 to 18.10. Every time I would like to login into my system via lightdm the login process takes a lot of time (more than 2 ...
1
vote
1answer
653 views
Fingerprint reader compatibility
Preamble
I need to buy 8 external fingerprint readers but I'm not sure they will work on the latest version of Ubuntu and I do not want to spend money blindly.
The readers I would like to purchase ...
0
votes
0answers
203 views
Local modifications to /etc/pam.d/common-*, not updating
Just like any normal day, I ran "sudo apt upgrade", but it gave me this:
Local modifications to /etc/pam.d/common-*, not updating.
pam-auth-update: Run pam-auth-update --force to override.
What ...
1
vote
1answer
5k views
Why system keep ask to enter password for the first member of sudo group instead of deny command execution
We have OS ubuntu 18.04. There are 2 users presented :
user1, user2. user1 is administrative account and is member of sudo group:
uid=1010(user1) gid=1010(user1) groups=1010(user1),27(sudo),110(lxd). ...
0
votes
1answer
54 views
google_authenticator ownership automatically changes to root on Ubuntu 18.04 [closed]
Running Ubuntu 18.04 Server, it seems pam will change the ownership of ~/.google_authenticator on login to root:USER
This means next time I try to login, I will be rejected. Changing the ownership of ...
1
vote
0answers
490 views
SSH doesn't detect authenticationmethod
So basically I'm trying to create an SFTP account for a part of my server that doesn't need an SSH-Key nor googles-2fa-pam module. I've got the following setting in my /etc/ssh/sshd_config file:
...
1
vote
0answers
401 views
Login fails silently on system restart, after adding new module to /etc/pam.d/common-auth
I am attempting to add an auth-only PAM module (poldi, to support login via GPG SmartCards).
The way I have it configured works perfectly well for most authentication use-cases:
sudo
unlocking a ...
0
votes
1answer
6k views
Having “PAM adding faulty module: pam_winbind.so”, “… pam_kwallet5.so”, “… pam_kwallet.so” on start of smbd, ssh, cron daemons - why and how to fix?
I'm using Ubuntu 16.04.5 LTS.
I tried to read my log files for errors.
The most interesting are the following:
cat /var/log/auth.log | egrep "unable|faulty"
Nov 25 13:25:13 localhost su[4491]: PAM ...
0
votes
1answer
766 views
SDDM fails when PAM_MOUNT is used
I have a new install of Kubuntu 18.04.1, with user authentication via sssd to the company's Microsoft Active Directory.
Every user has a Samba share on //fileserver6/$USER and I want to mount it at ...
2
votes
1answer
477 views
PAM unable to dlopen pam_sss.so pam_cap.so pam_systemd.so pam_pwquality.so
Since yesterday i have a huge number of errors in journald log. New records appears at 3-5 in each second:
окт 24 09:08:37 ripcomp su[7405]: PAM unable to dlopen(pam_sss.so): /lib/security/pam_sss.so:...
3
votes
1answer
5k views
How to configure a U2F key(such as a YubiKey) for system wide 2-Factor Authentication?
The official Yubico guide only covers enabling it for GDM login, how can I enable it for all logins including TTY, ssh, sudo, etc?
0
votes
1answer
634 views
Why USERGROUPS_ENAB property in /etc/login.defs does not have any effect?
I just found the following comment in /etc/login.defs:
# Enable setting of the umask group bits to be the same as owner bits
# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid ...
4
votes
1answer
992 views
A lot of PAM authentication errors on my logs targeting my mailserver. How do I stop it?
I need help pinpointing some errors in my auth.log file on my Ubuntu server. A few weeks ago, I found a plethora of login attempts to my SSH port (22) on auth.log, so I changed my SSH port. It was ...
