Sponsored Content
Operating Systems Solaris SSH and PAM authentication issues on Solaris 10 Post 302502317 by bluescreen on Monday 7th of March 2011 03:43:13 PM
Old 03-07-2011
SSH and PAM authentication issues on Solaris 10

This is a zone running Solaris 10u8 on a 6320 blade. The global zone is also running 10u8.

One my users is attempting to change his password and getting a following screen:

Code:
$ ssh remotesys
Password:
Warning: Your password has expired, please change it now.

New Password:
Re-enter new Password:
sshd-kbdint: Unexpected failure. Password database unchanged.

Password:

and when I check /var/adm/messages, I see this:

Code:
Mar  7 15:06:28 remotesys sshd[26575]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[4] while changing authentication tokens (password): System error
Mar  7 15:06:28 remotesys sshd[26575]: [ID 800047 auth.notice] Failed keyboard-interactive for user1 from nnn.nnn.nnn.nnn port 47644 ssh2

Checking the system, there appears to be no unusual issues (disk space, cpu, etc) - all files are in place with the proper permissions.

Any suggestions for help are greatly appreciated.
 

10 More Discussions You Might Find Interesting

1. Programming

PAM Authentication Sample

Hi, I am a Linux / Unix newbie c programmer. I have a c/c++ daemon server that will receive authentication (userid / password) from a windows client. All I want to do is authenticate the user via PAM API - i.e. user must exist on the Unix / Linux system + password must be validated. ... (1 Reply)
Discussion started by: vineshp
1 Replies

2. UNIX for Advanced & Expert Users

pam ldap limit authentication

I have a linux machine which authenticate users to ldap, this is working fine. But I would like to limit users that logon to the machines to just the system admins. The machines hosts different web sites which users accessed from there home directory like http://foo.mdx.ac.uk/~username At the... (0 Replies)
Discussion started by: hassan1
0 Replies

3. Solaris

nisplus and pam authentication

HI, There is a user having problem when he try to login to solaris box, it works after few tried. What may be the problem? PAM authentication Password: PAM authentication Password: PAM authentication New Password: (1 Reply)
Discussion started by: mokkan
1 Replies

4. Solaris

Soalris 10 PAM Radius authentication Module

Hello Group, I'm facing Problem with the configuration of "***pam_radius_auth.so.1***" module to be integrated with Freeradius and Funk Steel Belted Radius. Both this radius servers are able to make "Access-Accept" packet. But the SSH or Telnet client is not able to login to the system with the... (0 Replies)
Discussion started by: ImpeccableCode
0 Replies

5. UNIX for Advanced & Expert Users

PAM authentication failure

My PAM module seems to work right but it fails in authentication. Althought it can't authenticate, the session module works and the software who uses it executes well. For example, when I login through "gdm" using pam to authenticate against an ldap server /var/log/auth.log shows Any... (1 Reply)
Discussion started by: capibolso
1 Replies

6. UNIX for Dummies Questions & Answers

Solaris 10: Cannot ssh into machine- authentication issues

Greetings! I just managed to install Solaris 10 on a Sparc based machine. However, there might be a problem with the way ssh is configured. I CAN ssh from the machine into another on the network (same subnet, as root), but then the newly installed machine CANNOT seem to accept incoming ssh... (2 Replies)
Discussion started by: agummad
2 Replies

7. Red Hat

PAM configuration: Kerberos authentication and NIS authorization problem

Hi, I've configured two linux boxes to authenticate against Windows Active Directory using Kerberos while retrieving authorization data (uids, gids ,,,)from NIS. The problem I ran into with my PAM configuration is that all authentication attempts succeed in order.i.e. if someone tried his... (0 Replies)
Discussion started by: geek.ksa
0 Replies

8. SCO

Authentication problems with Active Directory/Samba/Winbind/Pam

Hi all. I'm having real trouble authenticating users against active directory for my SCO UnixWare 7.1.4 box running samba 3.0.24 (installed via Maintenance pack 4). I can list AD users/groups (after overcoming several hiccups) with wbinfo -g / wbinfo -u. I can use id to get a view an ad user ie:... (0 Replies)
Discussion started by: silk600
0 Replies

9. UNIX for Advanced & Expert Users

PAM authentication.

I have applied pam authentication for local users as highlighted in below file. # cat /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so... (0 Replies)
Discussion started by: pinga123
0 Replies

10. SuSE

Authentication with PAM

Hello all, I recently updated PAM policy files (pam_authz.policy) on HP-UX Servers with AD groups involving allowing and denying the certain groups.. Could anyone tell me what is the equivalent mechanism in SLES(Linux)? Is it possible to allow/deny AD group access with the SLES LDAP... (0 Replies)
Discussion started by: lcclaj0
0 Replies
passwd(1)						      General Commands Manual							 passwd(1)

Name
       passwd - create or change password

Syntax
       passwd [-aefs] [name]

Description
       The  command  lets you or the superuser change your password.  When you enter the command, the program prompts you for the old password and
       then for the new password.  Next, the program asks you for the new password again, to verify that you have typed it correctly.	Note  that
       the passwords are not displayed on the screen.

       Your  new password must meet the length requirements specified by the superuser.  To review these requirements, refer to the file. (This is
       a read-only file.)

       If your system is running with increased security, you may have to choose a password from a list of randomly generated  passwords,  or  you
       may  need  authorization  to  change your password.  At higher security levels, you may be prohibited from changing your password until its
       minimum lifetime has expired, as specified in the Authorization Database.

       If you are running the BIND/Hesiod service, your password will be updated automatically on the server.

Options
       -a   Supply a list of randomly generated passwords.  (See the Examples section.)

       -e   Use an extended protocol when communicating with a prompter program.  As a result, the standard input and output (used by is  sent	to
	    this program.

       -f   Change the finger information, not the password. The finger program provides information about current ULTRIX users, such as login and
	    terminal name, idle time and office location.

       -s   Change the login shell of the password file, not the password entry.

Restrictions
       If you use a hardcopy terminal, you must destroy all print outs of valid passwords.

Examples
       The following example illustrates the -a option, which displays a list of randomly generated passwords and  their  suggested  pronunciation
       with hyphens.  The hyphens delineate the syllables of the passwords:
       passwd -a abcd
       Changing password for abcd

       Here are some suggested passwords:

       ryegd	       ryeg-di
       aswurku	       a-swurk-u
       ryedok	       ryed-ok
       teleccs	       tel-ec-cos
       wahislas        wa-hi-slas

       Enter new password:

Diagnostics
       Password must be at least 6 characters long, password unchanged
	    Your password does not meet the minimum length requirement specified in

       Warning: Only the first 8 characters of the password are significant
	    Your password exceeds the maximum length requirement specified in

       Permission denied
	    You do not have the privilege to change your password. The minimum lifetime has not expired.

       Password is not different enough, unchanged
	    Your new password must be different from your old password.

       Password must be different than logname, and not resemble previous password
	    Your new password must be different from your login name.

       Verification failed, password unchanged
	    You misspelled the verification of your new password.

Files
       Password file

       Authorization data base directory

       Authorization data base page

       Data base service selection and security configuration file
			   Only the superuser and members of the group can access the and files.

See Also
       chfn(1), chsh(1), finger(1), login(1), shexp(1), yppasswd(1yp), passwd(5yp), edauth(8), vipw(8)
       Guide to System Environment Setup
       Security Guide for Users
       Security Guide for Administrators
       "Password Security: A Case History", Supplementary Documents, Volume 3: System Manager

																	 passwd(1)
All times are GMT -4. The time now is 04:04 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy