Making the Most of Pluggable Authentication Modules (PAM)
- How PAM Is Configured: The Basics
- How PAM Works: The Basics
- Putting PAM to Work: Expiring Passwords
- Putting PAM to Work: Enforcing wheel
- Putting PAM to Work: Other Authentication
- Summary
- Q&A
This article is excerpted from Sams Teach Yourself Linux Security Basics in 24 Hours, by Aron Hsiao.
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
In this article, we're going to study the basic configuration of PAM for Linux. PAM, or the Pluggable Authentication Modules system, is a complex authentication system that stretches across most of the restricted services (services requiring authentication) in any Linux system. Luckily, PAM is generally shipped in a fairly secure configuration with most Linux distributions, so a little touch-up here and there is all that is needed to ensure that general-purpose authentication is secure on your Linux box.
CAUTION
If PAM is not a component of your Linux distribution by default, you should consider upgrading to a newer distribution. Using PAM not only can make your system more secure, but it also can help to resolve a myriad of inconvenient compatibility conflicts between security necessities such as shadow and MD5 and services that need to access these files. You can check for PAM support on your system by checking for the existence of any of these files or directories:
/etc/pam.conf
/etc/pam.d/
/lib/libpam.so.*
/usr/lib/libpam.so.*
If any of these exist, you're probably in good shape with respect to PAM-enabled authentication services. Make no mistake: There's almost no point in trying to use shadow passwords without PAM installed as well, and shadow is more than essential for a secure system.
How PAM Is Configured: The Basics
PAM configuration is located either in a single, central file at /etc/pam.conf or in a series of smaller files named after the services they relate to in /etc/pam.d/.
NOTE
In order to fully follow this discussion of PAM configuration, you should try to "follow along" by examining your own configuration files and the PAM modules reference guide, a part of the official PAM documentation located at http://www.kernel.org/pub/linux/libs/pam/.
PAM configuration is based on a "stack" model. There is a given list, or stack, of required actions for any single service that must be completed before access to the service in question is granted. Each action in the stack is supplied on a single PAM configuration file line, which contains exactly one each of the following: a module type, a control flag, a module, and—depending on whether /etc/pam.conf or /etc/pam.d/ is used—a service name.
Each line contains a module type. A module type can be thought of as a specifier for one of four basic contexts within which a PAM stack entry can operate. These module type contexts are shown in Table 1.
Table 1
PAM ModuleType Context Names
|
Type |
Description |
|
auth |
This stack entry's action is related to user authentication—for example, when asking the user to enter a password for login. |
|
account |
This stack entry's action is related to user account management—for example, when checking to see whether a user's account or password has expired. |
|
session |
This stack entry's action is related to connection or session management—for example, logging information about the user's login session to the system log. |
|
password |
This stack entry's action is related to password management—for example, when updating a user's password as stored in the system /etc/shadow file. |
Each line also contains a control flag. A control flag can be thought of as a specifier for one of four basic levels of necessity. It defines the importance of the stack entry in question for the authentication process as a whole. This will determine how PAM will proceed after evaluating any action that has taken place. The control flag levels of necessity are shown in Table 2.
Table 2
PAM Control Flag Necessity Levels
|
Level |
Description |
|
requisite |
This stack entry's action must be completed successfully to continue processing actions. If not, the service request will fail, and no more actions in this context will be processed. |
|
required |
This stack entry's action must be completed successfully. If not, the service request will fail after the rest of the action stack has been processed. |
|
sufficient |
This stack entry's action alone is enough to cause a service request to be accepted unless an earlier required action has not been completed successfully. If the request is accepted based on a successful action, no further actions in the stack will be processed. |
|
optional |
If no other action has proven successful or unsuccessful, the success of this stack entry's actions—or the lack thereof—will determine the stack's response to the authentication request. |
In addition to the module type and control flag, each stack entry in an /etc/pam.conf file contains a service name supplied by the program requesting authentication. Also present in every stack entry are an authentication module used to control this type of authentication and arguments, which are to be supplied to the authentication module. The format of these elements together in a single stack entry in the /etc/pam.conf file is as follows:
service module-type control-flag module [arguments]
A PAM configuration file, therefore, is simply a list of these stack entries, one per line, which define the entire set of authentication procedures for a Linux system. When new services are installed on a Linux system that require new authentication techniques, they will normally include additional PAM modules, specific to the service in question, along with documentation on how the module is to be used. The new service and modules can then quickly and easily be incorporated into the existing authentication framework.