204 Technique 30: Customizing Authentication with PAM

Understanding Modules and

Configuration Files: The

Basics of PAM

Authentication

PAM (Pluggable Authentication Modules) is the program that is responsible for authenticating users who connect to a Linux system. Most programs packaged with Linux distributions use PAM for authentication, as do many other open-source projects.

PAM gains its flexibility from plug-in modules. PAM itself doesn’t do a whole lot, relying instead on modules to do the heavy lifting. Developers write the modules to fulfill a number of diverse tasks. Some modules store passwords on an smb mounted network share, while others are specialized to use hardware devices like smart cards and biometric scanners.

PAM keeps track of the level of security you desire in a set of configuration files. You can change the PAM configuration files to require multiple passwords, limit access based on a user/location relationship, or enable biometric devices. Each configuration file specifies a set of modules that PAM employs to authenticate a user.

With a little extra hardware and PAM, you can use biometric scans or other high-tech devices to secure super-important data.

We explain the basics of finding a module and customizing its rules in the next section. Then, in “Building Good Rules with PAM,” we explain the basic syntax of rules and what your customizing options are. And we help you better understand what’s actually in a configuration file in “Dissecting a Configuration File” also later in this technique.

Finding a Module and

Customizing Its Rules

Adding your own rules to the PAM configuration files is relatively simple when you understand what the different modules do.

If you use Fedora, you can find documentation about PAM modules in

$ /usr/share/doc/pam-0.77/txts

If you’re a Mandrake user, you find documentation about PAM modules in

$ /usr/share/doc/pam-doc-0.77.txts

If you use SuSE, look for PAM documentation in

$ /usr/share/doc/packages/pam/modules

Move into the directory, and use the ls command to see a list of the documents available. Use the more command to display the contents of the documentation:

$ more README.pam_nologin

Press the spacebar while the document is displayed to see more of the document.

When you’ve found a PAM module you want to use for program authentication, add a rule to the program configuration file that tells PAM when to invoke the module.

Building Good Rules with PAM

This is the section where we begin to break down what your options are for customizing levels of security in PAM. A PAM-enabled program can rely on a chain of one or more rules to authenticate the user. PAM configuration rules can seem a bit overwhelming

Building Good Rules with PAM 205

at first, but they’re actually quite simple. The basic format of a configuration rule is this:

phase control-level module-pathname arguments

We explain what you need to know about each part of a rule in the following sections.

Phase

Each configuration file controls four different phases of the authentication process: authentication, account management, session management, and password management. Each configuration rule belongs to a specific phase according to the first word in the rule:

auth: An auth rule verifies that you are who you claim to be, by password, biometric scanner, smart card, or other authentication means.

account: Account rules allow or deny access to a service based on available system resources (a certain number of users may be allowed to log in at one time), user location (root users must be sitting in front of the computer console), and other factors. You can use account rules to help control system resources and privileged access.

session: Session rules put in place the session information for the user that is logging in. A typical session rule may mount your home directory when you log in or set up a log file that records your entire login session.

password: Password rules change the password or other authentication means that a module uses to identify the user.

PAM modules are diverse, each controlling different aspects of authentication and session management. A given module may service all four phases (authentication, account management, session management, and password management) or only a few. For example, the pam_nologin.so module (which prohibits user logins if the file /etc/nologin exists) works in the auth phase, but doesn’t have anything to offer the password phase.

If you need an authentication module for an unusual security application, search the Web. Modules are out there — just search the Web for PAM modules.

Control level

The control level determines what happens if the module fails. For example, if the user fails to provide a proper password but passes a retina scan, you may want to let that user into your system.

Here are the control-level options:

sufficient: If a rule is satisfied that is deemed sufficient, you are allowed to continue. A user entering a correct password in a step that is deemed sufficient is allowed either to continue with the login process or to access the program.

required: This rule must succeed, or the user is not allowed to run the program.

optional: This rule does not need to be satisfied for the user to be allowed to use the program.

requisite: If two passwords are used to authenticate identity, using the requisite control type stops authentication when the first password fails.

Module pathname

The third feature in a configuration rule is the pathname to the PAM module that the rule uses. The modules are located in /lib/security.

Arguments

The fourth item in a PAM configuration rule is a set of zero or more arguments that gets passed along to the PAM module when the module is invoked. The arguments vary depending on the module. The simplest of arguments is debug, which causes a module to write debugging information to the system log (which is handy if you’re having trouble logging into your system).