View Source: pam(7) - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages
PAM
!!!PAM
NAME
SYNOPSIS
DESCRIPTION
The configuration file(s)
FILES
ERRORS
CONFORMING TO
BUGS
SEE ALSO
----
!!NAME


Linux-PAM - Pluggable Authentication Modules for Linux
!!SYNOPSIS


__/etc/pam.conf__
!!DESCRIPTION


This manual is intended to offer a quick introduction to
__Linux-PAM__. For more information the reader is
directed to the __Linux-PAM system administrators'
guide__.


__Linux-PAM__ Is a system of libraries that handle the
authentication tasks of applications (services) on the
system. The library provides a stable general interface
(Application Programming Interface - API) that privilege
granting programs (such as login(1) and su(1))
defer to to perform standard authentication
tasks.


The principal feature of the PAM approach is that the nature
of the authentication is dynamically configurable. In other
words, the system administrator is free to choose how
individual service-providing applications will authenticate
users. This dynamic configuration is set by the contents of
the single __Linux-PAM__ configuration file
__/etc/pam.conf__. Alternatively, the configuration can
be set by individual configuration files located in the
__/etc/pam.d/__ directory. ''The presence of this
directory will cause'' __Linux-PAM__ ''to ignore''
__/etc/pam.conf__''.''


From the point of view of the system administrator, for whom
this manual is provided, it is not of primary importance to
understand the internal behavior of the __Linux-PAM__
library. The important point to recognize is that the
configuration file(s) ''define'' the connection between
applications (__services__) and the pluggable
authentication modules (__PAM__s) that perform the actual
authentication tasks.


__Linux-PAM__ separates the tasks of
''authentication'' into four independent management
groups: __account__ management; __auth__entication
management; __password__ management; and __session__
management. (We highlight the abbreviations used for these
groups in the configuration file.)


Simply put, these groups take care of different aspects of a
typical user's request for a restricted
service:


__account__ - provide account verification types of
service: has the user's password expired?; is this user
permitted access to the requested service?


__auth__entication - establish the user is who they claim
to be. Typically this is via some challenge-response request
that the user must satisfy: if you are who you claim to be
please enter your password. Not all authentications are of
this type, there exist hardware based authentication schemes
(such as the use of smart-cards and biometric devices), with
suitable modules, these may be substituted seamlessly for
more standard approaches to authentication - such is the
flexibility of __Linux-PAM__.


__password__ - this group's responsibility is the task of
updating authentication mechanisms. Typically, such services
are strongly coupled to those of the __auth__ group. Some
authentication mechanisms lend themselves well to being
updated with such a function. Standard UN*X password-based
access is the obvious example: please enter a replacement
password.


__session__ - this group of tasks cover things that
should be done prior to a service being given and after it
is withdrawn. Such tasks include the maintenance of audit
trails and the mounting of the user's home directory. The
__session__ management group is important as it provides
both an opening and closing hook for modules to affect the
services available to a user.
!!The configuration file(s)


When a __Linux-PAM__ aware privilege granting application
is started, it activates its attachment to the PAM-API. This
activation performs a number of tasks, the most important
being the reading of the configuration file(s):
__/etc/pam.conf__. Alternatively, this may be the
contents of the __/etc/pam.d/__ directory.


These files list the __PAM__s that will do the
authentication tasks required by this service, and the
appropriate behavior of the PAM-API in the event that
individual __PAM__s fail.


The syntax of the __/etc/pam.conf__ configuration file is
as follows. The file is made up of a list of rules, each
rule is typically placed on a single line, but may be
extended with an escaped end of line: `
__


The format of each rule is a space separated collection of
tokens, the first three being case-insensitive:


__service type control module-path
module-arguments__


The syntax of files contained in the __/etc/pam.d/__
directory, are identical except for the absence of any
''service'' field. In this case, the ''service'' is
the name of the file in the __/etc/pam.d/__ directory.
This filename must be in lower case.


An important feature of __Linux-PAM__, is that a number
of rules may be ''stacked'' to combine the services of a
number of PAMs for a given authentication task.


The __service__ is typically the familiar name of the
corresponding application: __login__ and __su__ are
good examples. The __service__-name, __other__, is
reserved for giving ''default'' rules. Only lines that
mention the current service (or in the absence of such, the
__other__ entries) will be associated with the given
service-application.


The __type__ is the management group that the rule
corresponds to. It is used to specify which of the
management groups the subsequent module is to be associated
with. Valid entries are: __account__; __auth__;
__password__; and __session__. The meaning of each of
these tokens was explained above.


The third field, __control__, indicates the behavior of
the PAM-API should the module fail to succeed in its
authentication task. Valid __control__ values are:
__requisite__ - failure of such a PAM results in the
immediate termination of the authentication process;
__required__ - failure of such a PAM will ultimately lead
to the PAM-API returning failure but only after the
remaining ''stacked'' modules (for this __service__
and __type__) have been invoked; __sufficient__ -
success of such a module is enough to satisfy the
authentication requirements of the stack of modules (if a
prior __required__ module has failed the success of this
one is ''ignored''); __optional__ - the success or
failure of this module is only important if it is the only
module in the stack associated with this
__service__+__type__.


__module-path__ - this is the full filename of the PAM to
be used by the application


__module-arguments__ - these are a space separated list
of tokens that can be used to modify the specific behavior
of the given PAM. Such arguments will be documented for each
individual module.
!!FILES


__/etc/pam.conf__ - the configuration file__
/etc/pam.d/__ - the __Linux-PAM__ configuration
directory. If this directory is present, the
__/etc/pam.conf__ file is ignored.__
/usr/lib/libpam.so.X__ - the dynamic library__
/usr/lib/security/*.so__ - the PAMs


Note, to conform to the Linux File-system standard, the
libraries and modules in your system may be located in
__/lib__ and __/lib/security__
respectively.
!!ERRORS


Typically errors generated by the __Linux-PAM__ system of
libraries, will be written to syslog(3).
!!CONFORMING TO


DCE-RFC 86.0, October 1995.
Contains additional features, currently under consideration
by the DCE-RFC committee.
!!BUGS


None known.
!!SEE ALSO


The three __Linux-PAM__ Guides, for __System
administrators__, __module developers__, and
__application developers__.
----
3 pages link to pam(7):
This page is a man page (or other imported legacy content). We are unable to automatically determine the license status of this page.
Last edited on Tuesday, June 4, 2002 12:30:59 am by "perry"
Edit PageHistory Diff Info LikePages