LPI Linux Certification in a Nutshell, 2nd Edition

Objective 4: PAM Authentication

PAM is the Pluggable Authentication Modules system. It enables the addition of a number of advanced security features across the whole Linux system without the need to recode individual services. All security conscious programs (such as login, su, and ftp) are configured by PAM to do a variety of authentication and security checks.

When a service such as login is used, PAM will check its configuration files to determine how to authenticate the user. For instance, PAM may authenticate by checking shadow passwords, Kerberos, Winbind, Samba, and so on. After the method of authentication is determined, PAM returns an answer to the service to indicate whether the user was authenticated.

PAM Configuration

All the PAM configuration files are located in /etc/pam.d. Every application or service that can use PAM has a file entry in /etc/pam.d as well. Some of the most common entries that can be found under /etc/pam.d include chfn, chsh, halt, linuxconf, login, passwd, ppp, reboot, rexec, rlogin, rsh, shutdown, su, xdm, and xscreensaver. If installed, you may even find KDE, Samba, and SSH here as well. Looking at these files, you will see four columns of information: module-type , control-flag, module-path, and arguments. Take a look at the following example of the login entry under /etc/pam.d:

#%PAM-1.0 auth required /lib/security/pam_securetty.so auth required /lib/secuirty/pam_pwdb.so shadow nullok auth required /lib/security/pam_nologin.so account required ...