114

Chapter 7. Pluggable Authentication Modules (PAM)

A newer control flag syntax allowing for even more control is now available for PAM. Please see the

PAM docs located in the

/usr/share/doc/pam version number/

directory for information on

this new syntax.

7.5. PAM Module Paths

Module paths tell PAM where to find the pluggable module to be used with the module type specified.

Usually, it is provided as the full path to the module, such as

/lib/security/pam_stack.so

.

However, if the full path is not given (in other words, the path does not start with a

/

), then the

module indicated is assumed to be in the

/lib/security/

directory   the default location for

PAM modules.

7.6. PAM Module Arguments

PAM uses arguments to pass information to a pluggable module during authentication for a particular

module type. These arguments allow the PAM configuration files for particular programs to use a

common PAM module but in different ways.

For example, the

pam_userdb.so

module uses secrets stored in a Berkeley DB file to authenticate the

user. Berkeley DB is an open source database system designed to be embedded in many applications

to track information. The module takes a

db

argument, specifying the Berkeley DB filename to use,

which can be different for different services.

So, the

pam_userdb.so

line in a PAM configuration file look like this:

auth

required

/lib/security/pam_userdb.so db=path/to/file

Invalid arguments are ignored and do not otherwise affect the success or failure of the PAM mod 

ule. When an invalid argument is passed, an error is usually written to

/var/log/messages

file.

However, since the reporting method is controlled by the PAM module, the module must be written

correctly to log the error to this file.

7.7. Sample PAM Configuration Files

Below is a sample PAM application configuration file:

#%PAM 1.0

auth

required

/lib/security/pam_securetty.so

auth

required

/lib/security/pam_unix.so shadow nullok

auth

required

/lib/security/pam_nologin.so

account

required

/lib/security/pam_unix.so

password

required

/lib/security/pam_cracklib.so retry=3

password

required

/lib/security/pam_unix.so shadow nullok use_authtok

session

required

/lib/security/pam_unix.so

The first line is a comment as denoted by the

#

character   the comment symbol in PAM configuration

files. Lines two through four stack three modules for login authentication.

auth

required

/lib/security/pam_securetty.so

This line makes sure that if the user is trying to log in as root, the tty on which they are logging in is

listed in the

/etc/securetty

file, if that file exists.

auth

required

/lib/security/pam_unix.so nullok