Practical UNIX and Internet Security, 3rd Edition

Pluggable Authentication Modules (PAM)

Because there are so many ways to authenticate users, it’s convenient to have a unified approach to authentication that can handle multiple authentication systems for different needs. The Pluggable Authentication Modules (PAM) system is one such approach.

PAM was originally developed by Sun, and implementations are available for Solaris, FreeBSD, and especially Linux, where most PAM development is now centered. PAM provides a library and API that any application can use to authenticate users against a myriad of authentication systems. Each authentication system that PAM knows about is implemented as a PAM module, which in turn is implemented as a dynamically-loaded shared library. PAM modules are available to authenticate users through:

• /etc/passwd or /etc/shadow

• NIS or NIS+

• LDAP

• Kerberos 4 or 5

• An arbitrary Berkeley DB file^[47]

Each PAM-aware service is configured either in the /etc/pam.conf file or, more commonly, in its own file in the /etc/pam.d directory. For example, the PAM configuration file for the /bin/su command in Linux distributions is /etc/pam.d/su. A service named other is used to provide defaults for PAM-aware services that are not explicitly configured.

Here is an excerpt from /etc/pam.conf for the OpenSSH server:

sshd auth required /lib/security/pam_env.so sshd auth sufficient /lib/security/pam_unix.so likeauth nullok sshd auth required /lib/security/pam_deny.so sshd account required /lib/security/pam_unix.so sshd password ...