Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 114)

114 Chapter 8. Pluggable Authentication Modules (PAM)

The next four sections will describe the basic format of PAM conﬁguration ﬁles and how they use

PAM modules to perform authentication for PAM-aware applications.

8.3. PAM Modules

There are four types of PAM modules used to control access to services. These types correlate to

different aspects of the authorization process:

• auth — used to authenticate the user by, for example, asking for and checking a password. It can

also set credentials, such as group membership or Kerberos tickets.

• account — used to make sure access is allowed. For example, it could check if the account has

expired. Or it could check if the user is allowed to log in at a particular time of day.

• password — used to set passwords.

• session — used after a user has been authenticated to manage the user’s session. This module

type can also perform additional tasks which are needed to allow access (for example, mounting

the user’s home directory or making their mailbox available).

Note

An individual module can address more than one of the above module types. For instance

pam_unix.so has components which address all four.

In a PAM conﬁguration ﬁle, the module type is the ﬁrst aspect deﬁned. For example a typical line in

a conﬁguration may look like this:

auth required /lib/security/pam_unix.so

This instructs PAM to look at the auth component of the pam_unix.so module.

8.3.1. Stacking Modules

Modules can be stacked, or placed upon one another, so that multiple modules are used together for a

particular purpose. Therefore the order of the modules is very important in the authentication process.

Stacking makes it very easy for an administrator to require several conditions to exist before allowing

user authentication. For example, rlogin normally uses ﬁve stacked auth modules, as seen in its

PAM conﬁguration ﬁle:

auth required /lib/security/pam_nologin.so

auth required /lib/security/pam_securetty.so

auth required /lib/security/pam_env.so

auth sufficient /lib/security/pam_rhosts_auth.so

auth required /lib/security/pam_stack.so service=system-auth

Before someone is allowed to use rlogin, PAM veriﬁes that the /etc/nologin ﬁle does not exist,

that they are not trying to log in remotely as root over an unencrypted network connection, and that any

environmental variables can be loaded. Then, a successful rhosts authentication is performed before

the connection is allowed. If rhosts authentication fails, then standard password authentication is

performed.

1 2 ... 109 110 111 112 113 114 115 116 117 118 119 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 114