Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 118)

118 Chapter 8. Pluggable Authentication Modules (PAM)

#%PAM-1.0

auth required /lib/security/pam_nologin.so

auth required /lib/security/pam_securetty.so

auth required /lib/security/pam_env.so

auth sufficient /lib/security/pam_rhosts_auth.so

auth required /lib/security/pam_stack.so service=system-auth

First, pam_nologin.so checks to see if /etc/nologin exists. If is does, no one can log in except

for root.

auth required /lib/security/pam_securetty.so

The pam_securetty.so module then prevents root logins from occurring on insecure terminals.

This effectively disallows all root rlogin attempts for security reasons. If you need to log in as root,

use OpenSSH instead. For more information on the SSH protocol, see Chapter 10.

auth required /lib/security/pam_env.so

The pam_env.so module loads the environmental variables speciﬁed in

/etc/security/pam_env.conf.

auth sufficient /lib/security/pam_rhosts_auth.so

The pam_rhosts_auth.so modules then authenticates the user using .rhosts in the user’s

home directory. If this succeeds, PAM immediately authenticates the rlogin session. If

pam_rhosts_auth.so fails to authenticate the user, this failed authentication attempt is ignored.

auth required /lib/security/pam_stack.so service=system-auth

If the pam_rhosts_auth.so module fails to authenticate the user, the pam_stack.so module per-

forms normal password authentication.

The argument service=system-auth means the user must now pass through the PAM conﬁguration

for system authorization found in /etc/pam.d/system-auth.

Note

If you do not want to prompt for a password when the securetty check fails and determines that

the user is trying to login as root remotely, you can change the pam_securetty.so module from

required to requisite.

8.8. PAM and Device Ownership

Red Hat Linux allows the ﬁrst privileged user to log in on the physical console of the machine the

ability to manipulate devices and perform tasks normally reserved for root. This is done through a

PAM module called pam_console.so.

8.8.1. Device Ownership

When a user logs into a machine under Red Hat Linux, the pam_console.so module is called by

— called the console user — the module grants ownership of a variety of devices normally owned by

root. The console user owns these devices until the last local session for that user ends. Once the user

has logged out, ownership of the devices reverts back to their default values.

1 2 ... 113 114 115 116 117 118 119 120 121 122 123 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 118