Datasheet

“main” (Installation and Administration) — 2004/6/25 — 13:29 — page 404 — #430

System administrators and programmers often want to restrict access to

certain parts of the system or to limit the use of certain functions of an ap-

plication. Without PAM, applications must be adapted every time a new

authentication mechanism (such as LDAP or SAMBA) is introduced. This

process, however, is rather time-consuming and error-prone. One way to

avoid these drawbacks is to separate applications from the authentica-

tion mechanism and to delegate the latter to centrally managed modules.

Whenever a newly required authentication scheme is needed, it is sufﬁcient

to adapt or write a suitable PAM module for use by the program in ques-

tion.

Every program that relies on the PAM mechanism has its own conﬁg-

uration ﬁle in the directory /etc/pam.d/<programname>/. These

ﬁles deﬁne the PAM modules that are used for authentication. In addi-

tion, there are global conﬁguration ﬁles for most PAM modules under

/etc/security/, which deﬁne the exact behavior of these modules (ex-

amples are pam_env.conf, pam_pwcheck.conf, pam_unix2.conf,

time.conf, etc.). Every application that uses a PAM module actually calls

a set of PAM functions, which then process the information in the various

conﬁguration ﬁles and return the result to the calling application.

20.1 Structure of a PAM Conﬁguration

File

Each line in a PAM conﬁguration ﬁle comprises a maximum of four

columns:

PAM modules are processed as stacks. Different types of modules have dif-

ferent purposes, for example, one module checks the password, another

one veriﬁes the location from which the system is accessed, and yet another

one reads user-speciﬁc settings. PAM knows about four different types of

modules:

auth The purpose of this type of module is to check the user’s authentic-

ity. This is traditionally done by querying a password, but it can also

be achieved with the help of a chip card or through biometrics (ﬁn-

gerprints or iris scan).

404 20.1. Structure of a PAM Conﬁguration File