19.0 Authentication with PAM
Linux uses PAM (pluggable authentication modules) in the authentication
process as a layer that mediates between user and application. PAM
modules are available on a systemwide basis, so they can be requested by
any application. This chapter describes how the modular authentication
mechanism works and how it is configured.
System administrators and programmers often want to restrict access to
certain parts of the system or to limit the use of certain functions of an
application. Without PAM, applications must be adapted every time a new
authentication mechanism, such as LDAP, Samba, or Kerberos, is introduced.
This process, however, is rather time-consuming and error-prone. One way
to avoid these drawbacks is to separate applications from the
authentication mechanism and delegate authentication to centrally managed
modules. Whenever a newly required authentication scheme is needed, it is
sufficient to adapt or write a suitable PAM module for use by the program
in question.
Every program that relies on the PAM mechanism has its own configuration
file in the directory
/etc/pam.d/programname.
These files define the PAM modules used for authentication. In addition,
there are global configuration files for PAM modules under
/etc/security, which define the exact behavior of
these modules (examples include pam_env.conf, and
time.conf). Every application that uses a PAM module
actually calls a set of PAM functions, which then process the information
in the various configuration files and return the result to the calling
application.
To facilitate the creation and maintenance of PAM modules, common default
configuration files for the functions auth,
account, password, and
session modules have been introduced. These are pulled
in from every application's PAM configuration. Updates to the global PAM
configuration modules in common-* are thus propagated
across all PAM configuration files without requiring the administrator to
update every single PAM configuration file.
The global common PAM configuration files are maintained using the
pam-config tool. This tool automatically adds new modules to the
configuration, changes the configuration of existing ones or deletes
modules or options from the configurations. Manual intervention in
maintaining PAM configurations is minimized or no longer required.
