A variety of graphical administrative tools under Red Hat Enterprise Linux give users
elevated privileges for up to five minutes via the
pam_timestamp.so module. It is important to
understand how this mechanism works because a user who walks away from a
terminal while pam_timestamp.so is in effect leaves
the machine open to manipulation by anyone with physical access to the
console.
Under the PAM timestamp scheme, the graphical administrative application
prompts the user for the root password when it is launched. Once
authenticated, the pam_timestamp.so module creates
a timestamp file within the /var/run/sudo/
directory by default. If the timestamp file already exists, other
graphical administrative programs do not prompt for a
password. Instead, the pam_timestamp.so module
freshens the timestamp file — reserving an extra five minutes of
unchallenged administrative access for the user.
The existence of the timestamp file is denoted by an authentication icon
in the notification area of the panel. Below is an illustration of the
authentication icon:
It is recommended that before walking away from a console where a PAM
timestamp is active, the timestamp file be destroyed. To do this from
within a graphical environment, click on the authentication icon on
the panel. When a dialog box appears, click on the Forget
Authorization button.
If logged into a system remotely using ssh, use the
/sbin/pam_timestamp_check -k root command to destroy the
timestamp file.
 | Note |
|---|
| | You must be logged in as the user who originally invoked the
pam_timestamp.so module in order to use the
/sbin/pam_timestamp_check command. Do not log in
as root to issue this command.
|
For information about destroying the timestamp file using
pam_timestamp_check, refer to the
pam_timestamp_check man page.
The pam_timestamp.so module accepts several
directives. Below are the two most commonly used options:
timestamp_timeout — Specifies the number of seconds the
during which the timestamp file is valid (in seconds). The default
value is 300 seconds (five minutes).
timestampdir — Specifies the directory
in which the timestamp file is stored. The default value is
/var/run/sudo/.
For more information about controlling the
pam_timestamp.so module, refer to Section 16.8.1 Installed Documentation.
