Who this book is written for This book is for experienced system administrators and developers working with multiple Linux/UNIX servers or with both UNIX and P Windows servers. It assumes a good level of admin knowledge, and that l u developers are competent in C development on UNIX-based systems. g g a b l e Pluggable Authentication Modules A u t h e n t i PAM (Pluggable Authentication Modules) is a modular and flexible authentication management c a layer that sits between Linux applications and the native underlying authentication system. t i o n The PAM framework is widely used by most Linux distributions for authentication purposes. M Originating from Solaris 2.6 ten years ago, PAM is used today by most proprietary and free o UNIX operating systems including GNU/Linux, FreeBSD, and Solaris, following both the d design concept and the practical details. PAM is thus a unifying technology for authentication u l mechanisms in UNIX. e s This book provides a practical approach to UNIX/Linux authentication. The design principles are thoroughly explained, then illustrated through the examination of popular modules. It is intended as a one-stop introduction and reference to PAM. What you will learn from this book F r o m T e c h n o l o g i e s t o S o l u t i o n s • Install, compile, and configure Linux-PAM on your system • Download and compile third-party modules • Understand the PAM framework and how it works • Learn to work with PAM’s management groups and control fl ags Pluggable Authentication Modules • Test and debug your PAM confi guration • Install and configure the pamtester utility to check your PAM confi guration • Work with PAM modules common to various operating systems • Use PAM services for authentication in applications • Mount encrypted home directories, automatically load SSH, and work with directory The Definitive Guide to PAM for Linux SysAdmins and services like Winbind and LDAP K e C Developers • Restrict access to r-services and limit resources used by users n n • Extend PAM’s functionality by developing new modules and PAM-aware applications e th • Create custom PAM modules in C using the PAM API G e A comprehensive and practical guide to PAM for Linux: is s h how modules work and how to implement them ir $ 19.99 US Packt Publishing t £ 12.99 UK Birmingham - Mumbai € 17.99 EU www.packtpub.com Prices do not include local sales tax or VAT Kenneth Geisshirt where applicable www.it-ebooks.info Pluggable Authentication Modules The Definitive Guide to PAM for Linux SysAdmins and C Developers A comprehensive and practical guide to PAM for Linux: how modules work and how to implement them Kenneth Geisshirt BIRMINGHAM - MUMBAI www.it-ebooks.info Pluggable Authentication Modules The Definitive Guide to PAM for Linux SysAdmins and C Developers Copyright © 2007 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, Packt Publishing, nor its dealers or distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. First published: January 2007 Production Reference: 1211206 Published by Packt Publishing Ltd. 32 Lincoln Road Olton Birmingham, B27 6PA, UK. ISBN 978-1-904811-32-9 www.packtpub.com Cover Image by www.visionwt.com www.it-ebooks.info Credits Author Project Manager Kenneth Geisshirt Patricia Weir Reviewers Indexer Ralf Hildebrandt Bhushan Pangaonkar Huang Zhen Proofreaders Development Editor Martin Brooks Louay Fatoohi Chris Smith Assistant Development Editor Layouts and Illustrations Nikhil Bangera Shantanu Zagade Manjiri Nadkarni Technical Editor Mithil Kulkarni Cover Designer Shantanu Zagade Editorial Manager Dipali Chittar www.it-ebooks.info About the Author Kenneth Geisshirt is a chemist by education, and is a strong free software advocate. He spent his Christmas holidays in 1992 installing SLS Linux, and GNU/Linux has been his favorite operating systems ever since. Currently, he does consultancy work in areas like scientific computing and Linux clusters. He lives in Copenhagen, Denmark with his partner and their two children. You can find him at http://kenneth.geisshirt.dk/. www.it-ebooks.info About the Reviewers Ralf Hildebrandt is an active and well-known figure in the Postfix community, working as a systems engineer for T-Systems, a German telecommunications company. He speaks about Postfix at industry conferences and hacker conventions and contributes regularly to a number of open source mailing lists. Ralf Hildebrandt is co-author of The Book of Postfix. Huang Zhen is a software engineer at IBM China Development Labs. He has been working on the Linux-HA project since 2004 and contributed several components to the project. PAM-related functions in the Linux-HA project were developed by him. www.it-ebooks.info www.it-ebooks.info Table of Contents Preface 1 Chapter 1: Introduction to PAM 7 History of PAM 7 PAM Solves the Authentication Problem 8 Need for PAM 9 Installing Linux-PAM 9 Downloading 10 Compiling 10 Extra Modules 12 PAM Implementations 12 Summary 14 Chapter 2: Theory of Operation 15 PAM File System Layout 15 The PAM Framework 17 Online Documentation 19 Services 20 Management Groups 22 The Auth Group 23 The Account Group 24 The Session Group 25 The Password Group 25 Stacking 26 Control Flags 26 Requisite 27 Required 27 Sufficient 27 Optional 28 Order matters 28 www.it-ebooks.info Table of Contents Consolidating Your PAM Configuration 29 Securing Your Environment 32 An Example 32 Summary 35 Chapter 3: Testing and Debugging 37 Where to Test? 37 Leaving a Back Door Open 38 Test Cases 39 Getting Backstage 40 Enabling Logging 40 Reading the Log 42 The pamtester Utility 44 Automating PAM Tests 46 Bad Example 47 Summary 49 Chapter 4: Common Modules 51 Parameters 51 debug 52 use_first_pass 53 try_first_pass 55 expose_account 55 Modules Related to User Environments 56 pam_mkhomedir 56 pam_mount 57 Modules Used to Restrict Access 58 pam_succeed_if 58 pam_nologin 59 pam_wheel 60 pam_access 60 pam_deny 61 Modules Related to Back-End Storage 62 pam_unix 62 pam_winbind 63 pam_ldap 63 pam_mysql 64 Summary 65 Chapter 5: Recipes 67 Encrypted Home Directories 67 Working with Secure Shell 68 Apache htaccess Made Smart 71 [ ii ] www.it-ebooks.info Table of Contents Directory Services 72 Winbind 73 Overview 73 Winbind Configuration 75 Kerberos 76 Joining the Directory 77 Finally PAM 78 LDAP 80 Installation 81 The LDAP Client 81 The Name Service Switch 82 PAM Configuration 82 Limiting r-Services 83 Limiting Resources 85 Summary 87 Chapter 6: Developing with PAM 89 PAM-aware Applications 89 Opening and Closing a PAM Session 91 Authenticating the User 92 Account Health Check 93 Manipulating the PAM Handling Data Structure 93 Conversation Functions 94 Working with Error Messages 95 Developing your Own PAM Modules 95 The Management Groups 96 Return Codes 97 Supporting Functions 98 Compiling 99 Summary 100 Appendix A: Source code 101 Vault – Secure Database 101 The ssh_tunnels Module 103 Index 107 [ iii ] www.it-ebooks.info