Home > Article > Operation and Maintenance > What does linux pam mean?
What does linux pam mean?
- 青灯夜游Original
- 2023-04-21 19:05:143044browse
In Linux, PAM refers to the dynamically loadable verification module. It is a set of shared libraries that allow local system administrators to choose the authentication method of the program at will; because the verification content can be dynamically changed as needed. , so the flexibility of verification can be greatly improved. PAM uses the configuration file under "/etc/pam.d/" to manage the authentication method of the program. The application calls the corresponding configuration file to call the local authentication module.
#The operating environment of this tutorial: linux7.3 system, Dell G3 computer.
When executing some programs in Linux, these programs must first authenticate the user who starts them before execution, and only allow execution after meeting certain requirements, such as login, su, etc. The identity or status verification process in Linux is performed by PAM, PAM (Pluggable Authentication Modules) can dynamically load the verification module, because the verification content can be dynamically changed as needed, so The flexibility of verification can be greatly improved.
1. Introduction to PAM module
Linux-PAM (linux pluggable authentication module) is a set of shared libraries that enable local system management Members are free to choose how the program is authenticated. In other words, you can change the authentication mechanism it uses without recompiling (rewriting) an application that contains PAM functionality. In this way, even if the local authentication mechanism is upgraded, the program does not need to be modified.
PAM uses the files under configuration /etc/pam.d/ to manage the authentication method of the program. The application calls the corresponding configuration file to call the local authentication module. The module is placed under /lib/security and loaded as a dynamic library. When we use the su command, the system will prompt you to enter the password of the root user. This is what the su command does by calling the PAM module.
PAM module types
Linux-PAM has four module types, which represent four different tasks. They are:
Authentication management(auth)
- ##Account management(account)
- Session management(session)
- Password management
vi /etc/pam.d/system-authAs shown below: The configuration is basically divided into four columns: module name, control, module library file and parameters.
- auth module: used to identify the user's identity. For example: prompt the user to enter a password, or determine whether the user is root, etc.
- auth module: Check various attributes of the account. For example: whether login is allowed, whether the maximum number of users has been reached, or whether the root user is allowed to log in from this terminal, etc.
- session module: This module is used to define the operations to be performed before the user logs in and after the user logs out. Such as: login connection information, opening and closing of user data, mounting file systems, etc.
- password module: Update with user information. For example: change user password.
2. PAM configuration file description
PAM configuration file has the following two ways of writing:1 ) is written in the /etc/pam.conf file, but in systems after centos6, this file no longer exists.
2) Place the PAM configuration file in the
/etc/pam.d/ directory. Its rule content does not contain the service part, that is, it does not contain the service name, and /etc/pam. The name of the file in the d directory is the service name. Such as: vsftpd, login, etc., but the leftmost service list is missing. Such as: /etc/pam.d/sshd
[root@centos6-test06 ~]# cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_sepermit.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth
Judging from the contents of the pam module file above, we can divide the pam configuration file into four columns,
- The first column represents the module type
- The second column represents the control tag
- The third column represents the module path
- The fourth column represents the module parameters
1) First column: PAM module type
Linux-PAM has four module types, representing four different tasks, they are:
Authentication management (auth) , Account management (account) , Session management (session) and Password (password) management , a type may have multiple lines, they are in order In turn called by the PAM module.
Further explanation of the above four module types:
auth: Indicates the authentication interface module type used to check users and passwords, and assign permissions;
This type of module provides two services for user authentication. Let the application prompt the user for a password or other token to confirm the user's legitimacy; set group membership or other priorities through his credential permissions.
account: Represents the account class interface, mainly responsible for checking the legitimacy of the account, confirming whether the account has expired, whether there is permission to log in to the system, etc.;
This kind of module Non-authentication-based account management is performed. It is mainly used to limit/allow users to access a certain service, current effective system resources (maximum number of users), and limit user location (for example: root can only log in through the console).
In most cases, auth and account are used together to restrict users' login and use of services. Such restrictions would be more complete. For example, the following is a specific example: login is an application. Login has to complete two tasks - first query the user, and then provide the user with the required services, such as providing a shell program. Usually Login requires the user to enter a name and password for verification. When the user name is entered, the system will naturally compare whether the user is a legitimate user and whether it exists in the local or remote user database. If the account does exist, will it expire? These tasks are handled by the account interface.
If the user meets the above login prerequisites, then whether it has a password that can log in to the system, whether the password has expired, etc. This work is handled by the auth interface, which usually encrypts user password information and provides it to local (/etc/shadow) or remote (ldap, kerberos, etc.) password verification methods for verification.
If the user can log in successfully, it proves that the work of auth and account has been completed. But the whole verification process is not completely over. Because there are some other issues that have not been confirmed. For example, how many windows can the user open on the server to log in at the same time, how many terminals can the user use after logging in for how long, what resources can and cannot be accessed by the user, etc. In other words, subsequent verification and environment definition after login also require other interfaces. These are the two sets of interfaces we will mention below:
session: session class interface. Implement session control from successful user login to exit;
handle some things that need to be done before/after providing services to users. Including: turning on/off exchange data information, monitoring directories, etc., setting user session environment, etc. In other words, this is the last step before the system officially provides services.
password: Password class interface. Control the entire process of users changing passwords. This is what some information calls upgrading the user verification mark.
Note: When using the above interface, only one interface type can be specified in each line. If the program requires multiple interfaces, it can be specified in multiple lines. be stipulated separately.
2) Second column: PAM control tags
PAM uses control tags to process and determine the return value of each module. (In This only describes the simple certification mark).
规定如何处理PAM模块鉴别认证的结果，简而言之就是鉴别认证成功或者失败之后会发生什么事，如何进行控制。单个应用程序可以调用多种底层模块，通常称为“堆叠”。对应于某程序按照配置文件中出现顺序执行的所有模块成为“堆”，堆中的各模块的地位与出错时的处理方式由control_flag栏的取值决定，他的四种可能的取值分别为required、Requisite、sufficient或_optional：
required：表示该行以及所涉及模块的成功是用户通过鉴别的必要条件。换句话说，只有当对应于应用程序的所有带 required标记的模块全部成功后，该程序才能通过鉴别。同时，如果任何带required标记的模块出现了错误，PAM并不立刻将错误消息返回给应用程序，而是在所有模块都调用完毕后才将错误消息返回调用他的程序。 反正说白了，就是必须将所有的模块都执行一次，其中任何一个模块验证出错，验证都会继续进行，并在执行完成之后才返回错误信息。这样做的目的就是不让用户知道自己被哪个模块拒绝，通过一种隐蔽的方式来保护系统服务。就像设置防火墙规则的时候将拒绝类的规则都设置为drop一样，以致于用户在访问网络不成功的时候无法准确判断到底是被拒绝还是目标网络不可达。
requisite：与required相仿，只有带此标记的模块返回成功后，用户才能通过鉴别。不同之处在于其一旦失败就不再执行堆中后面的其他模块，并且鉴别过程到此结束，同时也会立即返回错误信息。与上面的required相比，似乎要显得更光明正大一些。
sufficient：表示该行以及所涉及模块验证成功是用户通过鉴别的充分条件。也就是说只要标记为sufficient的模块一旦验证成功，那么PAM便立即向应用程序返回成功结果而不必尝试任何其他模块。即便后面的层叠模块使用了requisite或者required控制标志也是一样。当标记为sufficient的模块失败时，sufficient模块会当做 optional对待。因此拥有sufficient 标志位的配置项在执行验证出错的时候并不会导致整个验证失败，但执行验证成功之时则大门敞开。所以该控制位的使用务必慎重。
optional：他表示即便该行所涉及的模块验证失败用户仍能通过认证。在PAM体系中，带有该标记的模块失败后将继续处理下一模块。也就是说即使本行指定的模块验证失败，也允许用户享受应用程序提供的服务。使用该标志，PAM框架会忽略这个模块产生的验证错误，继续顺序执行下一个层叠模块。
include：表示在验证过程中调用其他的PAM配置文件。在RHEL系统中有相当多的应用通过完整调用/etc/pam.d/system-auth来实现认证而不需要重新逐一去写配置项。这也就意味着在很多时候只要用户能够登录系统，针对绝大多数的应用程序也能同时通过认证。
另外还有一种比较复杂的格式为value = action的语法来设置控制标志，标志之间会以空格分开。格式如下：
value1 = action1 value2 = action2 ……
其中value可以是下列Linux PAM库的返回值：
success、open_err、symbol_err、service_err、 system_err、buf_err、perm_denied、auth_err、cred_insufficient、authinfo_unavail、user_unknown、maxtries、new_authtok_reqd、acct_expired、 session_err、cred_unavail、cred_expired、cred_err、no_module_data、conv_err、 authtok_err、authtok_recover_err、authtok_lock_busy、authtok_disable_aging、 try_again、ignore、abort、authtok_expired、module_unknown、bad_item和default。
最后一个(default)能够用来设置上面的返回值无法表达的行为。
actionN可以是一个非负整数或者是下面的记号之一：ignore、ok、done、bad、die和reset。如果是非负整数J，就表示需要忽略后面J个同样类型的模块。通过这种方式，系统管理者可以更加灵活地设置层叠模块，模块的层叠路径由单个模块的反应决定。
关于这几个记号的详细解释：
ignore：如果使用层叠模块，那么这个模块的返回值将被忽略，不会被应用程序知道。
bad：他表示这个返回码应该被看作是模块验证失败的标志。如果这个模块是层叠模块的第一个验证失败的模块，那么他的状态值就是整个层叠模块验证的状态值和结果。
die：终止层叠模块验证过程，立刻返回到应用程序。
ok：告诉PAM这个模块的返回值将直接作为所有层叠模块的返回值。也就是说，如果这个模块前面的模块返回状态是PAM_SUCCESS，那这个返回值就会覆盖前面的返回状态。注意：如果前面的模块的返回状态表示模块验证失败，那么不能使用这个返回值再加以覆盖。
done：终止后续层叠模块的验证，把控制权立刻交回应用程序。
reset：清除所有层叠模块的返回状态，从下一个层叠模块重新开始验证。
3）模块路径
模块路径.即要调用模块的位置. 如果是64位系统，一般保存在/lib64/security,如: pam_unix.so，同一个模块,可以出现在不同的类型中.它在不同的类型中所执行的操作都不相同.这是由于每个模块，针对不同的模块类型,编制了不同的执行函数。
4）模块参数
模块参数,即传递给模块的参数.参数可以有多个,之间用空格分隔开,如:password required pam_unix.so nullok obscure min=4 max=8 md5。
三、PAM模块的工作原理和流程
以RHEL系统为例，当pam安装之后有两大部分：在/lib/security目录下的各种pam模块以及/etc/pam.d和/etc/pam.d目录下的针对各种服务和应用已经定义好的pam配置文件。当某一个有认证需求的应用程序需要验证的时候，一般在应用程序中就会定义负责对其认证的PAM配置文件。以vsftpd为例，在它的配置文件/etc/vsftpd/vsftpd.conf中就有这样一行定义：
pam_service_name=vsftpd
表示登录FTP服务器的时候进行认证是根据/etc/pam.d/vsftpd文件定义的内容进行。
那么，当程序需要认证的时候已经找到相关的pam配置文件，认证过程是如何进行的？下面我们将通过解读/etc/pam.d/system-auth文件予以说明。
首先要声明一点的是：system-auth是一个非常重要的pam配置文件，主要负责用户登录系统的认证工作。而且该文件不仅仅只是负责用户登录系统认证，其它的程序和服务通过include接口也可以调用到它，从而节省了很多重新自定义配置的工作。所以应该说该文件是系统安全的总开关和核心的pam配置文件。
下面是/etc/pam.d/system-auth文件的全部内容：
[root@centos6-test06 ~]# grep -v ^# /etc/pam.d/system-auth auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so
第一部分表示，当用户登录的时候，首先会通过auth类接口对用户身份进行识别和密码认证。所以在该过程中验证会经过几个带auth的配置项。
其中的第一步是通过pam_env.so模块来定义用户登录之后的环境变量， pam_env.so允许设置和更改用户登录时候的环境变量，默认情况下，若没有特别指定配置文件，将依据/etc/security/pam_env.conf进行用户登录之后环境变量的设置。
然后通过pam_unix.so模块来提示用户输入密码，并将用户密码与/etc/shadow中记录的密码信息进行对比，如果密码比对结果正确则允许用户登录，而且该配置项的使用的是“sufficient”控制位，即表示只要该配置项的验证通过，用户即可完全通过认证而不用再去走下面的认证项。不过在特殊情况下，用户允许使用空密码登录系统，例如当将某个用户在/etc/shadow中的密码字段删除之后，该用户可以只输入用户名直接登录系统。
下面的配置项中，通过pam_succeed_if.so对用户的登录条件做一些限制，表示允许uid大于500的用户在通过密码验证的情况下登录，在Linux系统中，一般系统用户的uid都在500之内，所以该项即表示允许使用useradd命令以及默认选项建立的普通用户直接由本地控制台登录系统。
最后通过pam_deny.so模块对所有不满足上述任意条件的登录请求直接拒绝，pam_deny.so是一个特殊的模块，该模块返回值永远为否，类似于大多数安全机制的配置准则，在所有认证规则走完之后，对不匹配任何规则的请求直接拒绝。
第二部分的三个配置项主要表示通过account账户类接口来识别账户的合法性以及登录权限。
第一行仍然使用pam_unix.so模块来声明用户需要通过密码认证。第二行承认了系统中uid小于500的系统用户的合法性。之后对所有类型的用户登录请求都开放控制台。
第三部分会通过password口另类接口来确认用户使用的密码或者口令的合法性。第一行配置项表示需要的情况下将调用pam_cracklib来验证用户密码复杂度。如果用户输入密码不满足复杂度要求或者密码错，最多将在三次这种错误之后直接返回密码错误的提示，否则期间任何一次正确的密码验证都允许登录。需要指出的是，pam_cracklib.so是一个常用的控制密码复杂度的pam模块，关于其用法举例我们会在之后详细介绍。之后带pam_unix.so和pam_deny.so的两行配置项的意思与之前类似。都表示需要通过密码认证并对不符合上述任何配置项要求的登录请求直接予以拒绝。不过用户如果执行的操作是单纯的登录，则这部分配置是不起作用的。
第四部分主要将通过session会话类接口为用户初始化会话连接。其中几个比较重要的地方包括，使用pam_keyinit.so表示当用户登录的时候为其建立相应的密钥环，并在用户登出的时候予以撤销。不过该行配置的控制位使用的是optional，表示这并非必要条件。之后通过pam_limits.so限制用户登录时的会话连接资源，相关pam_limit.so配置文件是/etc/security/limits.conf，默认情况下对每个登录用户都没有限制。关于该模块的配置方法在后面也会详细介绍。
可见，不同应用程序通过配置文件在认证过程中调用不同的pam模块来定制具体的认证流程。其中我们不难看出，其实可以根据实际的需要对pam的配置文件进行修改以满足不同的认证需求，例如下面的例子：
#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_tally.so onerr=fail deny=5 auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 minlen=10 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 difok=6 password requisite pam_passwdqc.so use_first_pass enforce=everyone password sufficient pam_unix.so md5 remember=6 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so
In it, there are added restrictions on the complexity of user password modifications, lock restrictions after the user enters the password incorrectly multiple times, and user password history and other restriction options.
So by modifying the above system-auth configuration file, adding modules and changing options, we have increased the security requirements for user login verification to a great extent. We will explain this configuration in detail in a later article.
In addition, it must be noted that in the entire PAM configuration file, the logical sequence of configuration items and module calls is very critical. Because PAM performs verification according to the order of configuration items. Incorrect module calling sequence may cause serious security problems or even system errors. So be sure to consider this when modifying the PAM configuration.
4. Introduction to commonly used PAM modules
| PAM module | Combined management Type | Description | ||
| auth | Prompts the user for password, And compare it with the /etc/shadow file. The match returns 0 | |||
| Check the user's account information (including whether it has expired, etc.). The account is available When, return 0. | ||||
| Modify the user's password. Update the shadow file with the password entered by the user as the user's new password | ||||
| authaccount | If the user wants to log in to the system, then its shell must be in /etc/ shell||||
| accountauthpassword # in one of the shells files ##session This module can be used to deny access |
||||
| auth |
account password session The module returns success at any time. |
|||
| auth | If the user wants to log in as root, the logged-in tty must be in /etc/securetty. | |||
| auth |
account password session Control switch for accessing the application |
|||
| password | This module can be inserted into the password stack of a program and used to check the strength of the password. | |||
| session | Define the upper limit of system resource usage. The root user will also be subject to this restriction. It can be passed through /etc/security/limits.conf or /etc/security/limits.d/ *.conf to set | |||
The above is the detailed content of What does linux pam mean?. For more information, please follow other related articles on the PHP Chinese website!