Pluggable Authentication Modules (Pam); Advantages Of Pam; Pam Configuration Files; Pam Configuration File Format - Red Hat ENTERPRISE LINUX 3 Reference Manual

Pluggable Authentication Modules (PAM)

Programs which grant users access to a system verify each user's identity through a process called
authentication. Historically, each such program had its own way of performing the task of authen-
tication. Under Red Hat Enterprise Linux, many such programs are configured to use a centralized
authentication mechanism called Pluggable Authentication Modules or PAM.
PAM uses a pluggable, modular architecture, which affords the system administrator a great deal of
flexibility in setting authentication policies for the system.
In most situations, the default PAM configuration file for a PAM-aware application is sufficient. How-
ever, sometimes it may become necessary to edit a PAM configuration file. Because misconfiguration
of PAM can compromise system security, it is important to understand the structure of these files
before making any modifications (refer to Section 15.3 PAM Configuration File Format for more
information).

15.1. Advantages of PAM

PAM offers the following advantages:
It provides a common authentication scheme that can be used with a wide variety of applications.
•
It allows a large amount of flexibility and control over authentication for both system administrators
•
and application developers.
It allows application developers to develop programs without creating their own authentication
•
scheme.
15.2. PAM Configuration Files
The directory
/etc/pam.d/
In earlier versions of PAM, the file
only used if the
/etc/pam.d/
15.2.1. PAM Service Files
Each PAM-aware application or service has a file within the
this directory bears the name of the service for which it controls access.
It is up to the PAM-aware program to define its service name and install its own PAM configuration
file in the
/etc/pam.d/
and installs the
/etc/pam.d/login
15.3. PAM Configuration File Format
Each PAM configuration file contains a group of directives formatted as follows:
module interface
Each of these elements are explained in the subsequent sections.
contains the PAM configuration files for each PAM-aware application.
/etc/pam.conf
directory does not exist.
directory. For example, the
PAM configuration file.
control flag
was used, but this file is now deprecated and is
/etc/pam.d/
program defines its service name as login
login
module name
Chapter 15.
directory. Each file within
module arguments