Red Hat ENTERPRISE LINUX 3 Reference Manual page 248

230
15.3.1. Module Interface
There are four types of PAM module interfaces which correlate to different aspects of the authorization
process:
— This module interface authenticates the use. For example, it asks for and verifies the valid-
• auth
ity of a password. Modules with this interface can also set credentials, such as group memberships
or Kerberos tickets.
— This module interface verifies that access is allowed. For example, it may check if a
• account
user account is expired or is allowed to log in at a particular time of day.
— This module interface sets and verifies passwords.
• password
— This module interface configures and manages user sessions. Modules with this inter-
• session
face can also perform additional tasks that are needed to allow access, like mounting a user's home
directory and making the user's mailbox available.
Note
An individual module can provide any or all module interfaces. For instance,
all four module interfaces.
In a PAM configuration file, the module interface is the first field defined. For example a typical line
in a configuration may look like this:
auth required
This instructs PAM to use the
15.3.1.1. Stacking Module Interfaces
Module interface directives can be stacked, or placed upon one another, so that multiple modules
are used together for one purpose. For this reason, the order in which the modules are listed is very
important to the authentication process.
Stacking makes it very easy for an administrator to require specific conditions to exist before allowing
the user to authenticate. For example,
its PAM configuration file:
auth required
auth required
auth required
auth sufficient
auth required
Before someone is allowed to use
that they are not trying to log in remotely as a root user over a network connection, and that any
environmental variables can be loaded. Then, if a successful
connection is allowed. If the
performed.
Chapter 15. Pluggable Authentication Modules (PAM)
pam_unix.so
pam_unix.so
rlogin
pam_nologin.so
pam_securetty.so
pam_env.so
pam_rhosts_auth.so
pam_stack.so service=system-auth
, PAM verifies that the
rlogin
authentication fails, then standard password authentication is
rhosts
module's interface.
auth
normally uses five stacked
/etc/nologin
rhosts
pam_unix.so
modules, as seen in
auth
file does not exist,
authentication is performed, the
provides