Pam And Administrative Credential Caching; Removing The Timestamp File; Directives - Red Hat ENTERPRISE LINUX 4.5.0 Reference Manual

Chapter 16. Pluggable Authent...

6. PAM and Administrative Credential Caching

A variety of graphical administrative tools under Red Hat Enterprise Linux give users elevated
privileges for up to five minutes via the
how this mechanism works because a user who walks away from a terminal while
is in effect leaves the machine open to manipulation by anyone with
pam_timestamp.so
physical access to the console.
Under the PAM timestamp scheme, the graphical administrative application prompts the user for
the root password when it is launched. Once authenticated, the
creates a timestamp file within the
already exists, other graphical administrative programs do not prompt for a password. Instead,
the
pam_timestamp.so
unchallenged administrative access for the user.
The existence of the timestamp file is denoted by an authentication icon in the notification area
of the panel. Below is an illustration of the authentication icon:
Figure 16.1. The Authentication Icon

6.1. Removing the Timestamp File

It is recommended that before walking away from a console where a PAM timestamp is active,
the timestamp file be destroyed. To do this from within a graphical environment, click on the
authentication icon on the panel. When a dialog box appears, click on the Forget Authorization
button.
Figure 16.2. Authentication Icon Dialog
If logged into a system remotely using
command to destroy the timestamp file.
Note
You must be logged in as the user who originally invoked the
module in order to use the
in as root to issue this command.
For information about destroying the timestamp file using
pam_timestamp_check
6.2. Common
pam_timestamp
304
pam_timestamp.so
/var/run/sudo/
module freshens the timestamp file — reserving an extra five minutes of
, use the
ssh
/sbin/pam_timestamp_check
man page.

Directives

module. It is important to understand
pam_timestamp.so
directory by default. If the timestamp file
/sbin/pam_timestamp_check -k root
command. Do not log
pam_timestamp_check
module
pam_timestamp.so
, refer to the