Sample Pam Configuration Files - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 43. Securing Your Network
The following is a typical pam_userdb.so line in a PAM configuration. The <path-to-file> is the
full path to the Berkeley DB database file:
auth required pam_userdb.so db=<path-to-file>
Invalid arguments are generally ignored and do not otherwise affect the success or failure of the PAM
module. Some modules, however, may fail on invalid arguments. Most modules report errors to the /
var/log/secure file.

43.4.4. Sample PAM Configuration Files

The following is a sample PAM application configuration file:
#%PAM-1.0
auth required pam_securetty.so
auth required pam_unix.so nullok
auth required pam_nologin.so
account required pam_unix.so
password required pam_cracklib.so retry=3
password required pam_unix.so shadow nullok use_authtok
session required pam_unix.so
• The first line is a comment, indicated by the hash mark (#) at the beginning of the line.
• Lines two through four stack three modules for login authentication.
auth required pam_securetty.so — This module ensures that if the user is trying to log in as
root, the tty on which the user is logging in is listed in the /etc/securetty file, if that file exists.
If the tty is not listed in the file, any attempt to log in as root fails with a Login incorrect
message.
auth required pam_unix.so nullok — This module prompts the user for a password and
then checks the password using the information stored in /etc/passwd and, if it exists, /etc/
shadow.
In the authentication phase, the pam_unix.so module automatically detects whether the user's
password is in the passwd file or the shadow file. Refer to
more information.
• The argument nullok instructs the pam_unix.so module to allow a blank password.
• auth required pam_nologin.so — This is the final authentication step. It checks whether the
/etc/nologin file exists. If it exists and the user is not root, authentication fails.
Note
In this example, all three auth modules are checked, even if the first auth module
fails. This prevents the user from knowing at what stage their authentication failed. Such
knowledge in the hands of an attacker could allow them to more easily deduce how to
crack the system.
646
Section 33.6, "Shadow Passwords"
for