Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual page 674

Chapter 43. Securing Your Network
pam_timestamp.so is in effect leaves the machine open to manipulation by anyone with physical
access to the console.
In the PAM timestamp scheme, the graphical administrative application prompts the user for the root
password when it is launched. When the user has been authenticated, the pam_timestamp.so
module creates a timestamp file. By default, this is created in the /var/run/sudo/ directory. If
the timestamp file already exists, graphical administrative programs do not prompt for a password.
Instead, the pam_timestamp.so module freshens the timestamp file, reserving an extra five minutes
of unchallenged administrative access for the user.
You can verify the actual state of the timestamp file by inspecting the /var/run/sudo/<user> file.
For the desktop, the relevant file is unknown:root. If it is present and its timestamp is less than five
minutes old, the credentials are valid.
The existence of the timestamp file is indicated by an authentication icon, which appears in the
notification area of the panel.
Figure 43.7. The Authentication Icon
43.4.6.1. Removing the Timestamp File
Before abandoning a console where a PAM timestamp is active, it is recommended that the timestamp
file be destroyed. To do this from a graphical environment, click the authentication icon on the panel.
This causes a dialog box to appear. Click the Forget Authorization button to destroy the active
timestamp file.
Figure 43.8. Dismiss Authentication Dialog
You should be aware of the following with respect to the PAM timestamp file:
• If logged in to the system remotely using ssh, use the /sbin/pam_timestamp_check -k root
command to destroy the timestamp file.
• You need to run the /sbin/pam_timestamp_check -k root command from the same terminal
window from which you launched the privileged application.
• You must be logged in as the user who originally invoked the pam_timestamp.so module in
order to use the /sbin/pam_timestamp_check -k command. Do not log in as root to use this
command.
• If you want to kill the credentials on the desktop (without using the Forget Authorization action on
the icon), use the following command:
648