Red Hat LINUX 7.2 Reference Manual page 132

132
Each application (or service, as applications designed to be used by many users are commonly known)
has its own file. Each line in the file has five elements: service name, module type, control flag,
module path, and arguments.
7.2.1 PAM Service Names
The service name of every PAM-enabled application is the name of its configuration file in
/etc/pam.d. Each program which uses PAM defines its own service name.
For example, the login program defines the service name login, ftpd defines the service name
ftp, and so on.
In general, the service name is the name of the program used to access the service, not the program
used to provide the service.
7.2.2 PAM Modules
PAM includes four different types of modules for controlling access to a particular service:
• An auth module provides the actual authentication (perhaps asking for and checking a password)
and sets credentials, such as group membership or Kerberos tickets.
• An account module checks to make sure that access is allowed for the user (the account has not
expired, the user is allowed to log in at this time of day, and so on).
• A password module is used to set passwords.
• A session module is used after a user has been authenticated. A session module performs
additional tasks which are needed to allow access (for example, mounting the user's home direc-
tory or making their mailbox available).
These modules may be stacked, or placed upon one another, so that multiple modules are used. The
order of a module stack is very important in the authentication process, because it makes it very easy
for an administrator to require that several conditions exist before allowing user authentication to oc-
cur.
For example, rlogin normally uses at least four stacked authentication methods, as can be seen in
its PAM configuration file:
auth
auth
auth
auth
auth
account
password
session
Chapter 7:Pluggable Authentication Modules (PAM)
required /lib/security/pam_nologin.so
required /lib/security/pam_securetty.so
required /lib/security/pam_env.so
sufficient /lib/security/pam_rhosts_auth.so
required /lib/security/pam_stack.so service=system-auth
required /lib/security/pam_stack.so service=system-auth
required /lib/security/pam_stack.so service=system-auth
required /lib/security/pam_stack.so service=system-auth