Linux-PAM-1.3.0

#### Beyond Linux® From Scratch - Version 2019-02-27

### Chapter 4. Security

- Prev

  libcap-2.26 with PAM

- Next

  liboauth-1.0.3

- Up
- Home

# Linux-PAM-1.3.0

## Introduction to Linux PAM

The Linux PAM package contains Pluggable Authentication Modules used to enable the local system administrator to choose how applications authenticate users.

This package is known to build and work properly using an LFS-8.4 platform.

### Package Information

- Download (HTTP): http://linux-pam.org/library/Linux-PAM-1.3.0.tar.bz2

- Download MD5 sum: da4b2289b7cfb19583d54e9eaaef1c3a

- Download size: 1.3 MB

- Estimated disk space required: 28 MB (with tests)

- Estimated build time: 0.5 SBU (with tests)

### Additional Downloads

Optional Documentation

- Download (HTTP): http://linux-pam.org/documentation/Linux-PAM-1.2.0-docs.tar.bz2

- Download MD5 sum: 558378b8be9b8b5c987326f4529f2130

- Download size 480 KB

### Linux PAM Dependencies

#### Optional

Berkeley DB-5.3.28, CrackLib-2.9.6, libtirpc-1.1.4 and Prelude

#### Optional (To Rebuild the Documentation)

docbook-xml-4.5, docbook-xsl-1.79.2, fop-2.3, libxslt-1.1.33 and either w3m-0.5.3 or elinks (but with a link calling it 'links') and remove the documentation switch.

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/linux-pam

## Installation of Linux PAM

If you downloaded the documentation, unpack the tarball by issuing the following command.

    tar -xf ../Linux-PAM-1.2.0-docs.tar.bz2 --strip-components=1

Install Linux PAM by running the following commands:

    ./configure --prefix=/usr                    \
                --sysconfdir=/etc                \
                --libdir=/usr/lib                \
                --disable-regenerate-docu        \
                --enable-securedir=/lib/security \
                --docdir=/usr/share/doc/Linux-PAM-1.3.0 &&
    make

To test the results, a suitable `/etc/pam.d/other` configuration file must exist.

### Reinstallation or upgrade of Linux PAM

If you have a system with Linux PAM installed and working, be careful when modifying the files in `/etc/pam.d`, since your system may become totally unusable. If you want to run the tests, you do not need to create another `/etc/pam.d/other` file. The installed one can be used for that purpose.

You should also be aware that make install overwrites the configuration files in `/etc/security` as well as `/etc/environment`. In case you have modified those files, be sure to back them up.

For a first installation, create the configuration file by issuing the following commands as the `root` user:

    install -v -m755 -d /etc/pam.d &&

    cat > /etc/pam.d/other << "EOF"
    auth     required       pam_deny.so
    account  required       pam_deny.so
    password required       pam_deny.so
    session  required       pam_deny.so
    EOF

Now run the tests by issuing make check. Ensure there are no errors produced by the tests before continuing the installation. Note that the checks are quite long. It may be useful to redirect the output to a log file in order to inspect it thoroughly.

Only in case of a first installation, remove the configuration file created earlier by issuing the following command as the `root` user:

    rm -fv /etc/pam.d/*

Now, as the `root` user:

    make install &&
    chmod -v 4755 /sbin/unix_chkpwd &&

    for file in pam pam_misc pamc
    do
      mv -v /usr/lib/lib${file}.so.* /lib &&
      ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
    done

## Command Explanations

`--enable-securedir=/lib/security`: This switch sets install location for the PAM modules.

`--disable-regenerate-docu` : This switch prevents this version of the package trying to build its documentation, and failing, if the required dependencies except w3m-0.5.3 are present, but Links-2.18 is present. Remove this switch if you have installed w3m (or elinks, with a link so it can be invoked as 'links').

chmod -v 4755 /sbin/unix_chkpwd: The unix_chkpwd helper program must be setuid so that non-`root` processes can access the shadow file.

## Configuring Linux-PAM

### Config Files

`/etc/security/*` and `/etc/pam.d/*`

### Configuration Information

Configuration information is placed in `/etc/pam.d/`. Below is an example file:

    # Begin /etc/pam.d/other

    auth            required        pam_unix.so     nullok
    account         required        pam_unix.so
    session         required        pam_unix.so
    password        required        pam_unix.so     nullok

    # End /etc/pam.d/other

Now set up some generic files. As root:

    install -vdm755 /etc/pam.d &&
    cat > /etc/pam.d/system-account << "EOF" &&
    # Begin /etc/pam.d/system-account

    account   required    pam_unix.so

    # End /etc/pam.d/system-account
    EOF

    cat > /etc/pam.d/system-auth << "EOF" &&
    # Begin /etc/pam.d/system-auth

    auth      required    pam_unix.so

    # End /etc/pam.d/system-auth
    EOF

    cat > /etc/pam.d/system-session << "EOF"
    # Begin /etc/pam.d/system-session

    session   required    pam_unix.so

    # End /etc/pam.d/system-session
    EOF

The remaining generic file depends on whether CrackLib-2.9.6 is installed. If it is installed, use:

    cat > /etc/pam.d/system-password << "EOF"
    # Begin /etc/pam.d/system-password

    # check new passwords for strength (man pam_cracklib)
    password  required    pam_cracklib.so    authtok_type=UNIX retry=1 difok=5 \
                                             minlen=9 dcredit=1 ucredit=1 \
                                             lcredit=1 ocredit=1 minclass=0 \
                                             maxrepeat=0 maxsequence=0 \
                                             maxclassrepeat=0 \
                                             dictpath=/lib/cracklib/pw_dict
    # use sha512 hash for encryption, use shadow, and use the
    # authentication token (chosen password) set by pam_cracklib
    # above (or any previous modules)
    password  required    pam_unix.so        sha512 shadow use_authtok

    # End /etc/pam.d/system-password
    EOF

### Note

In its default configuration, pam_cracklib will allow multiple case passwords as short as 6 characters, even with the `minlen` value set to 11. You should review the pam_cracklib(8) man page and determine if these default values are acceptable for the security of your system.

If CrackLib-2.9.6 is NOT installed, use:

    cat > /etc/pam.d/system-password << "EOF"
    # Begin /etc/pam.d/system-password

    # use sha512 hash for encryption, use shadow, and try to use any previously
    # defined authentication token (chosen password) set by any prior module
    password  required    pam_unix.so       sha512 shadow try_first_pass

    # End /etc/pam.d/system-password
    EOF

Now add a restrictive `/etc/pam.d/other` configuration file. With this file, programs that are PAM aware will not run unless a configuration file specifically for that application is created.

    cat > /etc/pam.d/other << "EOF"
    # Begin /etc/pam.d/other

    auth        required        pam_warn.so
    auth        required        pam_deny.so
    account     required        pam_warn.so
    account     required        pam_deny.so
    password    required        pam_warn.so
    password    required        pam_deny.so
    session     required        pam_warn.so
    session     required        pam_deny.so

    # End /etc/pam.d/other
    EOF

The PAM man page (man pam) provides a good starting point for descriptions of fields and allowable entries. The Linux-PAM System Administrators' Guide is recommended for additional information.

Refer to http://debian.securedservers.com/kernel/pub/linux/libs/pam/modules.html for a list of various third-party modules available.

### Important

You should now reinstall the Shadow-4.6 package.

## Contents

Installed Program: mkhomedir_helper, pam_tally, pam_tally2, pam_timestamp_check, unix_chkpwd and unix_update
Installed Libraries: libpam.so, libpamc.so and libpam_misc.so
Installed Directories: /etc/security, /lib/security, /usr/include/security and /usr/share/doc/Linux-PAM-1.3.0

### Short Descriptions

mkhomedir_helper | is a helper binary that creates home directories.
pam_tally | is used to interrogate and manipulate the login counter file.
pam_tally2 | is used to interrogate and manipulate the login counter file, but does not have some limitations that pam_tally does.
pam_timestamp_check | is used to check if the default timestamp is valid
unix_chkpwd | is a helper binary that verifies the password of the current user.
unix_update | is a helper binary that updates the password of a given user.
`libpam.so` | provides the interfaces between applications and the PAM modules.

Last updated on 2019-02-15 15:01:29 -0600

- Prev

  libcap-2.26 with PAM

- Next

  liboauth-1.0.3

- Up
- Home