From ec88e446c21cb6848ddf697cb34ddf586ee14bba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dag-Erling=20Sm=C3=B8rgrav?= Date: Wed, 10 Dec 2003 16:26:44 +0000 Subject: [PATCH] Old uncommitted changes: improve the configuration section, and add descriptions for more modules. --- en_US.ISO8859-1/articles/pam/article.sgml | 178 +++++++++++++--------- 1 file changed, 106 insertions(+), 72 deletions(-) diff --git a/en_US.ISO8859-1/articles/pam/article.sgml b/en_US.ISO8859-1/articles/pam/article.sgml index 9f81155977..4f9da9604c 100644 --- a/en_US.ISO8859-1/articles/pam/article.sgml +++ b/en_US.ISO8859-1/articles/pam/article.sgml @@ -389,11 +389,13 @@ sshd password required pam_permit.so +This section has not yet been written. + This section has not yet been written. +-->
@@ -750,87 +752,99 @@ sshd password required pam_permit.so
PAM Configuration -
- Location of - configuration files +
+ PAM policy files - The traditional PAM configuration file is - /etc/pam.conf. This file contains all - the PAM policies for your system. Each line of the file - describes one step in a chain, as shown below: +
+ The + <filename>/etc/pam.conf</filename> file + + The traditional PAM policy file is + /etc/pam.conf. This file contains all + the PAM policies for your system. Each line of the file + describes one step in a chain, as shown below: login auth required pam_nologin.so no_warn - The fields are, in order: service name, facility name, - control flag, module name, and module arguments. Any - additional fields are interpreted as additional module - arguments. + The fields are, in order: service name, facility name, + control flag, module name, and module arguments. Any + additional fields are interpreted as additional module + arguments. - A separate chain is constructed for each service / - facility pair, so while the order in which lines for the same - service and facility appear is significant, the order in which - the individual services and facilities are listed is - not—except that entries for the other - service, which serves as a fall-back, should come last. The - examples in the original PAM paper grouped configuration lines - by facility, and the &solaris; stock pam.conf - still does that, but FreeBSD's stock configuration groups - configuration lines by service. Either way is fine; either - way makes equal sense. + A separate chain is constructed for each service / + facility pair, so while the order in which lines for the + same service and facility appear is significant, the order + in which the individual services and facilities are listed + is not. The examples in the original PAM paper grouped + configuration lines by facility, and the &solaris; stock + pam.conf still does that, but FreeBSD's + stock configuration groups configuration lines by service. + Either way is fine; either way makes equal sense. +
- OpenPAM and Linux-PAM offer an alternate configuration - mechanism, where policies are contained in separate files, - named for the service they apply to, in - /etc/pam.d/, with only four fields - instead of five—the service name field is omitted. This - is the preferred mechanism in FreeBSD 5.x. Note, however, - that if /etc/pam.conf exists, and - contains configuration statements for services which do not - have a specific policy in /etc/pam.d/, it - will be used as a fall-back for these services. +
+ The + <filename>/etc/pam.d</filename> directory - The great advantage of /etc/pam.d/ - over /etc/pam.conf is that it is possible - to use the same policy for multiple services by linking each - service name to a same policy file. For instance, to use the - same policy for the su and - sudo services, one could do as - follows: + OpenPAM and Linux-PAM support an alternate configuration + mechanism, which is the preferred mechanism in FreeBSD. In + this scheme, each policy is contained in a separate file + bearing the name of the service it applies to. These files + are stored in /etc/pam.d/. + + These per-service policy files have only four fields + instead of pam.conf's five: the service + name field is omitted. Thus, instead of the sample + pam.conf line from the previous + section, one would have the following line in + /etc/pam.d/login: + +auth required pam_nologin.so no_warn + + As a consequence of this simplified syntax, it is + possible to use the same policy for multiple services by + linking each service name to a same policy file. For + instance, to use the same policy for the + su and sudo services, + one could do as follows: &prompt.root; cd /etc/pam.d &prompt.root; ln -s su sudo - This works because the service name is determined from the - file name rather than specified in the policy file, so the - same file can be used for multiple differently-named - services. + This works because the service name is determined from + the file name rather than specified in the policy file, so + the same file can be used for multiple differently-named + services. - One other advantage is that third-party software can - easily install policies for their services without the need to - edit /etc/pam.conf. True to the FreeBSD - tradition, OpenPAM will even look for policy files in - /usr/local/etc/pam.d/ if no configuration - for the requested service is present in - /etc/pam.d/ or - /etc/pam.conf. + Since each service's policy is stored in a separate + file, the pam.d mechanism also makes it + very easy to install additional policies for third-party + software packages. +
- Finally, whichever configuration mechanism you choose, the - magic policy other is used - as a fall-back for any service that does not have its own - policy. +
+ The policy search + order + + As we have seen above, PAM policies can be found in a + number of places. What happens if policies for the same + service exist in multiple places? + + It is essential to understand that PAM's configuration + system is centered on chains. + +
Breakdown of a configuration line - As explained in the section, - each line in /etc/pam.conf consists of - four or more fields: the service name, the facility name, the - control flag, the module name, and zero or more module - arguments. + As explained in the section, each line in + /etc/pam.conf consists of four or more + fields: the service name, the facility name, the control flag, + the module name, and zero or more module arguments. The service name is generally (though not always) the name of the application the statement applies to. If you are @@ -996,12 +1010,6 @@ sshd password required pam_permit.so time which mounts the user's home directory.
-
- &man.pam.ftp.8; - - The &man.pam.ftp.8; module -
-
&man.pam.ftpusers.8; @@ -1019,6 +1027,17 @@ sshd password required pam_permit.so certain groups of users from a particular service.
+
+ &man.pam.guest.8; + + The &man.pam.guest.8; module allows guest logins using + fixed login names. Various requirements can be placed on the + password, but the default behaviour is to allow any password + as long as the login name is that of a guest account. The + &man.pam.guest.8; module can easily be used to implement + anonymous FTP logins. +
+
&man.pam.krb5.8; @@ -1040,13 +1059,19 @@ sshd password required pam_permit.so
&man.pam.login.access.8; - The &man.pam.login.access.8; module + The &man.pam.login.access.8; module provides an + implementation of the account management primitive which + enforces the login restrictions specified in the + &man.login.access.5; table.
&man.pam.nologin.8; - The &man.pam.nologin.8; module + The &man.pam.nologin.8; module refuses non-root logins + when /var/run/nologin exists. This file + is normally created by &man.shutdown.8; when less than five + minutes remain until the scheduled shutdown time.
@@ -1139,7 +1164,16 @@ sshd password required pam_permit.so
&man.pam.ssh.8; - The &man.pam.ssh.8; module + The &man.pam.ssh.8; module provides both authentication + and session services. The authentication service allows users + who have passphrase-protected SSH secret keys in their + ~/.ssh directory to authenticate + themselves by typing their passphrase. The session service + starts &man.ssh-agent.1; and preloads it with the keys that + were decrypted in the authentication phase. This feature is + particularly useful for local logins, whether in X (using + &man.xdm.1; or another PAM-aware X login manager) or at the + console.