Introduction to Linux PAM
The Linux PAM package contains
Pluggable Authentication Modules used by the local
system administrator to control how application programs authenticate
users.
![[Note]](../images/note.png)
Note
Development versions of BLFS may not build or run
some packages properly if LFS or dependencies have been updated
since the most recent stable versions of the books.
Package Information
Additional Downloads
Linux PAM Dependencies
Optional
libnsl-2.0.1,
libtirpc-1.3.4,
Berkeley DB (deprecated),
libaudit, and
Prelude
Note
Shadow-4.14.2
and Systemd-254
must be reinstalled
and reconfigured
after installing and configuring Linux PAM.
With Linux-PAM-1.4.0 and higher, the pam_cracklib module is not
installed by default. Use libpwquality-1.4.5
to enforce strong passwords.
Installation of Linux PAM
If you downloaded the documentation, unpack the tarball by issuing
the following command.
tar -xf ../Linux-PAM-1.5.3-docs.tar.xz --strip-components=1
Compile and link Linux PAM by
running the following commands:
./configure --prefix=/usr \
--sbindir=/usr/sbin \
--sysconfdir=/etc \
--libdir=/usr/lib \
--enable-securedir=/usr/lib/security \
--docdir=/usr/share/doc/Linux-PAM-1.5.3 &&
make
To test the results, a suitable /etc/pam.d/other
configuration file must exist.
![[Caution]](../images/caution.png)
Reinstallation or Upgrade of Linux PAM
If you have a system with Linux PAM installed and working, be careful
when modifying the files in
/etc/pam.d, since your system
may become totally unusable. If you want to run the tests, you do not
need to create another /etc/pam.d/other file. The
existing file can be used for the tests.
You should also be aware that make install
overwrites the configuration files in
/etc/security as well as
/etc/environment. If you
have modified those files, be sure to back them up.
For a first-time installation, create a configuration file by issuing the
following commands as the root
user:
install -v -m755 -d /etc/pam.d &&
cat > /etc/pam.d/other << "EOF"
auth required pam_deny.so
account required pam_deny.so
password required pam_deny.so
session required pam_deny.so
EOF
Now run the tests by issuing make check.
Be sure the tests produced no errors before continuing the
installation. Note that the tests are very long.
Redirect the output to a log file, so you can inspect it thoroughly.
For a first-time installation, remove the configuration file
created earlier by issuing the following command as the
root user:
rm -fv /etc/pam.d/other
Now, as the root
user:
make install &&
chmod -v 4755 /usr/sbin/unix_chkpwd
Command Explanations
--enable-securedir=/usr/lib/security:
This switch sets the installation location for the
PAM modules.
chmod -v 4755 /usr/sbin/unix_chkpwd:
The setuid bit for the unix_chkpwd helper program must be
turned on, so that non-root
processes can access the shadow file.
Configuring Linux-PAM
Configuration Files
/etc/security/* and
/etc/pam.d/*
Configuration Information
Configuration information is placed in
/etc/pam.d/.
Here is a sample file:
# Begin /etc/pam.d/other
auth required pam_unix.so nullok
account required pam_unix.so
session required pam_unix.so
password required pam_unix.so nullok
# End /etc/pam.d/other
Now create some generic configuration files. As the
root user:
install -vdm755 /etc/pam.d &&
cat > /etc/pam.d/system-account << "EOF" &&
# Begin /etc/pam.d/system-account
account required pam_unix.so
# End /etc/pam.d/system-account
EOF
cat > /etc/pam.d/system-auth << "EOF" &&
# Begin /etc/pam.d/system-auth
auth required pam_unix.so
# End /etc/pam.d/system-auth
EOF
cat > /etc/pam.d/system-session << "EOF" &&
# Begin /etc/pam.d/system-session
session required pam_unix.so
# End /etc/pam.d/system-session
EOF
cat > /etc/pam.d/system-password << "EOF"
# Begin /etc/pam.d/system-password
# use yescrypt hash for encryption, use shadow, and try to use any
# previously defined authentication token (chosen password) set by any
# prior module.
password required pam_unix.so yescrypt shadow try_first_pass
# End /etc/pam.d/system-password
EOF
If you wish to enable strong password support, install
libpwquality-1.4.5, and follow the
instructions on that page to configure the pam_pwquality
PAM module with strong password support.
Next, add a restrictive /etc/pam.d/other
configuration file. With this file, programs that are PAM aware will
not run unless a configuration file specifically for that application
exists.
cat > /etc/pam.d/other << "EOF"
# Begin /etc/pam.d/other
auth required pam_warn.so
auth required pam_deny.so
account required pam_warn.so
account required pam_deny.so
password required pam_warn.so
password required pam_deny.so
session required pam_warn.so
session required pam_deny.so
# End /etc/pam.d/other
EOF
The PAM man page (man
pam) provides a good starting point to learn
about the several fields, and allowable entries.
The
Linux-PAM System Administrators' Guide
is recommended for additional information.
![[Important]](../images/important.png)