Linux Pluggable Authentication Modules
lastmod 2020-11-18created 2020-11-184 edits
Linux Pluggable Authentication Modules (PAM), i.e. Linux PAM, provides dynamic authentication for applications and services on Linux or GNU/kFreeBSD systems.
Groups
Linux-PAM separates authentication tasks into four independent management groups.
- Account modules check whether the specified account is a valid authentication target under current conditions. This includes conditions such as account expiration, time, and whether the user has access to the requested service.
- Authentication modules verify the user's identity, for example by requesting and checking a password. They also pass authentication information on to other systems such as a keyring.
- Password modules are responsible for updating passwords. They are also used to enforce strong passwords.
- Session modules define actions performed at the start and end of a session. After that, the user is successfully authenticated.
Modules
- /lib/security/pam_securetty.so
- /lib/security/pam_listfile.so
- /lib/security/nologin.so
- /lib/security/pam_deny.so
- /lib/security/pam_cracklib.so (password policy)
- /lib/security/pam_wheel.so (only users in the wheel group can use the su command)
- /lib/security/pam_rootok.so
- /lib/security/pam_tally.so (limits the number of password failures when logging in to the server, etc.)
- /lib/security/pam_tally2.so
See also
- OpenPAM
- fprint
- InformationSecurity:CheckList:Unix - Security checklist for Unix-like systems.