> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-mcs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-mcs/identification-authentication-and-authorization/pam-pluggable-authentication-modules/pam.md).

# PAM

## Features

**Independent authentication protocols/mechanisms.**

* Linux password, S/Key, smartcards, biometrics, etc.
* One module per protocol/mechanism.

**Orchestration of protocols/mechanisms.**

* Alone or combined.
* AND and OR combinations.
* Application-independent.

**Several interface approaches.**

* Input from text consoles of graphical windows.
* Access to special devices (smart-cards, biometric readers, etc.).

**Modular and extensible architecture.**

* **Dynamic loading** of required **modules**.
* Handling of several actions besides authentication.
  * Password management.
  * Accounting management.
  * Session management.

**Default orchestration per host.**

* **Defined by the administrator.**
  * Username/password, biometrics, smart-cards, etc.

**Application-specific orchestrations.**

* Each application can use a unique orchestration.

## Classic Unix authentication

Requested input: **username + password**.

### Validation

* **An active account** for username.
  * Entry with the username in the `/etc/passwd` file.
* **Transformed password** for that username.
  * Entry with the username in the `/etc/shadow` file.
* **Transformation of the provided password with the function and the salt used for that username.**
* Comparison with the stored transformation.

### Obtained credentials

* UID + GID \[+ list of secondary GIDs]
* New process descriptor (login shell)

## Architecture

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FtiiiP4ijn2nwZ5XeftVC%2FScreenshot%20from%202024-04-08%2017-37-59.png?alt=media&amp;token=b3303cec-c84a-4627-a409-b9070147f1a7" alt=""><figcaption></figcaption></figure>

## Actions

* Authentication (auth).
  * Identity verification.
* Account Management (account).
  * Enforcement of access policies based on account properties.
* Password Management (password).
  * Management of authentication credentials.
* Session Management (session).
  * Verification of operational parameters.
  * Setup of session parameters.
    * max memory, max file descriptions, graphical interface configuration, ...

## Modules

Dynamically loaded (shared libraries).

* `/lib/security/pam_*.so`
* `/lib/x86_64-linux-gnu/security/pam_*.so`

Standard API.

* Functions provided by the modules that are used.
  * C interfaces.
  * Python wrapper exists.
* The decision is provided on the returned code.
  * AM\_SUCCESS
  * PAM\_AUTH\_ERR, PAM\_AUTHINFO\_UNAVAIL, etc…
* Not all functions need to be implemented.
  * A module does not need to implement all 4 actions.

## Orchestration files

Typically, one per PAM client application.

* e.g. `/etc/pam.d/ftp` or `/etc/pam.d/ssh`
* Can use shared files: `/etc/pam.d/common-auth`

Specify how the actions should be applied.

* Their mechanisms (modules).
* Their parameters.
* Their termination, with or without success.

Each module uses a particular set of resources.

* Local files.
  * `/etc/passwd`, `/etc/shadow`, `/etc/groups`, etc.
* Distributed information or located in remote servers.
  * NIS, Kerberos, LDAP, etc.

## Detailed Architecture

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2Fib78ZOzx5jJulWn2j4mx%2FScreenshot%20from%202024-04-08%2017-43-33.png?alt=media&amp;token=ed796aba-5f95-46e5-abce-9ce77ff0a4be" alt=""><figcaption></figcaption></figure>