> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/notes-mcs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/notes-mcs/secure-execution-environments/security-in-operating-systems/linux-login.md).

# Linux login

## Not an OS kernel operation

A privileged login application presents an interface for getting users’ credentials.

* A username/password pair.
* Biometric data.
* Smartcard and activation PIN.

The login application validates the credentials and fetches the appropriate UID and GIDs for the user.

* And starts an initial user application on a process with those identifiers.
  * In a Linux console, this application is a shell (sh, bash, csh, tcsh, zsh, etc.)
* When this process ends the login application reappears.

Thereafter **all processes created by the user have their identifiers**.

* Inherited through forks.

## From login to session processes

The login process must be a privileged process.

* Has to **create processes with arbitrary UID and GIDs**.
  * The ones of the entity logging in.

<figure><img src="https://234178705-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlSLj4wxc6NsT415otBid%2Fuploads%2FYMQYvbFyqFOdfuHPQmhn%2FScreenshot%20from%202024-02-26%2011-59-04.png?alt=media&amp;token=646127dd-6895-4cd5-bb31-0ae09a8d0fab" alt=""><figcaption></figcaption></figure>

## Password validation process

The **username is used to fetch a UID/GID** pair from `/etc/passwd`.

* And a set of additional GIDs in the `/etc/group` file.

The **supplied password is transformed using a digest function**.

* Currently configurable, for creating a new user (`/etc/login.defs`).
* Its identification is stored along with the transformed password.

The **result is checked against a value stored in `/etc/shadow`**.

* **Indexed** again **by the username**.
* If they match, the user was correctly authenticated.

File protections.

* `/etc/passwd` and `/etc/group` can be read by anyone.
  * This is fundamental, for instance, for listing directories (why?)
* `/etc/shadow` can only be read by root.
  * Protection against dictionary attacks.