I am writing my own PAM module that will be part of an application that I am developing, but I'm not sure exactly where to put it. My module basically does network-level authentication (with other mojo of course) similar to LDAP.
There are a lot of config files in my
/etc/pam.d/ directory, and I know what most of the services do (except a couple, like atd, polkit, ppp). I assume that authentication with PAM stack goes something like this:
- Runs stack based on service name (if a config file exists)
- If not authenticated, fall back on common-*, where * is the module-type (auth, account, etc)
- Return success or fail to calling application (and any other data of course)
Am I correct in this assumption? Do all platforms have common-auth, common-account, common-password, and common-session?
If so, I was thinking about just putting it at the top of common-* as a
sufficient module so that on failure the regular PAM stack would be left unaffected. This is particularly advantageous because I can programmatically do this on software install.
Am I missing any potential security vulnerabilities?
I couldn't find very good documentation on where to integrate custom PAM modules or security issues surrounding where to put modules.