0

Having the following line:

auth required pam_env.so

Documentation happily says

"This module is required—it must run successfully for authentication to proceed."

(https://www.safaribooksonline.com/library/view/practical-unix-and/0596003234/ch04s05.html)

Great! What does really mean "run successfully". I know that it loads variables from /etc/security/pam_env.conf that by the way in Centos and Ubuntu have all its lines commented out. Please could you explain me what does that really mean?

How can this module could run unsuccessfully? Or merely loads variable, what has this have to do with authentication?

I've read the pam.conf manpage:

required failure of such a PAM will ultimately lead to the PAM-API returning failure but only after the remaining stacked modules (for this service and type) have been invoked.

Perhaps, I missing something, but it says me nothing about this topic.

All in all, why the type is auth, and not session?

2

The pam_env man page says:

RETURN VALUES
   PAM_ABORT
       Not all relevant data or options could be gotten.

   PAM_BUF_ERR
       Memory buffer error.

   PAM_IGNORE
       No pam_env.conf and environment file was found.

   PAM_SUCCESS
       Environment variables were set.

Additionally, if your system has been corrupted badly, pam_env.so itself perhaps couldn't run (e.g. filesystem corrupted, or a 64-bit binary on a 32-bit kernel) and that will return an error value.

The reason it's in the auth stack is that subsequent PAM modules may rely on what has been set (and that's the reason that it is required).

  • IIUC that module is to prevent authentication in case of "OS curruption" rather a misconfiguration, isn't it? – sebelk May 5 '15 at 18:45
  • I think that's right - really to prevent other PAM modules running without the correct environment. – Toby Speight May 5 '15 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.