0

Having the following line:

auth        required      pam_env.so

Documentation says:

The first module run, pam_env, optionally sets or clears environment variables specified in /etc/security/pam_env.conf.  This module is required—it must run successfully for authentication to proceed.

Practical UNIX and Internet Security, 3rd Edition by Simson Garfinkel, Gene Spafford, Alan Schwartz / Pluggable Authentication Modules (PAM)

Great! What does really mean "run successfully" really mean?  I know that it loads variables from /etc/security/pam_env.conf (which, by the way, in CentOS and Ubuntu has all its lines commented out).  Please could you explain me what does that really mean?

How can this module run unsuccessfully? Or merely loads variable, what has this have to do with authentication?

I've read the pam.conf manpage:

required

    failure of such a PAM will ultimately lead to the PAM-API returning failure but only after the remaining stacked modules (for this service and type) have been invoked.

Perhaps, I missing something, but it says me nothing about this topic.

All in all, why the type is auth, and not session?

1 Answer 1

2

The pam_env man page says:

RETURN VALUES
   PAM_ABORT
       Not all relevant data or options could be gotten.

   PAM_BUF_ERR
       Memory buffer error.

   PAM_IGNORE
       No pam_env.conf and environment file was found.

   PAM_SUCCESS
       Environment variables were set.

Additionally, if your system has been corrupted badly, pam_env.so itself perhaps couldn't run (e.g. filesystem corrupted, or a 64-bit binary on a 32-bit kernel) and that will return an error value.

The reason it's in the auth stack is that subsequent PAM modules may rely on what has been set (and that's the reason that it is required).

2
  • IIUC that module is to prevent authentication in case of "OS curruption" rather a misconfiguration, isn't it?
    – sebelk
    May 5, 2015 at 18:45
  • I think that's right - really to prevent other PAM modules running without the correct environment. May 5, 2015 at 19:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .