5

I know that passwords are stored in /etc/shadow

However, during the login process, I'm assuming that Linux take your username and password as an argument, encrypt your password with the same algorithm and compare it to the one stored in the shadow.

My question is, where does this process take place? (the code) I tried to search the PAM but I couldn't find anything useful there either.

  • 3
    What you are describing is handled by pam_unix. Relevant source: github.com/pibara/pam_unix/blob/… – jordanm Dec 11 '16 at 6:36
  • @jordanm Thank you! I'm assuming that if I want to edit something I should create a PAM module instead of editing the actual file, right? – Ryan Dec 11 '16 at 21:29
3

Within PAM, for a local password stored in /etc/shadow, the job of checking the password is performed by pam_unix.

Under the hood, the verification is done by the crypt function. (Actually, in most cases, by crypt_r.) Note that despite the name, this function does not encrypt or decrypt the password, it hashes the password. The password field in /etc/shadow contains parameters for the hashing as well as the actual hash value.

The source code of the pam_unix module is part of Linux-PAM. The source code of the crypt function is part of the C library (Glibc).

2

I know that passwords are stored in /etc/shadow

As Gilles already stated, only password hashes are stored in /etc/shadow, moreover, this is just one of the possible locations, they might be stored globally on a ldap server or a NIS table.

However, during the login process, I'm assuming that Linux take your username and password as an argument, encrypt your password with the same algorithm and compare it to the one stored in the shadow.

The process is much more flexible than that. Depending on the PAM configuration, the system might check multiple modules in sequence, and will stop if either one of the module succeed and is declared to be sufficient or alternatively if a module fails and is declared as requisite. Modules are able to establish a dialog with the user trying to log in so what is provided is not necessarily a couple of username/password. For example, a user can be granted access without providing any password when using rlogin (pam_rhosts_auth). He must be warned the password is about to expire, be prompted to change an expired password, and similar interactive tasks.

My question is, where does this process take place? (the code) I tried to search the PAM but I couldn't find anything useful there either.

Gilles also already replied to that question, pam_unix is handling /etc/passwd et /etc/shadow files entries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.