3

Let's say that I have configured sshd(linked against libpam.so.0 shared library) to use PAM and I have following /etc/pam.d/sshd content:

auth        requisite   pam_nologin.so
auth    required        pam_env.so
auth    required        pam_unix.so     try_first_pass 
auth    required        pam_google_authenticator.so
account     requisite   pam_nologin.so
account required        pam_unix.so     try_first_pass
password        requisite       pam_cracklib.so
password        required        pam_unix.so     use_authtok nullok shadow try_first_pass 
session     required    pam_loginuid.so
session required        pam_limits.so
session required        pam_unix.so     try_first_pass 
session optional        pam_umask.so
session optional        pam_systemd.so
session optional        pam_env.so
session  optional       pam_lastlog.so   silent noupdate showfailed

Am I correct that PAM informs sshd about success or failure at the end of each stack? So first auth facilities are processed and then the result is returned to sshd, then account facilities are processed and result of account stack is returned to sshd, etc? Is PAM informed by daemon when authenticated session ends?

2 Answers 2

3
+100

In a sense that is what is happening, but I would not phrase it that way. Because PAM does not inform sshd actively, but rather sshd asks PAM via function calls (like pam_authenticate, pam_acct_mgmt, etc.) and acts according to the results. PAM also does not automatically know, when a session is closed, but has to be informed via pam_close_session (since a session can be closed from another application).

You can look up the source code of openssh in order to understand where and how sshd does utilize PAM. I would also recommend the Linux-PAM Application Developers' Guide if you are interested in the details.

1
  • 1
    Exactly. The PAM configuration is misleading by continuously calling the PAM an active entity, while it is not. PAM is a passive thing, a library, which can authenticate anything with a pre-configured order of plugins, that is all.
    – peterh
    Jan 20, 2018 at 17:48
1

If by stack, you mean auth, account, password, and session then no, PAM does not inform sshd after each one. Being stacked just means that they are used together to do one thing which in your case is granting or denying access. The first column is the module interface, the second is the control flag, and the third is the module name and arguments. For the first, auth verifies the password, account determines whether or not the account being used has access, password is for changing passwords, and session is for mounting the home directory or enabling mail. The control flag is self-explanatory: required means that it must be true, sufficient is ignored if it fails but will proceed if it is successful, and so forth. The last tells it which module to use for PAM in this case.

2) No.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.