1

I do not understand how ssh or any other service can work without pam. pam defines all the rules, if I understand correctly, calls other modules to set resources or restrictions etc.

Can someone explain how does SSH behave, if we set UsePam=No. Which modules takes care of authentication, session creation etc.?

  • 1
    sshd is already capable of authenticating users. Using PAM just means that the configuration can be centralized and/or extended. – Ignacio Vazquez-Abrams Jun 3 '18 at 17:27
  • 1
    What are you asking here? It's been pointed out that sshd can authenticate without pam. Certainly one could have su also have its own authentication outside of pam. Pam is a convenience, not a mandate to use. – Doug O'Neal Jun 3 '18 at 17:52
  • 2
    There was a time before PAM. What do you think how sshd and su worked back then? – Hauke Laging Jun 3 '18 at 17:54
  • 1
    There are non-Linux Unix systems without PAM. The OpenBSD system does not use PAM and OpenSSH is developed (mainly) by OpenBSD developers. – Kusalananda Jun 3 '18 at 19:18
  • 2
    @HaukeLaging and others (but I can only tag one): I think they wrote the question exactly because they don't know the answer to it. If you have an answer, write it as an answer. – ilkkachu Jun 3 '18 at 19:41
3

If you set UsePam no, then sshd itself will do the job of the PAM modules, as best as it can.

Since sshd is running as root, it can use getspnam(3) function to get the user's password hash and other information from /etc/shadow (or from NIS, LDAP or any other storage location supported by the C library of the system), select the password hashing algorithm by looking at the beginning of the hash, then hash the password entered by the user with the salt from the getspnam(3) result using crypt(3). The result is then compared to the complete password hash retrieved by getspnam(3). If they match, the password authentication is successful.

Account verification step is again pretty simple: the password expiration information is included in the getspnam(3) results, and another check is made that the user's shell exists and is listed in /etc/shells.

Session creation includes a number of steps whose details depend on the type of Linux or Unix the service is running on. But typically, for a shell session, the sshd child process handling this specific connection would record the session information to the utmp and wtmp files, set up a pseudo-TTY, then fork() another child process that would take on the user's UID and group memberships, switch to the user's home directory and call setsid() to become a session leader. This process would then exec() the user's shell.

When the shell dies, the sshd child process holding the master end of the pseudo-TTY would then perform any necessary clean-up actions, like recording the end of session in the wtmp file.

This is roughly how a Unix session was handled before PAM was invented.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.