0

I am trying to implement a PAM for Linux which gets invoked for sudo operations, the purpose of it is to ask the user for SMS sent to his mobile right after he enters a password when performing sudo operation in cmd, I guess this password is asked by common-auth PAM which is default PAM in Linux and this plain password entered by the user is validated by this common-auth PAM by converting into a hash and then comparing it with hash from the shadow file. Now after this common-auth PAM authentication my custom PAM is getting invoked but I am not getting hold or access to the plain password that user entered (This is important because I need to make an API call with this plain username and password of the user in my custom PAM), how can I get access of the plain password that user has entered after sudo? Can we enable passing of plain password from common-auth PAM to my custom PAM?

I'm trying to implement a custom PAM which acts as Multi Factor Authentication when user tries to SUDO. So, I need to send these user credentials to an API which sends an SMS (OTP) to my mobile. I have a C program which sends API request and I need to pass the password into that program.

I got access to username from the "pwd.h" file. But, couldn't access the password.

0

1 Answer 1

0

In a PAM module, the way to get the user’s authentication token is pam_get_authtok.

However, passing passwords around is usually a bad idea; does your SMS-sending service really need to know the user’s password? (I’m not looking for an answer, just suggesting it’s worth questioning that.)

3
  • Yeah, I need to use the same credentials with the provider.
    – Umesh
    Aug 28, 2020 at 14:17
  • 1
    I understand that, and like I said, I wasn’t looking for an answer. Having to deal with user passwords like this is really asking for trouble in the medium to long term; we’ve had good SSO and two-factor authentication systems for many years that don’t involve anything like this. Aug 28, 2020 at 14:20
  • Thanks for your help, I resolved my problem with pam_get_authtok.
    – Umesh
    Sep 2, 2020 at 9:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .