3 ms·
Sorry to be blunt but isn’t it best to avoid PAM these days?
by cpach 6y ago
Sorry to be blunt but isn’t it best to avoid PAM these days?
- kelnos 6y agoDoesn't pretty much every mainstream Linux distro use it?
- sleepydog 6y agoWhat is an alternative? PAM seems pretty ubiquitous.
- AceJohnny2 6y agobuilt-in auth in whatever program. It's saying something that rolling-your-own is even a debatable alternative to PAM (because if there's a flaw in your program, "only" that program is vulnerable, not the whole system. "Only" in quotes because it's just one privilege escalation step away)
- duskwuff 6y agoWhat is "built-in auth" for a console login or SSH? Before you come up with an answer involving /etc/shadow and crypt(), consider that not all systems use local password files... and that you've just reinvented what PAM does, except less flexible and more prone to implementation errors.
- e12e 6y agoSsh certainly have built in auth - i think usepam = no is still the default? Ssh certificates certainly "reinvent" auth - but not really in a bad way. Kerberos should also be quite possible without Pam. But either way, you need some trusted code with privileges to grant privileges (eg an suid binary).
- thwarted 6y agoAnd you need to reinvent what glibc does with nsswitch.
- Fnoord 6y agoFWIW, OpenBSD doesn't use PAM; it has been using BSD_Auth [1] since forever. The other BSDs and macOS use OpenPAM [2] instead of Linux PAM. Both are written in C. [1] https://en.wikipedia.org/wiki/BSD_Authentication https://en.wikipedia.org/wiki/BSD_Authentication [2] https://en.wikipedia.org/wiki/OpenPAM https://en.wikipedia.org/wiki/OpenPAM
- amerine 6y agoDo you mean via mod_pam style PAM module creations? Help Me understand what you mean.
- pepemon 6y agoPAM is an authn core in any modern mainstream Linux distro. If you build and/or tweak Linux boxes, PAM was almost always here right with you. The only question is do you know what exacly PAM do?
- jsiepkes 6y agoI remember when I was in school (about 15 years ago) Slackware was one of the few distro's that didn't have PAM and they made a big point of it. So I did a quick Google just now and found that this year (2020) even Slackware got PAM [1]. Had a good chuckle over that. [1] https://alien.slackbook.org/blog/slackware-introduces-pam-into-its-core/ https://alien.slackbook.org/blog/slackware-introduces-pam-in...