4 ms·
What is an alternative? PAM seems pretty ubiquitous.
by sleepydog 6y ago
What is an alternative? PAM seems pretty ubiquitous.
- AceJohnny2 6y agobuilt-in auth in whatever program. It's saying something that rolling-your-own is even a debatable alternative to PAM (because if there's a flaw in your program, "only" that program is vulnerable, not the whole system. "Only" in quotes because it's just one privilege escalation step away)
- duskwuff 6y agoWhat is "built-in auth" for a console login or SSH? Before you come up with an answer involving /etc/shadow and crypt(), consider that not all systems use local password files... and that you've just reinvented what PAM does, except less flexible and more prone to implementation errors.
- e12e 6y agoSsh certainly have built in auth - i think usepam = no is still the default? Ssh certificates certainly "reinvent" auth - but not really in a bad way. Kerberos should also be quite possible without Pam. But either way, you need some trusted code with privileges to grant privileges (eg an suid binary).
- thwarted 6y agoAnd you need to reinvent what glibc does with nsswitch.
- Fnoord 6y agoFWIW, OpenBSD doesn't use PAM; it has been using BSD_Auth [1] since forever. The other BSDs and macOS use OpenPAM [2] instead of Linux PAM. Both are written in C. [1] https://en.wikipedia.org/wiki/BSD_Authentication https://en.wikipedia.org/wiki/BSD_Authentication [2] https://en.wikipedia.org/wiki/OpenPAM https://en.wikipedia.org/wiki/OpenPAM