4 ms·
built-in auth in whatever program. It's saying something that rolling-your-own is even a debatable alternative to PAM (because if there's a flaw in your progra
by AceJohnny2 6y ago
built-in auth in whatever program.
It's saying something that rolling-your-own is even a debatable alternative to PAM (because if there's a flaw in your program, "only" that program is vulnerable, not the whole system. "Only" in quotes because it's just one privilege escalation step away)
- duskwuff 6y agoWhat is "built-in auth" for a console login or SSH? Before you come up with an answer involving /etc/shadow and crypt(), consider that not all systems use local password files... and that you've just reinvented what PAM does, except less flexible and more prone to implementation errors.
- e12e 6y agoSsh certainly have built in auth - i think usepam = no is still the default? Ssh certificates certainly "reinvent" auth - but not really in a bad way. Kerberos should also be quite possible without Pam. But either way, you need some trusted code with privileges to grant privileges (eg an suid binary).
- thwarted 6y agoAnd you need to reinvent what glibc does with nsswitch.