3 ms·

I can't possibly see how PAM was ever considered a good idea.

• tadfisher 6y ago
  I mean, it's literally in the name: Pluggable Authentication Module. It's a very good idea to expose a common interface for user authentication to hide the vagaries of the underlying authentication mechanisms. It's far more useful to explain why or how PAM is bad, because no one (sane) will agree that the idea of PAM is bad.
  • vbezhenar 6y ago
    Module should be implemented as a separate process running under unprivileged user and communication should be done via pipes. It's UNIX-way. If I understand it correctly, currently module is implemented as a shared library executing under root sharing all the memory with other modules and main program. This exposes way too many opportunities to exploit any vulnerability.
    • megous 6y ago
      PAM using app can fork a process for this, so it's not too horrible, but it increases complexity.