2 ms·
Wait, is this why my arbitrary changes to /etc/pam.d on Ubuntu have resulted in failure?
by xena 5y ago
Wait, is this why my arbitrary changes to /etc/pam.d on Ubuntu have resulted in failure?
- Spivak 5y agoMaybe! Rewriting PAM is usually only done when messing with packages but can be called manually if you drop files in there with your config management. “Wow this could be really useful” you might think. “Where “is it documented?” https://wiki.ubuntu.com/PAMConfigFrameworkSpec https://wiki.ubuntu.com/PAMConfigFrameworkSpec “But where is the reference, how do I know what directives are even available?” …
- notacoward 5y agoThis is the part that really gets me about PAM. There really did need to be something where it sits, and the plugin approach is perfectly sound. (Aside: I hope the expressed horror at "plugins in C" is one of the satirical parts, because plenty of people really do have such a poor grasp of computing history.) On the other hand, the implementation of those basic ideas has always been plagued by inscrutable APIs/formats, poor documentation, and unnecessarily catastrophic failure modes - as shown in the talk itself, and some of the comments above. Actually working with PAM is almost as unpleasant as working with SELinux, and neither has to be so bad.
- gerdesj 5y agoYou can always take control back. I have a fair few Ubuntus lying around whilst I use Arch on my laptop and workstations. Ubuntu has /etc/pam.d/common-auth which looks like the main module to define your intent. Strip out the comments and see what you have left - read the comments first! Copy the whole lot somewhere and login to another console with root rights. Now you can play. What would you like to do?