4 ms·

Everytime I delve into PAM I can't help but think it's carrying a ton of legacy tech debt. It seems like it tries to support a lot of things out of the box tha

Everytime I delve into PAM I can't help but think it's carrying a ton of legacy tech debt. It seems like it tries to support a lot of things out of the box that may not be relevant these days, like mail and limits. The modules themselves are littered with arcane options, and the entire thing is just this commented mess of inheritance and options that most users will just use to compare a hash in a file. On a basic debian install, there's around 455 lines of configs in /etc/pam.d! Maybe systemd will streamline it someday.

duskwuff 4y ago
> Everytime I delve into PAM I can't help but think it's carrying a ton of legacy tech debt. It seems like it tries to support a lot of things out of the box that may not be relevant these days, like mail and limits. Beyond that, PAM has been saddled with a whole slew of responsibilities which go beyond user authentication, like supporting anonymous FTP (pam_ftp), maintaining /var/log/lastlog (pam_lastlog), or telling shell users that they have new mail when they log in (pam_mail). A lot of it is pretty specific to supporting traditional shell login workflows on shared machines, and is rarely used in most installs.
- takeda 4y ago
  I do like the module that automatically creates a home directory on first login. It works well when you use ldap or similar mechanism for authentication.
  - bayindirh 4y ago
    And if you don't like that, you can disable it. It's both modular and flexible.
- gnu8 4y ago
  > rarely used in most installs. I was going to object but you are absolutely right. Most Linux installs are instances of something that are created and destroyed without a human ever touching them. However, I wouldn't go so far as to characterize these features as technical debt. A fully functional Linux system should be able to tell users if they have mail, for instance.
  - duskwuff 4y ago
    > Most Linux installs are instances of something that are created and destroyed without a human ever touching them. I'm not just talking about containers or managed servers, though. Most Linux desktop systems rarely or never have a user perform a PAM login in a situation where the mail message would be seen. (Opening a terminal emulator doesn't go through PAM; it starts the shell directly, and logging into X / Wayland might use PAM, but doesn't display login messages.) And, of course, it isn't relevant at all on embedded systems; a lot of those probably aren't even running a getty. > A fully functional Linux system should be able to tell users if they have mail, for instance. Hot take: storing and processing email shouldn't be a required function of the OS. It should be an optional feature, just like serving web pages over HTTP or having a graphical desktop.
    - gnu8 4y ago
      That’s a good take though. I still hang on to the fantasy of having my mail delivered to my machine like it was big iron, but in the 25 years I have been using Linux it hasn’t happened.
b112 4y ago
Maybe systemd will streamline it someday. Oh dear god I hope not. Systemd has added immense complication, has sinplified nothing, and is massive bloat.
bayindirh 4y ago
When you understand how a PAM config file works, it's all pretty simple and readable. The biggest problem is missing documents detailing how it works. And yes, systemd shouldn't touch to that.
- tremon 4y ago
  I disagree that "it's all pretty simple and readable". The PAM configuration syntax is horrific, IMNSHO. It's a ruleset specification without explicit rule syntax, it has zero syntax checking and there are no validation/testing tools. The configuration files are line-based rather than having a separate scope for each rule; even ini-style headers would have been an improvement. The config syntax allows conditional rule evaluation by specifying how many of the following rules to skip (hello GOTO!). It even allows rule inheritance by using @include, but the including rule cannot modify/evaluate the results: if the rules you're inheriting have hard fails or hard accepts (such as root_ok), the rest of your own rules might not even get evaluated. What does PAM actually do? It allows you to specify different authentication flows depending on the agent (authorizing application) and the intended action/flow. The resulting ruleset is effectively a determination tree, but there is no way to either input your ruleset as a tree structure, nor is there a way to get PAM to dump its abstract syntax tree for debugging.

duskwuff 4y ago

> Everytime I delve into PAM I can't help but think it's carrying a ton of legacy tech debt. It seems like it tries to support a lot of things out of the box that may not be relevant these days, like mail and limits. Beyond that, PAM has been saddled with a whole slew of responsibilities which go beyond user authentication, like supporting anonymous FTP (pam_ftp), maintaining /var/log/lastlog (pam_lastlog), or telling shell users that they have new mail when they log in (pam_mail). A lot of it is pretty specific to supporting traditional shell login workflows on shared machines, and is rarely used in most installs.

takeda 4y ago
I do like the module that automatically creates a home directory on first login. It works well when you use ldap or similar mechanism for authentication.
- bayindirh 4y ago
  And if you don't like that, you can disable it. It's both modular and flexible.
gnu8 4y ago
> rarely used in most installs. I was going to object but you are absolutely right. Most Linux installs are instances of something that are created and destroyed without a human ever touching them. However, I wouldn't go so far as to characterize these features as technical debt. A fully functional Linux system should be able to tell users if they have mail, for instance.
- duskwuff 4y ago
  > Most Linux installs are instances of something that are created and destroyed without a human ever touching them. I'm not just talking about containers or managed servers, though. Most Linux desktop systems rarely or never have a user perform a PAM login in a situation where the mail message would be seen. (Opening a terminal emulator doesn't go through PAM; it starts the shell directly, and logging into X / Wayland might use PAM, but doesn't display login messages.) And, of course, it isn't relevant at all on embedded systems; a lot of those probably aren't even running a getty. > A fully functional Linux system should be able to tell users if they have mail, for instance. Hot take: storing and processing email shouldn't be a required function of the OS. It should be an optional feature, just like serving web pages over HTTP or having a graphical desktop.
  - gnu8 4y ago
    That’s a good take though. I still hang on to the fantasy of having my mail delivered to my machine like it was big iron, but in the 25 years I have been using Linux it hasn’t happened.

b112 4y ago

Maybe systemd will streamline it someday. Oh dear god I hope not. Systemd has added immense complication, has sinplified nothing, and is massive bloat.

bayindirh 4y ago

When you understand how a PAM config file works, it's all pretty simple and readable. The biggest problem is missing documents detailing how it works. And yes, systemd shouldn't touch to that.

tremon 4y ago
I disagree that "it's all pretty simple and readable". The PAM configuration syntax is horrific, IMNSHO. It's a ruleset specification without explicit rule syntax, it has zero syntax checking and there are no validation/testing tools. The configuration files are line-based rather than having a separate scope for each rule; even ini-style headers would have been an improvement. The config syntax allows conditional rule evaluation by specifying how many of the following rules to skip (hello GOTO!). It even allows rule inheritance by using @include, but the including rule cannot modify/evaluate the results: if the rules you're inheriting have hard fails or hard accepts (such as root_ok), the rest of your own rules might not even get evaluated. What does PAM actually do? It allows you to specify different authentication flows depending on the agent (authorizing application) and the intended action/flow. The resulting ruleset is effectively a determination tree, but there is no way to either input your ruleset as a tree structure, nor is there a way to get PAM to dump its abstract syntax tree for debugging.