4 ms·

Pluggable Authentication Modules (PAM)

37 points by networked 4y ago

mauvehaus 4y ago
PAM lets you do some pretty slick things. I did a bunch of Samba/Active Directory integrations on Solaris[0] back in the late aughts. I never got super deep into the PAM side of things, but it was pretty clear that you could go absolutely wild with it. [0] For people rolling their own NAS, mostly with SAMFS, at least one with ZFS.
- arminiusreturns 4y ago
  Yep, it's powerful, complicated, and easy to jack things up, but very useful. It's been a while but I had a whole company on three factor ssh via the google auth libpam module at one point and it worked quite well once I ironed out the bugs.
  - brmgb 4y ago
    Having had to use it to connect authentication to LDAP via sssd, I’m not sure I would describe it as nicely as you do. To put it bluntly, my personal opinion is that it is a massive piece of shit. It makes even simple things feel complicated for no reason whatsoever and is so brittle. The whole thing is a huge design failure.
m00dy 4y ago
I hear you [0]. [0]: https://github.com/m00dy/pam-backdoor/blob/master/pam-backdoor https://github.com/m00dy/pam-backdoor/blob/master/pam-backdo...
notaplumber1 4y ago
OpenSSH developers documented some issues they found with PAM, in implementation and design. https://www.dtucker.net/pam/ https://www.dtucker.net/pam/ BSD Authentication is much nicer, but has only been adopted by OpenBSD. https://man.openbsd.org/authenticate.3 https://man.openbsd.org/authenticate.3 https://man.openbsd.org/auth_subr.3 https://man.openbsd.org/auth_subr.3
hackeraccount 4y ago
My one rule about PAM is always have an ssh session going when you mess with it and never drop it until you've tested logins 7 ways to Sunday. I remember one time making a seemingly minor change - testing it; huzzah! logins still work - dropping the connection and much much later realizing that you didn't need any password to login. Oops.
- towawy 4y ago
  I made a similar learning when messing with PAM to enable TouchID with sudo on a Mac! Edited the config with "sudo nano /etc/pam.d/sudo", a typo slipped in, saved the file and closed nano. After that sudo was broken and I had to go down the rabbit hole of changing a root owned system file without sudo to fix it. The next time I opened a root shell with "sudo -s" and THEN opened nano. Made absolutely sure sudo still works in a new Terminal window before closing anything.
  - tadfisher 4y ago
    Does "su" not work on macOS?
    - Schnitz 4y ago
      Not by default, similar like on Ubuntu etc.
Waterluvian 4y ago
Is it possible in Ubuntu to never have to type my sudo password again so long as I’ve got some sort of security dongle plugged in? Specifically: it just skips asking at all. No extra step like pushing a button.
- woleium 4y ago
  You could probably make something like this work using pam_listfile https://www.systutorials.com/docs/linux/man/8-pam_listfile/ https://www.systutorials.com/docs/linux/man/8-pam_listfile/

37 points by networked 4y ago

PAM lets you do some pretty slick things. I did a bunch of Samba/Active Directory integrations on Solaris[0] back in the late aughts. I never got super deep into the PAM side of things, but it was pretty clear that you could go absolutely wild with it. [0] For people rolling their own NAS, mostly with SAMFS, at least one with ZFS.

arminiusreturns 4y ago
Yep, it's powerful, complicated, and easy to jack things up, but very useful. It's been a while but I had a whole company on three factor ssh via the google auth libpam module at one point and it worked quite well once I ironed out the bugs.
- brmgb 4y ago
  Having had to use it to connect authentication to LDAP via sssd, I’m not sure I would describe it as nicely as you do. To put it bluntly, my personal opinion is that it is a massive piece of shit. It makes even simple things feel complicated for no reason whatsoever and is so brittle. The whole thing is a huge design failure.

m00dy 4y ago

I hear you [0]. [0]: https://github.com/m00dy/pam-backdoor/blob/master/pam-backdoor https://github.com/m00dy/pam-backdoor/blob/master/pam-backdo...

notaplumber1 4y ago

OpenSSH developers documented some issues they found with PAM, in implementation and design. https://www.dtucker.net/pam/ https://www.dtucker.net/pam/ BSD Authentication is much nicer, but has only been adopted by OpenBSD. https://man.openbsd.org/authenticate.3 https://man.openbsd.org/authenticate.3 https://man.openbsd.org/auth_subr.3 https://man.openbsd.org/auth_subr.3

hackeraccount 4y ago

My one rule about PAM is always have an ssh session going when you mess with it and never drop it until you've tested logins 7 ways to Sunday. I remember one time making a seemingly minor change - testing it; huzzah! logins still work - dropping the connection and much much later realizing that you didn't need any password to login. Oops.

towawy 4y ago
I made a similar learning when messing with PAM to enable TouchID with sudo on a Mac! Edited the config with "sudo nano /etc/pam.d/sudo", a typo slipped in, saved the file and closed nano. After that sudo was broken and I had to go down the rabbit hole of changing a root owned system file without sudo to fix it. The next time I opened a root shell with "sudo -s" and THEN opened nano. Made absolutely sure sudo still works in a new Terminal window before closing anything.
- tadfisher 4y ago
  Does "su" not work on macOS?
  - Schnitz 4y ago
    Not by default, similar like on Ubuntu etc.

Waterluvian 4y ago

Is it possible in Ubuntu to never have to type my sudo password again so long as I’ve got some sort of security dongle plugged in? Specifically: it just skips asking at all. No extra step like pushing a button.

woleium 4y ago
You could probably make something like this work using pam_listfile https://www.systutorials.com/docs/linux/man/8-pam_listfile/ https://www.systutorials.com/docs/linux/man/8-pam_listfile/