Source string Read only

(itstool) path: section/title (itstool) id: article.translate.xml#pam-modules-securetty.title
97/970
Context English State
<citerefentry><refentrytitle>pam_opie</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_opie</refentrytitle><manvolnum>8</manvolnum></citerefentry> module implements the <citerefentry><refentrytitle>opie</refentrytitle><manvolnum>4</manvolnum></citerefentry> authentication method. The <citerefentry><refentrytitle>opie</refentrytitle><manvolnum>4</manvolnum></citerefentry> system is a challenge-response mechanism where the response to each challenge is a direct function of the challenge and a passphrase, so the response can be easily computed <quote>just in time</quote> by anyone possessing the passphrase, eliminating the need for password lists. Moreover, since <citerefentry><refentrytitle>opie</refentrytitle><manvolnum>4</manvolnum></citerefentry> never reuses a challenge that has been correctly answered, it is not vulnerable to replay attacks.
<citerefentry><refentrytitle>pam_opieaccess</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_opieaccess</refentrytitle><manvolnum>8</manvolnum></citerefentry> module is a companion module to <citerefentry><refentrytitle>pam_opie</refentrytitle><manvolnum>8</manvolnum></citerefentry>. Its purpose is to enforce the restrictions codified in <citerefentry><refentrytitle>opieaccess</refentrytitle><manvolnum>5</manvolnum></citerefentry>, which regulate the conditions under which a user who would normally authenticate herself using <citerefentry><refentrytitle>opie</refentrytitle><manvolnum>4</manvolnum></citerefentry> is allowed to use alternate methods. This is most often used to prohibit the use of password authentication from untrusted hosts.
In order to be effective, the <citerefentry><refentrytitle>pam_opieaccess</refentrytitle><manvolnum>8</manvolnum></citerefentry> module must be listed as <literal>requisite</literal> immediately after a <literal>sufficient</literal> entry for <citerefentry><refentrytitle>pam_opie</refentrytitle><manvolnum>8</manvolnum></citerefentry>, and before any other modules, in the <literal>auth</literal> chain.
<citerefentry><refentrytitle>pam_passwdqc</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_passwdqc</refentrytitle><manvolnum>8</manvolnum></citerefentry> module
<citerefentry><refentrytitle>pam_permit</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_permit</refentrytitle><manvolnum>8</manvolnum></citerefentry> module is one of the simplest modules available; it responds to any request with <literal>PAM_SUCCESS</literal>. It is useful as a placeholder for services where one or more chains would otherwise be empty.
<citerefentry><refentrytitle>pam_radius</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_radius</refentrytitle><manvolnum>8</manvolnum></citerefentry> module
<citerefentry><refentrytitle>pam_rhosts</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_rhosts</refentrytitle><manvolnum>8</manvolnum></citerefentry> module
<citerefentry><refentrytitle>pam_rootok</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_rootok</refentrytitle><manvolnum>8</manvolnum></citerefentry> module reports success if and only if the real user id of the process calling it (which is assumed to be run by the applicant) is 0. This is useful for non-networked services such as <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry> or <citerefentry><refentrytitle>passwd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, to which the <literal>root</literal> should have automatic access.
<citerefentry><refentrytitle>pam_securetty</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_securetty</refentrytitle><manvolnum>8</manvolnum></citerefentry> module
<citerefentry><refentrytitle>pam_self</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_self</refentrytitle><manvolnum>8</manvolnum></citerefentry> module reports success if and only if the names of the applicant matches that of the target account. It is most useful for non-networked services such as <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry>, where the identity of the applicant can be easily verified.
<citerefentry><refentrytitle>pam_ssh</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_ssh</refentrytitle><manvolnum>8</manvolnum></citerefentry> module provides both authentication and session services. The authentication service allows users who have passphrase-protected SSH secret keys in their <filename>~/.ssh</filename> directory to authenticate themselves by typing their passphrase. The session service starts <citerefentry><refentrytitle>ssh-agent</refentrytitle><manvolnum>1</manvolnum></citerefentry> and preloads it with the keys that were decrypted in the authentication phase. This feature is particularly useful for local logins, whether in X (using <citerefentry vendor="xfree86"><refentrytitle>xdm</refentrytitle><manvolnum>1</manvolnum></citerefentry> or another PAM-aware X login manager) or at the console.
<citerefentry><refentrytitle>pam_tacplus</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_tacplus</refentrytitle><manvolnum>8</manvolnum></citerefentry> module
<citerefentry><refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum></citerefentry> module implements traditional <trademark class="registered">UNIX</trademark> password authentication, using <citerefentry><refentrytitle>getpwnam</refentrytitle><manvolnum>3</manvolnum></citerefentry> to obtain the target account's password and compare it with the one provided by the applicant. It also provides account management services (enforcing account and password expiration times) and password-changing services. This is probably the single most useful module, as the great majority of admins will want to maintain historical behavior for at least some services.
PAM Application Programming
This section has not yet been written.
PAM Module Programming
Sample PAM Application
The following is a minimal implementation of <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry> using PAM. Note that it uses the OpenPAM-specific <citerefentry><refentrytitle>openpam_ttyconv</refentrytitle><manvolnum>3</manvolnum></citerefentry> conversation function, which is prototyped in <filename>security/openpam.h</filename>. If you wish build this application on a system with a different PAM library, you will have to provide your own conversation function. A robust conversation function is surprisingly difficult to implement; the one presented in <xref linkend="pam-sample-conv"/> is a good starting point, but should not be used in real-world applications.
/*-
* Copyright (c) 2002,2003 Networks Associates Technology, Inc.
* All rights reserved.
*
* This software was developed for the FreeBSD Project by ThinkSec AS and
* Network Associates Laboratories, the Security Research Division of
* Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
* ("CBOSS"), as part of the DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $P4: //depot/projects/openpam/bin/su/su.c#10 $
* $FreeBSD: head/en_US.ISO8859-1/articles/pam/su.c 38826 2012-05-17 19:12:14Z hrs $
*/

#include &lt;sys/param.h&gt;
#include &lt;sys/wait.h&gt;

#include &lt;err.h&gt;
#include &lt;pwd.h&gt;
#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;string.h&gt;
#include &lt;syslog.h&gt;
#include &lt;unistd.h&gt;

#include &lt;security/pam_appl.h&gt;
#include &lt;security/openpam.h&gt; /* for openpam_ttyconv() */

extern char **environ;

static pam_handle_t *pamh;
static struct pam_conv pamc;

static void
usage(void)
{

fprintf(stderr, "Usage: su [login [args]]\n");
exit(1);
}

int
main(int argc, char *argv[])
{
char hostname[MAXHOSTNAMELEN];
const char *user, *tty;
char **args, **pam_envlist, **pam_env;
struct passwd *pwd;
int o, pam_err, status;
pid_t pid;

while ((o = getopt(argc, argv, "h")) != -1)
switch (o) {
case 'h':
default:
usage();
}

argc -= optind;
argv += optind;

if (argc &gt; 0) {
user = *argv;
--argc;
++argv;
} else {
user = "root";
}

/* initialize PAM */
pamc.conv = &amp;openpam_ttyconv;
pam_start("su", user, &amp;pamc, &amp;pamh);

/* set some items */
gethostname(hostname, sizeof(hostname));
if ((pam_err = pam_set_item(pamh, PAM_RHOST, hostname)) != PAM_SUCCESS)
goto pamerr;
user = getlogin();
if ((pam_err = pam_set_item(pamh, PAM_RUSER, user)) != PAM_SUCCESS)
goto pamerr;
tty = ttyname(STDERR_FILENO);
if ((pam_err = pam_set_item(pamh, PAM_TTY, tty)) != PAM_SUCCESS)
goto pamerr;

/* authenticate the applicant */
if ((pam_err = pam_authenticate(pamh, 0)) != PAM_SUCCESS)
goto pamerr;
if ((pam_err = pam_acct_mgmt(pamh, 0)) == PAM_NEW_AUTHTOK_REQD)
pam_err = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
if (pam_err != PAM_SUCCESS)
goto pamerr;

/* establish the requested credentials */
if ((pam_err = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS)
goto pamerr;

/* authentication succeeded; open a session */
if ((pam_err = pam_open_session(pamh, 0)) != PAM_SUCCESS)
goto pamerr;

/* get mapped user name; PAM may have changed it */
pam_err = pam_get_item(pamh, PAM_USER, (const void **)&amp;user);
if (pam_err != PAM_SUCCESS || (pwd = getpwnam(user)) == NULL)
goto pamerr;

/* export PAM environment */
if ((pam_envlist = pam_getenvlist(pamh)) != NULL) {
for (pam_env = pam_envlist; *pam_env != NULL; ++pam_env) {
putenv(*pam_env);
free(*pam_env);
}
free(pam_envlist);
}

/* build argument list */
if ((args = calloc(argc + 2, sizeof *args)) == NULL) {
warn("calloc()");
goto err;
}
*args = pwd-&gt;pw_shell;
memcpy(args + 1, argv, argc * sizeof *args);

/* fork and exec */
switch ((pid = fork())) {
case -1:
warn("fork()");
goto err;
case 0:
/* child: give up privs and start a shell */

/* set uid and groups */
if (initgroups(pwd-&gt;pw_name, pwd-&gt;pw_gid) == -1) {
warn("initgroups()");
_exit(1);
}
if (setgid(pwd-&gt;pw_gid) == -1) {
warn("setgid()");
_exit(1);
}
if (setuid(pwd-&gt;pw_uid) == -1) {
warn("setuid()");
_exit(1);
}
execve(*args, args, environ);
warn("execve()");
_exit(1);
default:
/* parent: wait for child to exit */
waitpid(pid, &amp;status, 0);

/* close the session and release PAM resources */
pam_err = pam_close_session(pamh, 0);
pam_end(pamh, pam_err);

exit(WEXITSTATUS(status));
}

pamerr:
fprintf(stderr, "Sorry\n");
err:
pam_end(pamh, pam_err);
exit(1);
}

Loading…

No matching activity found.

Browse all component changes

Things to check

Multiple failing checks

The translations in several languages have failing checks

Reset

Glossary

English English
No related strings found in the glossary.

Source information

Source string comment
(itstool) path: section/title (itstool) id: article.translate.xml#pam-modules-securetty.title
Flags
read-only
Source string location
article.translate.xml:1158
String age
a year ago
Source string age
a year ago
Translation file
articles/pam.pot, string 210