The translation is temporarily closed for contributions due to maintenance, please come back later.

Translation

(itstool) path: appendix/para
English
The following is a minimal implementation of <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry> using PAM. Note that it uses the OpenPAM-specific <citerefentry><refentrytitle>openpam_ttyconv</refentrytitle><manvolnum>3</manvolnum></citerefentry> conversation function, which is prototyped in <filename>security/openpam.h</filename>. If you wish build this application on a system with a different PAM library, you will have to provide your own conversation function. A robust conversation function is surprisingly difficult to implement; the one presented in <xref linkend="pam-sample-conv"/> is a good starting point, but should not be used in real-world applications.
762/7050 · 705
Context English Spanish State
The <citerefentry><refentrytitle>pam_rootok</refentrytitle><manvolnum>8</manvolnum></citerefentry> module reports success if and only if the real user id of the process calling it (which is assumed to be run by the applicant) is 0. This is useful for non-networked services such as <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry> or <citerefentry><refentrytitle>passwd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, to which the <literal>root</literal> should have automatic access. El módulo <citerefentry><refentrytitle>pam_rootok</refentrytitle><manvolnum>8</manvolnum></citerefentry> informa de éxito si, y solo si, si el identificador del usuario real en el proceso que lo llama (se supone que lo ejecuta el applicant) es 0. Esto es útil para servicios no contectados en red, como <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry> o <citerefentry><refentrytitle>passwd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, a los que <literal>root</literal> debe tener acceso automático.
<citerefentry><refentrytitle>pam_securetty</refentrytitle><manvolnum>8</manvolnum></citerefentry> <citerefentry><refentrytitle>pam_securetty</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_securetty</refentrytitle><manvolnum>8</manvolnum></citerefentry> module El módulo <citerefentry><refentrytitle>pam_securetty</refentrytitle><manvolnum>8</manvolnum></citerefentry>
<citerefentry><refentrytitle>pam_self</refentrytitle><manvolnum>8</manvolnum></citerefentry> <citerefentry><refentrytitle>pam_self</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_self</refentrytitle><manvolnum>8</manvolnum></citerefentry> module reports success if and only if the names of the applicant matches that of the target account. It is most useful for non-networked services such as <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry>, where the identity of the applicant can be easily verified. El módulo <citerefentry><refentrytitle>pam_self</refentrytitle><manvolnum>8</manvolnum></citerefentry> informa de éxito si y solo si, los nombres del applicant coinciden con los de la cuenta de destino. Es más útil para servicios no conectados en red como <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry>, donde la identidad del solicitante se puede verificar fácilmente.
<citerefentry><refentrytitle>pam_ssh</refentrytitle><manvolnum>8</manvolnum></citerefentry> <citerefentry><refentrytitle>pam_ssh</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_ssh</refentrytitle><manvolnum>8</manvolnum></citerefentry> module provides both authentication and session services. The authentication service allows users who have passphrase-protected SSH secret keys in their <filename>~/.ssh</filename> directory to authenticate themselves by typing their passphrase. The session service starts <citerefentry><refentrytitle>ssh-agent</refentrytitle><manvolnum>1</manvolnum></citerefentry> and preloads it with the keys that were decrypted in the authentication phase. This feature is particularly useful for local logins, whether in X (using <citerefentry vendor="xfree86"><refentrytitle>xdm</refentrytitle><manvolnum>1</manvolnum></citerefentry> or another PAM-aware X login manager) or at the console. El módulo <citerefentry><refentrytitle>pam_ssh</refentrytitle><manvolnum>8</manvolnum></citerefentry> proporciona servicios de autenticación y sesión. El servicio de autenticación permit a los usuarios que tienen claves secretas SSH protegidas con contraseña en su directorio <filename>~/.ssh</filename> para autenticarse escribiendo su contraseña. El servicio de sesión inicia <citerefentry><refentrytitle>ssh-agent</refentrytitle><manvolnum>1</manvolnum></citerefentry> y lo precarga con las claves que se descifraron en la fase de autenticación. Esta característica es particularmente útil para inicios de sesión locales, ya sea en X (usando <citerefentry vendor="xfree86"><refentrytitle>xdm</refentrytitle><manvolnum>1</manvolnum></citerefentry> u otro administrador de inicio de sesión en el entorno X compatible con PAM) o en la consola.
<citerefentry><refentrytitle>pam_tacplus</refentrytitle><manvolnum>8</manvolnum></citerefentry> <citerefentry><refentrytitle>pam_tacplus</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_tacplus</refentrytitle><manvolnum>8</manvolnum></citerefentry> module El módulo <citerefentry><refentrytitle>pam_tacplus</refentrytitle><manvolnum>8</manvolnum></citerefentry>
<citerefentry><refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum></citerefentry> <citerefentry><refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum></citerefentry>
The <citerefentry><refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum></citerefentry> module implements traditional <trademark class="registered">UNIX</trademark> password authentication, using <citerefentry><refentrytitle>getpwnam</refentrytitle><manvolnum>3</manvolnum></citerefentry> to obtain the target account's password and compare it with the one provided by the applicant. It also provides account management services (enforcing account and password expiration times) and password-changing services. This is probably the single most useful module, as the great majority of admins will want to maintain historical behavior for at least some services. El módulo <citerefentry><refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum></citerefentry> implementa la autenticación con contraseña tradicional <trademark class="registered">UNIX</trademark>, usando <citerefentry><refentrytitle>getpwnam</refentrytitle><manvolnum>3</manvolnum></citerefentry> para obtener la contraseña de la cuenta de destino y compararla con la proporciona por el applicant. También proporciona servicios de administración de cuentas (cumplimiento con los tiempos de expiración de cuentas y contraseñas) y servicios de cambio de contraseñas. Este es probablemente el módulo más útil, ya que la gran mayoría de los administradores querrán mantener el comportamiento de siempre en al menos algunos servicios.
PAM Application Programming Programación de aplicaciones PAM
This section has not yet been written. Esta sección aún no se ha escrito.
PAM Module Programming Programación del módulo PAM
Sample PAM Application Ejemplo de aplicación PAM
The following is a minimal implementation of <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry> using PAM. Note that it uses the OpenPAM-specific <citerefentry><refentrytitle>openpam_ttyconv</refentrytitle><manvolnum>3</manvolnum></citerefentry> conversation function, which is prototyped in <filename>security/openpam.h</filename>. If you wish build this application on a system with a different PAM library, you will have to provide your own conversation function. A robust conversation function is surprisingly difficult to implement; the one presented in <xref linkend="pam-sample-conv"/> is a good starting point, but should not be used in real-world applications. El siguiente ejemplo es una implementación mínima del comando <citerefentry><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry> usando PAM. Tenga en cuenta que utiliza la función de conversación <citerefentry><refentrytitle>openpam_ttyconv</refentrytitle><manvolnum>3</manvolnum></citerefentry> específica de OpenPAM, que tiene su prototipo en <filename>security/openpam.h</filename>. Si desea compilar esta aplicación en un sistema con una libreria de PAM diferente, tendrá que proporcionar su propia función de conversación. Una función de conversación robusta es sorprendentemente difícil de implementar; el ejemplo del <xref linkend="pam-sample-conv"/> es un buen punto de partida, pero no debe utilizarse en aplicaciones del mundo real.
/*-
* Copyright (c) 2002,2003 Networks Associates Technology, Inc.
* All rights reserved.
*
* This software was developed for the FreeBSD Project by ThinkSec AS and
* Network Associates Laboratories, the Security Research Division of
* Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
* ("CBOSS"), as part of the DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $P4: //depot/projects/openpam/bin/su/su.c#10 $
* $FreeBSD: head/en_US.ISO8859-1/articles/pam/su.c 38826 2012-05-17 19:12:14Z hrs $
*/

#include &lt;sys/param.h&gt;
#include &lt;sys/wait.h&gt;

#include &lt;err.h&gt;
#include &lt;pwd.h&gt;
#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;string.h&gt;
#include &lt;syslog.h&gt;
#include &lt;unistd.h&gt;

#include &lt;security/pam_appl.h&gt;
#include &lt;security/openpam.h&gt; /* for openpam_ttyconv() */

extern char **environ;

static pam_handle_t *pamh;
static struct pam_conv pamc;

static void
usage(void)
{

fprintf(stderr, "Usage: su [login [args]]\n");
exit(1);
}

int
main(int argc, char *argv[])
{
char hostname[MAXHOSTNAMELEN];
const char *user, *tty;
char **args, **pam_envlist, **pam_env;
struct passwd *pwd;
int o, pam_err, status;
pid_t pid;

while ((o = getopt(argc, argv, "h")) != -1)
switch (o) {
case 'h':
default:
usage();
}

argc -= optind;
argv += optind;

if (argc &gt; 0) {
user = *argv;
--argc;
++argv;
} else {
user = "root";
}

/* initialize PAM */
pamc.conv = &amp;openpam_ttyconv;
pam_start("su", user, &amp;pamc, &amp;pamh);

/* set some items */
gethostname(hostname, sizeof(hostname));
if ((pam_err = pam_set_item(pamh, PAM_RHOST, hostname)) != PAM_SUCCESS)
goto pamerr;
user = getlogin();
if ((pam_err = pam_set_item(pamh, PAM_RUSER, user)) != PAM_SUCCESS)
goto pamerr;
tty = ttyname(STDERR_FILENO);
if ((pam_err = pam_set_item(pamh, PAM_TTY, tty)) != PAM_SUCCESS)
goto pamerr;

/* authenticate the applicant */
if ((pam_err = pam_authenticate(pamh, 0)) != PAM_SUCCESS)
goto pamerr;
if ((pam_err = pam_acct_mgmt(pamh, 0)) == PAM_NEW_AUTHTOK_REQD)
pam_err = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
if (pam_err != PAM_SUCCESS)
goto pamerr;

/* establish the requested credentials */
if ((pam_err = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS)
goto pamerr;

/* authentication succeeded; open a session */
if ((pam_err = pam_open_session(pamh, 0)) != PAM_SUCCESS)
goto pamerr;

/* get mapped user name; PAM may have changed it */
pam_err = pam_get_item(pamh, PAM_USER, (const void **)&amp;user);
if (pam_err != PAM_SUCCESS || (pwd = getpwnam(user)) == NULL)
goto pamerr;

/* export PAM environment */
if ((pam_envlist = pam_getenvlist(pamh)) != NULL) {
for (pam_env = pam_envlist; *pam_env != NULL; ++pam_env) {
putenv(*pam_env);
free(*pam_env);
}
free(pam_envlist);
}

/* build argument list */
if ((args = calloc(argc + 2, sizeof *args)) == NULL) {
warn("calloc()");
goto err;
}
*args = pwd-&gt;pw_shell;
memcpy(args + 1, argv, argc * sizeof *args);

/* fork and exec */
switch ((pid = fork())) {
case -1:
warn("fork()");
goto err;
case 0:
/* child: give up privs and start a shell */

/* set uid and groups */
if (initgroups(pwd-&gt;pw_name, pwd-&gt;pw_gid) == -1) {
warn("initgroups()");
_exit(1);
}
if (setgid(pwd-&gt;pw_gid) == -1) {
warn("setgid()");
_exit(1);
}
if (setuid(pwd-&gt;pw_uid) == -1) {
warn("setuid()");
_exit(1);
}
execve(*args, args, environ);
warn("execve()");
_exit(1);
default:
/* parent: wait for child to exit */
waitpid(pid, &amp;status, 0);

/* close the session and release PAM resources */
pam_err = pam_close_session(pamh, 0);
pam_end(pamh, pam_err);

exit(WEXITSTATUS(status));
}

pamerr:
fprintf(stderr, "Sorry\n");
err:
pam_end(pamh, pam_err);
exit(1);
}
 		/*-
* Copyright (c) 2002,2003 Networks Associates Technology, Inc.
* All rights reserved.
*
* This software was developed for the FreeBSD Project by ThinkSec AS and
* Network Associates Laboratories, the Security Research Division of
* Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
* ("CBOSS"), as part of the DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $P4: //depot/projects/openpam/bin/su/su.c#10 $
* $FreeBSD: head/en_US.ISO8859-1/articles/pam/su.c 38826 2012-05-17 19:12:14Z hrs $
*/

#include &lt;sys/param.h&gt;
#include &lt;sys/wait.h&gt;

#include &lt;err.h&gt;
#include &lt;pwd.h&gt;
#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;string.h&gt;
#include &lt;syslog.h&gt;
#include &lt;unistd.h&gt;

#include &lt;security/pam_appl.h&gt;
#include &lt;security/openpam.h&gt; /* for openpam_ttyconv() */

extern char **environ;

static pam_handle_t *pamh;
static struct pam_conv pamc;

static void
usage(void)
{

fprintf(stderr, "Usage: su [login [args]]\n");
exit(1);
}

int
main(int argc, char *argv[])
{
char hostname[MAXHOSTNAMELEN];
const char *user, *tty;
char **args, **pam_envlist, **pam_env;
struct passwd *pwd;
int o, pam_err, status;
pid_t pid;

while ((o = getopt(argc, argv, "h")) != -1)
switch (o) {
case 'h':
default:
usage();
}

argc -= optind;
argv += optind;

if (argc &gt; 0) {
user = *argv;
--argc;
++argv;
} else {
user = "root";
}

/* initialize PAM */
pamc.conv = &amp;openpam_ttyconv;
pam_start("su", user, &amp;pamc, &amp;pamh);

/* set some items */
gethostname(hostname, sizeof(hostname));
if ((pam_err = pam_set_item(pamh, PAM_RHOST, hostname)) != PAM_SUCCESS)
goto pamerr;
user = getlogin();
if ((pam_err = pam_set_item(pamh, PAM_RUSER, user)) != PAM_SUCCESS)
goto pamerr;
tty = ttyname(STDERR_FILENO);
if ((pam_err = pam_set_item(pamh, PAM_TTY, tty)) != PAM_SUCCESS)
goto pamerr;

/* authenticate the applicant */
if ((pam_err = pam_authenticate(pamh, 0)) != PAM_SUCCESS)
goto pamerr;
if ((pam_err = pam_acct_mgmt(pamh, 0)) == PAM_NEW_AUTHTOK_REQD)
pam_err = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
if (pam_err != PAM_SUCCESS)
goto pamerr;

/* establish the requested credentials */
if ((pam_err = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS)
goto pamerr;

/* authentication succeeded; open a session */
if ((pam_err = pam_open_session(pamh, 0)) != PAM_SUCCESS)
goto pamerr;

/* get mapped user name; PAM may have changed it */
pam_err = pam_get_item(pamh, PAM_USER, (const void **)&amp;user);
if (pam_err != PAM_SUCCESS || (pwd = getpwnam(user)) == NULL)
goto pamerr;

/* export PAM environment */
if ((pam_envlist = pam_getenvlist(pamh)) != NULL) {
for (pam_env = pam_envlist; *pam_env != NULL; ++pam_env) {
putenv(*pam_env);
free(*pam_env);
}
free(pam_envlist);
}

/* build argument list */
if ((args = calloc(argc + 2, sizeof *args)) == NULL) {
warn("calloc()");
goto err;
}
*args = pwd-&gt;pw_shell;
memcpy(args + 1, argv, argc * sizeof *args);

/* fork and exec */
switch ((pid = fork())) {
case -1:
warn("fork()");
goto err;
case 0:
/* child: give up privs and start a shell */

/* set uid and groups */
if (initgroups(pwd-&gt;pw_name, pwd-&gt;pw_gid) == -1) {
warn("initgroups()");
_exit(1);
}
if (setgid(pwd-&gt;pw_gid) == -1) {
warn("setgid()");
_exit(1);
}
if (setuid(pwd-&gt;pw_uid) == -1) {
warn("setuid()");
_exit(1);
}
execve(*args, args, environ);
warn("execve()");
_exit(1);
default:
/* parent: wait for child to exit */
waitpid(pid, &amp;status, 0);

/* close the session and release PAM resources */
pam_err = pam_close_session(pamh, 0);
pam_end(pamh, pam_err);

exit(WEXITSTATUS(status));
}

pamerr:
fprintf(stderr, "Sorry\n");
err:
pam_end(pamh, pam_err);
exit(1);
}
Sample PAM Module Ejemplo de módulo PAM
The following is a minimal implementation of <citerefentry><refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum></citerefentry>, offering only authentication services. It should build and run with most PAM implementations, but takes advantage of OpenPAM extensions if available: note the use of <citerefentry><refentrytitle>pam_get_authtok</refentrytitle><manvolnum>3</manvolnum></citerefentry>, which enormously simplifies prompting the user for a password. El siguiente ejemplo es una implementación mínima de <citerefentry><refentrytitle>pam_unix</refentrytitle><manvolnum>8</manvolnum></citerefentry>, ofrece solo servicios de autenticación. Debería de compilarse y ejecutarse con la mayoría de las implementaciones de PAM, pero aprovecha las extensiones de OpenPAM si están disponibles: tenga en cuenta el uso de <citerefentry><refentrytitle>pam_get_authtok</refentrytitle><manvolnum>3</manvolnum></citerefentry>, que simplifica enormemente la solicitud de una contraseña al usuario.
/*-
* Copyright (c) 2002 Networks Associates Technology, Inc.
* All rights reserved.
*
* This software was developed for the FreeBSD Project by ThinkSec AS and
* Network Associates Laboratories, the Security Research Division of
* Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
* ("CBOSS"), as part of the DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $P4: //depot/projects/openpam/modules/pam_unix/pam_unix.c#3 $
* $FreeBSD: head/en_US.ISO8859-1/articles/pam/pam_unix.c 38826 2012-05-17 19:12:14Z hrs $
*/

#include &lt;sys/param.h&gt;

#include &lt;pwd.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;stdio.h&gt;
#include &lt;string.h&gt;
#include &lt;unistd.h&gt;

#include &lt;security/pam_modules.h&gt;
#include &lt;security/pam_appl.h&gt;

#ifndef _OPENPAM
static char password_prompt[] = "Password:";
#endif

#ifndef PAM_EXTERN
#define PAM_EXTERN
#endif

PAM_EXTERN int
pam_sm_authenticate(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{
#ifndef _OPENPAM
struct pam_conv *conv;
struct pam_message msg;
const struct pam_message *msgp;
struct pam_response *resp;
#endif
struct passwd *pwd;
const char *user;
char *crypt_password, *password;
int pam_err, retry;

/* identify user */
if ((pam_err = pam_get_user(pamh, &amp;user, NULL)) != PAM_SUCCESS)
return (pam_err);
if ((pwd = getpwnam(user)) == NULL)
return (PAM_USER_UNKNOWN);

/* get password */
#ifndef _OPENPAM
pam_err = pam_get_item(pamh, PAM_CONV, (const void **)&amp;conv);
if (pam_err != PAM_SUCCESS)
return (PAM_SYSTEM_ERR);
msg.msg_style = PAM_PROMPT_ECHO_OFF;
msg.msg = password_prompt;
msgp = &amp;msg;
#endif
for (retry = 0; retry &lt; 3; ++retry) {
#ifdef _OPENPAM
pam_err = pam_get_authtok(pamh, PAM_AUTHTOK,
(const char **)&amp;password, NULL);
#else
resp = NULL;
pam_err = (*conv-&gt;conv)(1, &amp;msgp, &amp;resp, conv-&gt;appdata_ptr);
if (resp != NULL) {
if (pam_err == PAM_SUCCESS)
password = resp-&gt;resp;
else
free(resp-&gt;resp);
free(resp);
}
#endif
if (pam_err == PAM_SUCCESS)
break;
}
if (pam_err == PAM_CONV_ERR)
return (pam_err);
if (pam_err != PAM_SUCCESS)
return (PAM_AUTH_ERR);

/* compare passwords */
if ((!pwd-&gt;pw_passwd[0] &amp;&amp; (flags &amp; PAM_DISALLOW_NULL_AUTHTOK)) ||
(crypt_password = crypt(password, pwd-&gt;pw_passwd)) == NULL ||
strcmp(crypt_password, pwd-&gt;pw_passwd) != 0)
pam_err = PAM_AUTH_ERR;
else
pam_err = PAM_SUCCESS;
#ifndef _OPENPAM
free(password);
#endif
return (pam_err);
}

PAM_EXTERN int
pam_sm_setcred(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SUCCESS);
}

PAM_EXTERN int
pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SUCCESS);
}

PAM_EXTERN int
pam_sm_open_session(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SUCCESS);
}

PAM_EXTERN int
pam_sm_close_session(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SUCCESS);
}

PAM_EXTERN int
pam_sm_chauthtok(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SERVICE_ERR);
}

#ifdef PAM_MODULE_ENTRY
PAM_MODULE_ENTRY("pam_unix");
#endif
 		/*-
* Copyright (c) 2002 Networks Associates Technology, Inc.
* All rights reserved.
*
* This software was developed for the FreeBSD Project by ThinkSec AS and
* Network Associates Laboratories, the Security Research Division of
* Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
* ("CBOSS"), as part of the DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $P4: //depot/projects/openpam/modules/pam_unix/pam_unix.c#3 $
* $FreeBSD: head/en_US.ISO8859-1/articles/pam/pam_unix.c 38826 2012-05-17 19:12:14Z hrs $
*/

#include &lt;sys/param.h&gt;

#include &lt;pwd.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;stdio.h&gt;
#include &lt;string.h&gt;
#include &lt;unistd.h&gt;

#include &lt;security/pam_modules.h&gt;
#include &lt;security/pam_appl.h&gt;

#ifndef _OPENPAM
static char password_prompt[] = "Password:";
#endif

#ifndef PAM_EXTERN
#define PAM_EXTERN
#endif

PAM_EXTERN int
pam_sm_authenticate(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{
#ifndef _OPENPAM
struct pam_conv *conv;
struct pam_message msg;
const struct pam_message *msgp;
struct pam_response *resp;
#endif
struct passwd *pwd;
const char *user;
char *crypt_password, *password;
int pam_err, retry;

/* identify user */
if ((pam_err = pam_get_user(pamh, &amp;user, NULL)) != PAM_SUCCESS)
return (pam_err);
if ((pwd = getpwnam(user)) == NULL)
return (PAM_USER_UNKNOWN);

/* get password */
#ifndef _OPENPAM
pam_err = pam_get_item(pamh, PAM_CONV, (const void **)&amp;conv);
if (pam_err != PAM_SUCCESS)
return (PAM_SYSTEM_ERR);
msg.msg_style = PAM_PROMPT_ECHO_OFF;
msg.msg = password_prompt;
msgp = &amp;msg;
#endif
for (retry = 0; retry &lt; 3; ++retry) {
#ifdef _OPENPAM
pam_err = pam_get_authtok(pamh, PAM_AUTHTOK,
(const char **)&amp;password, NULL);
#else
resp = NULL;
pam_err = (*conv-&gt;conv)(1, &amp;msgp, &amp;resp, conv-&gt;appdata_ptr);
if (resp != NULL) {
if (pam_err == PAM_SUCCESS)
password = resp-&gt;resp;
else
free(resp-&gt;resp);
free(resp);
}
#endif
if (pam_err == PAM_SUCCESS)
break;
}
if (pam_err == PAM_CONV_ERR)
return (pam_err);
if (pam_err != PAM_SUCCESS)
return (PAM_AUTH_ERR);

/* compare passwords */
if ((!pwd-&gt;pw_passwd[0] &amp;&amp; (flags &amp; PAM_DISALLOW_NULL_AUTHTOK)) ||
(crypt_password = crypt(password, pwd-&gt;pw_passwd)) == NULL ||
strcmp(crypt_password, pwd-&gt;pw_passwd) != 0)
pam_err = PAM_AUTH_ERR;
else
pam_err = PAM_SUCCESS;
#ifndef _OPENPAM
free(password);
#endif
return (pam_err);
}

PAM_EXTERN int
pam_sm_setcred(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SUCCESS);
}

PAM_EXTERN int
pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SUCCESS);
}

PAM_EXTERN int
pam_sm_open_session(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SUCCESS);
}

PAM_EXTERN int
pam_sm_close_session(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SUCCESS);
}

PAM_EXTERN int
pam_sm_chauthtok(pam_handle_t *pamh, int flags,
int argc, const char *argv[])
{

return (PAM_SERVICE_ERR);
}

#ifdef PAM_MODULE_ENTRY
PAM_MODULE_ENTRY("pam_unix");
#endif
Sample PAM Conversation Function Ejemplo de función de conversación PAM
The conversation function presented below is a greatly simplified version of OpenPAM's <citerefentry><refentrytitle>openpam_ttyconv</refentrytitle><manvolnum>3</manvolnum></citerefentry>. It is fully functional, and should give the reader a good idea of how a conversation function should behave, but it is far too simple for real-world use. Even if you are not using OpenPAM, feel free to download the source code and adapt <citerefentry><refentrytitle>openpam_ttyconv</refentrytitle><manvolnum>3</manvolnum></citerefentry> to your uses; we believe it to be as robust as a tty-oriented conversation function can reasonably get. La función de conversación presentada a continuación es una versión muy simplificada de <citerefentry><refentrytitle>openpam_ttyconv</refentrytitle><manvolnum>3</manvolnum></citerefentry> de OpenPAM. Es completamente funcional y debería de dar al lector una buena idea de cómo debería de comportarse una función de conversación, pero es demasiado simple para su uso en el mundo real. Incluso si no está utilizando OpenPAM, no dude en descargar el código fuente y adaptar <citerefentry><refentrytitle>openpam_ttyconv</refentrytitle><manvolnum>3</manvolnum></citerefentry> a sus necesidades; creemos que es tan robusta como lo puede ser una función de conversación orientada a tty.
/*-
* Copyright (c) 2002 Networks Associates Technology, Inc.
* All rights reserved.
*
* This software was developed for the FreeBSD Project by ThinkSec AS and
* Network Associates Laboratories, the Security Research Division of
* Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
* ("CBOSS"), as part of the DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD: head/en_US.ISO8859-1/articles/pam/converse.c 38826 2012-05-17 19:12:14Z hrs $
*/

#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;string.h&gt;
#include &lt;unistd.h&gt;

#include &lt;security/pam_appl.h&gt;

int
converse(int n, const struct pam_message **msg,
struct pam_response **resp, void *data)
{
struct pam_response *aresp;
char buf[PAM_MAX_RESP_SIZE];
int i;

data = data;
if (n &lt;= 0 || n &gt; PAM_MAX_NUM_MSG)
return (PAM_CONV_ERR);
if ((aresp = calloc(n, sizeof *aresp)) == NULL)
return (PAM_BUF_ERR);
for (i = 0; i &lt; n; ++i) {
aresp[i].resp_retcode = 0;
aresp[i].resp = NULL;
switch (msg[i]-&gt;msg_style) {
case PAM_PROMPT_ECHO_OFF:
aresp[i].resp = strdup(getpass(msg[i]-&gt;msg));
if (aresp[i].resp == NULL)
goto fail;
break;
case PAM_PROMPT_ECHO_ON:
fputs(msg[i]-&gt;msg, stderr);
if (fgets(buf, sizeof buf, stdin) == NULL)
goto fail;
aresp[i].resp = strdup(buf);
if (aresp[i].resp == NULL)
goto fail;
break;
case PAM_ERROR_MSG:
fputs(msg[i]-&gt;msg, stderr);
if (strlen(msg[i]-&gt;msg) &gt; 0 &amp;&amp;
msg[i]-&gt;msg[strlen(msg[i]-&gt;msg) - 1] != '\n')
fputc('\n', stderr);
break;
case PAM_TEXT_INFO:
fputs(msg[i]-&gt;msg, stdout);
if (strlen(msg[i]-&gt;msg) &gt; 0 &amp;&amp;
msg[i]-&gt;msg[strlen(msg[i]-&gt;msg) - 1] != '\n')
fputc('\n', stdout);
break;
default:
goto fail;
}
}
*resp = aresp;
return (PAM_SUCCESS);
fail:
for (i = 0; i &lt; n; ++i) {
if (aresp[i].resp != NULL) {
memset(aresp[i].resp, 0, strlen(aresp[i].resp));
free(aresp[i].resp);
}
}
memset(aresp, 0, n * sizeof *aresp);
*resp = NULL;
return (PAM_CONV_ERR);
}
 		/*-
* Copyright (c) 2002 Networks Associates Technology, Inc.
* All rights reserved.
*
* This software was developed for the FreeBSD Project by ThinkSec AS and
* Network Associates Laboratories, the Security Research Division of
* Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
* ("CBOSS"), as part of the DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD: head/en_US.ISO8859-1/articles/pam/converse.c 38826 2012-05-17 19:12:14Z hrs $
*/

#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;string.h&gt;
#include &lt;unistd.h&gt;

#include &lt;security/pam_appl.h&gt;

int
converse(int n, const struct pam_message **msg,
struct pam_response **resp, void *data)
{
struct pam_response *aresp;
char buf[PAM_MAX_RESP_SIZE];
int i;

data = data;
if (n &lt;= 0 || n &gt; PAM_MAX_NUM_MSG)
return (PAM_CONV_ERR);
if ((aresp = calloc(n, sizeof *aresp)) == NULL)
return (PAM_BUF_ERR);
for (i = 0; i &lt; n; ++i) {
aresp[i].resp_retcode = 0;
aresp[i].resp = NULL;
switch (msg[i]-&gt;msg_style) {
case PAM_PROMPT_ECHO_OFF:
aresp[i].resp = strdup(getpass(msg[i]-&gt;msg));
if (aresp[i].resp == NULL)
goto fail;
break;
case PAM_PROMPT_ECHO_ON:
fputs(msg[i]-&gt;msg, stderr);
if (fgets(buf, sizeof buf, stdin) == NULL)
goto fail;
aresp[i].resp = strdup(buf);
if (aresp[i].resp == NULL)
goto fail;
break;
case PAM_ERROR_MSG:
fputs(msg[i]-&gt;msg, stderr);
if (strlen(msg[i]-&gt;msg) &gt; 0 &amp;&amp;
msg[i]-&gt;msg[strlen(msg[i]-&gt;msg) - 1] != '\n')
fputc('\n', stderr);
break;
case PAM_TEXT_INFO:
fputs(msg[i]-&gt;msg, stdout);
if (strlen(msg[i]-&gt;msg) &gt; 0 &amp;&amp;
msg[i]-&gt;msg[strlen(msg[i]-&gt;msg) - 1] != '\n')
fputc('\n', stdout);
break;
default:
goto fail;
}
}
*resp = aresp;
return (PAM_SUCCESS);
fail:
for (i = 0; i &lt; n; ++i) {
if (aresp[i].resp != NULL) {
memset(aresp[i].resp, 0, strlen(aresp[i].resp));
free(aresp[i].resp);
}
}
memset(aresp, 0, n * sizeof *aresp);
*resp = NULL;
return (PAM_CONV_ERR);
}
Further Reading Lecturas adicionales
This is a list of documents relevant to PAM and related issues. It is by no means complete. Esto es un listado de documentos relevantes sobre PAM y temas relacionados. El listado no está completo.
Papers Artículos
Making Login Services Independent of Authentication Technologies Hacer que los servicios de acceso sean independientes de las tecnologías de autenticación
<personname> <surname>Samar</surname> <firstname>Vipin</firstname> </personname> <personname> <surname>Samar</surname> <firstname>Vipin</firstname> </personname>
<personname> <surname>Lai</surname> <firstname>Charlie</firstname> </personname> <personname> <surname>Lai</surname> <firstname>Charlie</firstname> </personname>
Sun Microsystems Sun Microsystems
<link xlink:href="https://pubs.opengroup.org/onlinepubs/8329799/toc.htm">X/Open Single Sign-on Preliminary Specification</link> <link xlink:href="https://pubs.opengroup.org/onlinepubs/8329799/toc.htm">X/Open Single Sign-on Preliminary Specification</link>

Loading…

User avatar None

New source string

FreeBSD Doc (Archived) / articles_pam — Spanish

New source string a year ago
Browse all component changes

Glossary

English Spanish
No related strings found in the glossary.

Source information

Source string comment
(itstool) path: appendix/para
Source string location
article.translate.xml:1241
String age
a year ago
Source string age
a year ago
Translation file
articles/es_ES/pam.po, string 224