Michael Tinker September 16, 2004 PAM LDAP Michael Tinker September 16, 2004

Content Preview PAM motivation and design PAM internals LDAP overview PAM LDAP authentication

Motivation for PAM Problems with traditional authentication… authentication built into system entry services little administrative flexibility difficulty in upgrading Pluggable Authentication Modules (PAM) use a generic, modular authentication framework

The PAM Framework The PAM framework presents a generic API to applications needing authentication, and a generic SPI to modules providing authentication.

PAM Design Goals The PAM framework allows for: setting a default authentication scheme per application configuration authentication over protocol stacks transparent low-level authentication pluggable authentication-related modules

The PAM API for Applications Interface overview: pam_start(service_name, user, pam_conversation, handle) pam_authenticate(handle) Transparently authenticate the user named in pam_start pam_acct_mgmt(handle) Check account and password expiration dates, etc pam_open/close_session(handle) Log user interaction, mount directories, etc. pam_chauthtok(handle) Change the user’s authentication token pam_end(handle) Implemented in libpam.so, libpam_misc.so

The PAM SPI PAM API for Service Modules SPI Interface: pam_get/set_item(handle, item_type, item) Get information associated with this handle SPI Interface: pam_sm_authenticate(handle) Authenticate the user in the transaction pointed to by handle pam_sm_acct_mgmt(handle) Service provider analog of pam_acct_mgmt() pam_sm_open/close_session(handle) Service provider analog of pam_open/close_session() pam_sm_chauthtok(handle) Ditto Implemented in every service module, e.g. pam_unix.so, pam_mail.so, pam_tally.so, pam_krb4.so…

Using PAM Use Linux as example The /etc/pam.d directory Contains configuration files for PAM-compliant applications on the system The files define how authentication-related tasks for their application should be handled Example,

PAM Configuration Files Syntax: module-type control-flag module-path args Example: auth sufficient pam_userdb.so db=/tmp/dbtest auth required pam_unix.so use_first_pass debug Possible module types: auth, account, session, password Control flag options: required, requisite, sufficient, optional Most modules support a set of generic arguments

Module Types auth account session password User authentication and credential-granting (corresponds to pam_authenticate()) account Account management (pam_acct_mgmt()) session Events beginning or ending service use (pam_open/close_session()) password Authentication token management (pam_chauthtok())

Control Flags and Module Stacks PAM can use a “stack” of modules e.g. for service ftpd: auth sufficient pam_ftp.so auth required pam_unix.so use_first_pass Control flag required means module must succeed for authentication to occur Flag requisite is required plus immediate return after failure Flag sufficient means module success allows authentication unless a required module has already failed Control flag optional indicates that a module does not affect authentication success

Generic Optional Arguments debug Use syslog() to log debugging information use_first_pass Use stored authentication token from previous module in the stack Allows for unified login use_mapped_pass Generate a key to recover the authentication token required by the module expose_account Be friendly

Example Configuration File

What is LDAP? Lightweight Directory Access Protocol Based on X.500, provides a mechanism to distribute information over a network using a hierarchy of servers Allows secure transmission using SSL An excellent choice to avoid replicating user account information over multiple hosts Information is also categorized hierarchically by distinguished names (DN), e.g. UID=mtinker, OU=STUDENT, OU=CSCE,O=UAF,C=USA

Sample LDAP Entry Attributes connected to a DN, again example UID=mtinker,OU=STUDENT, OU=CSCE, O=UAF, C=USA objectclass: account loginshell: /bin/bash uidnumber: 112970 homedirectory: /home/mtinker userpassword: {crypt}KDnOoUYN7Neac

PAM LDAP Install the pam_ldap.so library Configure /etc/ldap.conf Specifies LDAP server location, DN of the search base, trusted CA database Edit /etc/pam.d/myApp As in example configuration file Probably use NSS LDAP as well

PAM/LDAP Schematic