Book Image

Pluggable Authentication Modules: The Definitive Guide to PAM for Linux SysAdmins and C Developers

By : Kenneth Geisshirt
Book Image

Pluggable Authentication Modules: The Definitive Guide to PAM for Linux SysAdmins and C Developers

By: Kenneth Geisshirt

Overview of this book

<p>PAM-aware applications reduce the complexity of authentication. With PAM you can use the same user database for every login process. PAM also supports different authentication processes as required. Moreover, PAM is a well-defined API, and PAM-aware applications will not break if you change the underlying authentication configuration.<br /><br />The PAM framework is widely used by most Linux distributions for authentication purposes. Originating from Solaris 2.6 ten years ago, PAM is used today by most proprietary and free UNIX operating systems including GNU/Linux, FreeBSD, and Solaris, following both the design concept and the practical details. PAM is thus a unifying technology for authentication mechanisms in UNIX. <br /><br />PAM is a modular and flexible authentication management layer that sits between Linux applications and the native underlying authentication system. PAM can be implemented with various applications without having to recompile the applications to specifically support PAM.</p>
Table of Contents (13 chapters)

PAM Implementations


As mentioned previously, PAM is not a new framework. Today, many operating systems are using PAM for authentication, including Solaris, GNU/Linux, FreeBSD, NetBSD, Mac OS X, AIX 5L, and HP-UX 11. OpenVMS does not implement PAM but uses a similar concept called ACME, and OpenBSD does not use PAM but PAM can be added.

FreeBSD and NetBSD share the code base for PAM. In older versions of FreeBSD, Linux-PAM is used, but in newer versions (5.x and 6.x) OpenPAM is used. According to the design principles of OpenPAM, it tries to take the best from the PAM implementations under Solaris and GNU/Linux. The OpenPAM implementation has a limited number of modules in the default installation but in the port collection (archive of FreeBSD packages) a larger set of PAM modules can be found.

The situation in the Linux world is somewhat more complicated. The Linux-PAM project lives a quiet life and has just reach version 0.99 (April 2006). The major Linux distributions are using PAM, including Novell/SuSE, Red Hat, and Debian/Ubuntu. It seems that Slackware is probably the last pocket of resistance. The table below correlates the version of the distributions and Linux-PAM. As the table indicates the diversity is large. The current versions of Linux-PAM is 0.99.6 and it seems that the Linux distributions do not follow the advancement of Linux-PAM development, as they are using older versions. For example, Ubuntu Linux is a very popular distribution due to its frequent updates to recent version of software. But in the case of PAM, Ubuntu 6.10 (November 2006) is using a version of Linux-PAM released in March 2005. Exceptions are SuSE Linux Enterprise Server 10 and Fedora Core 6, which use recent versions of Linux-PAM.

Distribution

Version

PAM version

Features

Released

SuSE Linux Enterprise Server

8

0.76

 

July 2002

9

0.77

Some third-party modules

September 2002

9 service pack 3

0.77

Some third-party modules

December 2005

10

0.99.3

 

January 2006

Red Hat Enterprise Linux

3 update 6

0.75

 

April 2001

4

0.77

 

September 2002

4 update 4

0.77

Newer build

April 2006

Fedora Core

5

0.78

 

November 2004

6

0.99.6.2

 

November 2006

Debian GNU/Linux

3.1 release 2

0.76

Many third-party modules

July 2002

4.0

0.79

Many third-party modules

Excepted December 2006

Ubuntu Linux

5.10

0.76

Many third-party modules

October 2005

6.06

0.77

Many third-party modules

July 2006

6.10

0.79

Many third-party modules

November 2006

Arch Linux

0.7.1

0.81

 

November 2005