Book Image

Pluggable Authentication Modules: The Definitive Guide to PAM for Linux SysAdmins and C Developers

By : Kenneth Geisshirt
Book Image

Pluggable Authentication Modules: The Definitive Guide to PAM for Linux SysAdmins and C Developers

By: Kenneth Geisshirt

Overview of this book

<p>PAM-aware applications reduce the complexity of authentication. With PAM you can use the same user database for every login process. PAM also supports different authentication processes as required. Moreover, PAM is a well-defined API, and PAM-aware applications will not break if you change the underlying authentication configuration.<br /><br />The PAM framework is widely used by most Linux distributions for authentication purposes. Originating from Solaris 2.6 ten years ago, PAM is used today by most proprietary and free UNIX operating systems including GNU/Linux, FreeBSD, and Solaris, following both the design concept and the practical details. PAM is thus a unifying technology for authentication mechanisms in UNIX. <br /><br />PAM is a modular and flexible authentication management layer that sits between Linux applications and the native underlying authentication system. PAM can be implemented with various applications without having to recompile the applications to specifically support PAM.</p>
Table of Contents (13 chapters)

Test Cases


One of the major disciplines of software engineering is how to do testing. A test suite cannot prove that the software is working due to the limited set of test cases. To prove the correctness of computer software is one of the harder disciplines of theoretical computer science. Instead a test suite is used to find as many errors or bugs as possible. A test case consists of both the user input and the expected outcome.

The behavior of PAM can be very complex. To find a minimum set of test cases can be difficult. For example, in some situations, accounts are required to expire after 60 days of inactivity. Expiration of an account is difficult to test since you are supposed to wait for 60 days. In order to perform such a test case, you can move the clock ahead by 60 days instead of waiting. But such a test case can often be safely ignored since expiration is not configured directly by PAM.

While testing a particular service, three possibilities for each module must be considered:

  • Valid...