Book Image

Pluggable Authentication Modules: The Definitive Guide to PAM for Linux SysAdmins and C Developers

By : Kenneth Geisshirt
Book Image

Pluggable Authentication Modules: The Definitive Guide to PAM for Linux SysAdmins and C Developers

By: Kenneth Geisshirt

Overview of this book

<p>PAM-aware applications reduce the complexity of authentication. With PAM you can use the same user database for every login process. PAM also supports different authentication processes as required. Moreover, PAM is a well-defined API, and PAM-aware applications will not break if you change the underlying authentication configuration.<br /><br />The PAM framework is widely used by most Linux distributions for authentication purposes. Originating from Solaris 2.6 ten years ago, PAM is used today by most proprietary and free UNIX operating systems including GNU/Linux, FreeBSD, and Solaris, following both the design concept and the practical details. PAM is thus a unifying technology for authentication mechanisms in UNIX. <br /><br />PAM is a modular and flexible authentication management layer that sits between Linux applications and the native underlying authentication system. PAM can be implemented with various applications without having to recompile the applications to specifically support PAM.</p>
Table of Contents (13 chapters)

Directory Services


In the UNIX world, directory services like NIS and NIS+ have a long history, but both are fairly tight-coupled with UNIX. Integrating Linux in a NIS environment does not require any modification in the PAM configuration, while the Name Service Switch (NSS) in the GNU C Library embraces NIS for authentication purposes, and the pam_unix module can be used.

The Lightweight Directory Access Protocol (LDAP) is on the other hand a generic framework, and a set of protocols and data format, which can be used to capture any information about an organization—including users and computers.

Many vendors have embraced LDAP, but one particular implementation is very popular—Microsoft Active Directory (AD). AD is Microsoft's own version of LDAP and Kerberos. Prior to AD, Microsoft had its proprietary mechanisms for authenticating users. But even Microsoft is approaching integration with Linux/UNIX by using open standards. Of course, Microsoft adds small deviations to the open standards...