Chapter 7. Pluggable Authentication Modules (PAM)

113

7.3.2. Creating Modules

New PAM modules can be added at any time, and PAM aware applications can then use them. For

example, if you create a one time password creation method and write a PAM module to support

it, PAM aware programs can immediately use the new module and password method without being

recompiled or otherwise modified. This is very beneficial because it lets you mix and match, as well

as test, authentication methods for different programs without recompiling them.

Documentation on writing modules is included with the system in the

/usr/share/doc/pam 

version number/

directory.

7.4. PAM Module Control Flags

All PAM modules generate a success or failure result when checked. Control flags tell PAM what do

with the result. Since modules can be stacked in a particular order, control flags give you the ability

to set the importance of a module in respect to the modules that follow it.

Again, consider the

rlogin

PAM configuration file:

auth

required

/lib/security/pam_nologin.so

auth

required

/lib/security/pam_securetty.so

auth

required

/lib/security/pam_env.so

auth

sufficient

/lib/security/pam_rhosts_auth.so

auth

required

/lib/security/pam_stack.so service=system auth

Important

The order in which required modules are called is not critical. The sufficient and requisite

control flags is what causes order to become important. See below for an explanation of each type

of control flag.

After the module type is specified, the control flags decide how important the success or failure of that

particular module should be in the overall goal of allowing access to the service.

Four types of control flags are defined by the PAM standard:

  required

  the module must be successfully checked in order to allow authentication. If a

re 

quired

module check fails, the user is not notified until all other modules of the same module type

have been checked.

  requisite

  the module must be successfully checked in order for the authentication to be suc 

cessful. However, if a

requisite

module check fails, the user is notified immediately with a

message reflecting the first failed

required

or

requisite

module.

  sufficient

  the module checks are ignored if it fails. But, if a

sufficient

flagged module

is successfully checked and no

required

flagged modules above it have failed, then no other

modules of this module type are checked and the user is authenticated.

  optional

  the module checks are ignored if it fails. If the module check is successful, it does

not play a role in the overall success or failure for that module type. The only time a module flagged

as

optional

is necessary for successful authentication is when no other modules of that type have

succeeded or failed. In this case, an

optional

module determines the overall PAM authentication

for that module type.