PAM (Overview)

The Pluggable Authentication Module (PAM) framework lets you “plug in” new authentication services without changing system services, such as login, su, and ssh. You can also use PAM to integrate UNIX login with other security mechanisms such as Kerberos. Mechanisms for account, credential, session, and password management can also be “plugged in” by using this framework.

Benefits of Using PAM

The PAM framework enables you to configure the use of system services (such as, su, login, or ssh) for user authentication. Some benefits that PAM provides are as follows:

• Flexible configuration policy

  • Per-application authentication policy

  • Per-user authentication policy

  • The ability to choose a default authentication mechanism

  • The ability to require multiple authorizations on high-security systems

• Ease of use for the end user

  • No retyping of passwords if the passwords are the same for different authentication services

  • The ability to prompt the user for passwords for multiple authentication services without requiring the user to type multiple commands

• The ability to pass options to the user authentication services

• The ability to implement a site-specific security policy without having to change the system entry services

Introduction to the PAM Framework

The PAM framework consists of four parts:

• PAM consumers

• PAM library

• PAM configuration

• PAM service modules, also referred to as providers

The framework provides a uniform way for authentication-related activities to take place. This approach enables application developers to use PAM services without having to know the semantics of the policy. Algorithms are centrally supplied. The algorithms can be modified independently of the individual applications. With PAM, administrators can tailor the authentication process to the needs of a particular system without having to change any applications. Adjustments are made through the PAM configuration.

The following figure illustrates the PAM architecture. Applications communicate with the PAM library through the PAM application programming interface (API). PAM modules communicate with the PAM library through the PAM service provider interface (SPI). Thus, the PAM library enables applications and modules to communicate with each other.

Figure 14-1 PAM Architecture

Changes to PAM for This Release

The PAM framework included in the Oracle Solaris 11.1 release includes several new features including:

• definitive control flag

• per-service configuration

• per-user configuration