Linux PAM: Difference between revisions

Revision as of 04:51, 2 November 2010

Latest revision as of 05:54, 6 May 2025

(46 intermediate revisions by 38 users not shown)

Line 1:

{{Short description|Software library to manage authentication on Linux}}

{{nofootnotes|date=September 2010}}

{{Infobox software

{{primarysources|date=August 2008}}

| name = Linux PAM

'''Linux Pluggable Authentication Modules''' (PAM) provide dynamic authorization for applications and services in a [[Linux]] system. Linux PAM is evolved from the [[Unix]] [[Pluggable Authentication Modules]] architecture.

| title = Linux PAM

| logo = <!-- Image name is enough -->

| logo caption =

| logo size =

| logo alt =

| screenshot = <!-- Image name is enough -->

| caption =

| screenshot size =

| screenshot alt =

| author =

| developer =

| released = <!-- {{Start date and age|YYYY|MM|DD|df=yes/no}} -->

| discontinued =

| latest release version = {{wikidata|property|preferred|references|edit|Q6555077|P348|P548=Q2804309}}

| latest release date = {{wikidata|qualifier|preferred|single|Q6555077|P348|P548=Q2804309|P577}}

| latest preview version =

| latest preview date = <!-- {{Start date and age|YYYY|MM|DD|df=yes/no}} -->

| programming language = [[C (programming language)|C]]

| operating system = [[Linux]]

| platform =

| size =

| genre = authentication

| repo = {{URL|github.com/linux-pam/linux-pam}}

| license = [[GNU General Public License]] or [[Modified BSD License]]

| website = {{URL|linux-pam.org}}

}}

'''Linux Pluggable Authentication Modules''' (PAM) is a suite of libraries that allow a Linux [[system administrator]] to configure methods to [[Authentication|authenticate]] users. It provides a flexible and centralized way to switch authentication methods for secured applications by using configuration files instead of changing application code.<ref>{{Cite web|title=Chapter 1. Introduction|url=http://www.linux-pam.org/Linux-PAM-html/sag-introduction.html|access-date=2023-11-11|website=An Internet Archive page of Linux PAM site|archive-url=https://web.archive.org/web/20210506140423/http://www.linux-pam.org/Linux-PAM-html/sag-introduction.html |archive-date=2021-05-06 }}</ref> There are Linux PAM libraries allowing authentication using methods such as local passwords, [[Lightweight Directory Access Protocol|LDAP]], or fingerprint readers.<ref>{{Cite web|last=Lauber|first=Susan|date=2020-07-22|title=An introduction to Pluggable Authentication Modules (PAM) in Linux|url=https://www.redhat.com/sysadmin/pluggable-authentication-modules-pam|access-date=2021-02-28|website=Red Hat|language=en}}</ref> Linux PAM is evolved from the [[Unix]] [[Pluggable Authentication Modules]] architecture.<ref>{{Cite web|url=https://www.linuxjournal.com/article/5940|title=Securing Applications on Linux with PAM {{!}} Linux Journal|last1=Fernandes|first1=Savio|last2=Reddy|first2=KLM|website=[[Linux Journal]]|language=en|access-date=2018-09-30}}</ref>

Linux-PAM separates the tasks of authentication into four independent management groups:<ref>{{Cite web|title=pam.d(8): Pluggable Authentication Modules for - Linux man page|url=https://linux.die.net/man/8/pam.d|access-date=2021-02-28|website=linux.die.net}}</ref>

* Accountaccount modules check that the specified account is a valid authentication target under current conditions. This may include conditions like account expiration, time of day, and that the user has access to the requested service.

* Authenticationauthentication modules verify the user's identity, for example by requesting and checking a password or other secret. They may also pass authentication information on to other systems like a [[Keyring (cryptography)|keyring]].

* Passwordpassword modules are responsible for updating passwords, and are generally coupled to modules employed in the authentication step. They may also be used to enforce strong passwords.

* Sessionsession modules define actions that are performed at the beginning and end of sessions. A session starts after the user has successfully authenticated.

== See also ==

There are four groups for independent management:

{{Portal|Linux|Free and open-source software}}

*[[Pluggable Authentication Modules]]

* [[OpenPAM]]

==References==

* Account modules check that the specified account is a valid authentication target under current conditions. This may include conditions like account expiration, time of day, and that the user has access to the requested service.

{{Reflist}}

* Authentication modules verify the user's identity, for example by requesting and checking a password or other secret. They may also pass authentication information on to other systems like a [[keyring]].

* Password modules are responsible for updating passwords, and are generally coupled to modules employed in the authentication step. They may also be used to enforce strong passwords.

* Session modules define actions that are performed at the beginning and end of sessions. A session starts after the user has successfully authenticated.

== See also ==

* [[OpenPAM]]

==External links==

* [http://www.kernellinux-pam.org/pub/linux/libs/pam/ Primary distribution site for the Linux-PAM pageproject]

* [httphttps://linuxgithub.die.netcom/man/8linux-pam/linux-pam.d pam.d(8)Development -site for the Linux-PAM man pageproject]

* [http://wwwaplawrence.kernel.orgcom/pubBasics/linux/libs/pam/whatispamunderstandingpam.html What''Understanding is Linux-PAM?'', by A.P. Lawrence]

{{Linux kernel}}

[[Category:Linux kernel features]]

[[Category:Computer access control frameworks]]

{{Security-software-stub}}