- So we have just talked about ACLs and attributes,
a totally different local security fee here is PAM,
Pluggable Authentication Modules.
So PAM helps separate the specific authentication approach
from the binary that needs it.
And PAM also provides modules
that may be used by different binaries.
And it can be used to enhance security
in different environments.
PAM Tally2 for instance, can be used to put restrictions
on errors that may happen during the log in procedure.
PAM is a very rich environment. Let's explore it.
So to start with, I want to give you LDD,
(keyboard tapping)
on which login, which is showing all the different libraries
that are used by the login binary,
including LibPAM and LibPAM misc.
That's good, that means that login is a binary
that is PAM compatible using the PAM libraries.
And that means that you can use
the PAM framework to configure it.
Now in PAM we have ETC PAM.D, and in ETC PAM.D
we see the different PAM configuration files.
Typically the name of the configuration file
corresponds to the name of the service
or program that is using it.
So if you have a look at login, now what do we see?
We see the PAM configuration.
In this PAM configuration we have three columns.
The first column is about the face
of the authentication procedure,
and that consists of four phases,
auth, account, password and session.
Where auth is the first phase in the authentication.
Account is checking account configuration
to see if any files like PAM no login apply for instance.
Password is password related.
And session is to further specify
what is going to happen in a specific session.
Now you can have required, which is a very common one
which means that you need to meet the conditions in this PAM
or include, which is including another configuration file.
A very common include a system auth for instance,
which is a generic PAM configuration
that is used by multiple services.
In the last column,
you can find the name of the different PAM libraries.
And these libraries is what PAM is all about,
because PAM is using these libraries, and that means
that you can easily add a different method
to your authentication procedure.
So let's check out these libraries.
PAM SE Linux.so for instance, they are in Lib64 security.
And there we can see all the PAMs that are available.
Now I want to work out an example,
that helps us understand how PAM is working
and that is PAM SecureTTY.so.
What is that?
Well, you may have heard of the file ETC SecureTTY,
which is an old file and this old file
is used to define TTYs,
on which it is considered secure for the root user to login.
Now at this point, if I'm using ETC SecureTTY,
now we can see the file does not exist.
And if I'm putting only TTY4 in there as a SecureTTY,
then it's not working, and I can show you
if I use CHVT3 to open a TTY, a virtual terminal
on TTY 3, then this is what I get
and I try to login as the root user, and it works.
Now let me use CHVT2 to get back to the graphical interface,
because I want this ETC SecureTTY to be effective
and I wanna make sure that root can only log in on TTY4.
Not that it makes sense for you to only be able
to login on TTY4, but hey it's just an example.
I want to show you how PAM is working.
Now how are we going to do that?
Well, let's try man on PAM_SecureTTY.
These PAMs have a man page,
and what I'm looking for is right here.
PAM should be used as a required authentication method
before any sufficient authentication methods.
Well that means that it belongs to the auth module,
and I need to make sure that this PAM SecureTTY
is included in the auth module of the login procedure.
So I am going to edit the ETC PAM.D login file,
and in there I'm going to use auth.
(keyboard tapping) Required.
(keyboard tapping)
PAM SecureTTY.SO. (keyboard tapping)
And now I'm going to try it again.
So I am using CHVT3, where the root user is still logged in.
No problem, let's log him out.
So this is proof that PAM is working for TTY4,
and blocking access on TTY3.
Now let me get back to TTY2, there we go.
And now I do have one little issue, and that's these users
that are logged in on TTY 3, and TTY 4.
Not really related to the topic, but there's login CTL.
Login CTL is a part of system D,
and it allows you to manage sessions.
So in login CTL, I can use list sessions,
(keyboard tapping)
where we can see the different sessions.
And well, I want to terminate session six and session seven.
So how do we do that?
Well that would be terminate session.
(keyboard tapping)
For session six and session seven as well.
W again, and now these users are gone
and my system is secure again.
Good, it's up to you to decide
if you want to clean this up or not.
I think it's pretty cool, this ETC SecureTTY.
One final thing, and that is the generic PAM.
So we need to get back to ETC PAM.D
(keyboard tapping)
where we have the different PAMs,
and the system auth is file that I would like to check.
This system auth is the generic PAM that is included
by many different services, and in this generic PAM
we have auth sufficient on PAM UNIX.SO, which means
that if you have a user account that could be verified
through ETC pass WD, you're in.
If not, then that's not a problem.
Then you still have a chance to login through triple SD.
Triple SD is a service that is trying
to get you authenticated using LDAP.
If that's also not working, PAM Deny.SO, no access.
PAM deny is a nice less rule,
that will deny all access if you haven't been able
to authenticate based on any of the previous modules.