Linux-PAM系统管理员指南1.1.2：配置与安全实践

linux

需积分: 9 141 浏览量更新于2024-06-30 收藏 237KB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

《Linux-PAM系统管理员指南》1.1.2 是由 Andrew G. Morgan 和 Thorsten Kukuk 联合编写的文档，专注于为Linux平台上的系统管理员介绍PAM（Pluggable Authentication Modules）库的相关知识。该手册旨在帮助管理员正确理解和配置PAM，以确保系统的安全性和维护策略。首先，章节1介绍了手册的目的和背景，强调了作为系统管理员在使用PAM时所需具备的基本理解。接下来，章节2提供了一些关于手册文本的注释和建议，可能包括作者对最佳实践的看法或对某些配置技巧的提醒。在核心部分，章节3提供了PAM的概述，解释了其在Linux系统中的作用，即模块化认证和授权机制，如何增强系统的安全性，以及与其他系统服务的集成。随后的章节4详细讨论了PAM配置文件的语法和结构。管理员需要了解如何编写和组织配置文件，以实现不同的功能，如目录基础的配置管理和示例配置项。安全问题是章节5的重要议题，探讨了在配置过程中可能出现的问题以及如何避免薄弱环节，例如防止意外的错误配置导致系统安全漏洞，以及避免`other'配置过于宽松导致风险增加。章节5还强调了当出现问题时的应对策略。接着，章节6是PAM模块的参考指南，列举了多个实用模块及其功能。例如： 1. `pam_access-logdaemonstyleloginaccesscontrol`：用于记录登录尝试，有助于审计和监控。 2. `pam_cracklib-checksthepasswordagainstdictionarywords`：通过检查密码是否符合字典中的词汇，增强密码强度。 3. `pam_debug-debugthePAMstack`：模块用于调试PAM栈，帮助定位和解决问题。 4. `pam_deny-locking-outPAMmodule`：防止某个模块频繁失败后锁定用户账户，提供更好的用户体验。 5. `pam_echo-printtextmessages`：控制PAM在执行过程中的消息输出。 6. `pam_env-set/unsetenvironmentvariables`：设置或清除环境变量，适用于需要特定环境变量的模块。 7. `pam_exec-c`：允许执行外部命令，以便实现复杂的认证逻辑。总结来说，《Linux-PAM系统管理员指南》1.1.2是系统管理员必备的参考资料，它详细解释了如何通过PAM来增强Linux系统的安全性、配置管理以及处理各种安全相关的模块。通过学习和遵循这份手册，管理员能够更有效地管理他们的系统，确保其安全可靠。

资源详情

资源推荐

Chapter 5. Security issues

5.1. If something goes wrong

Linux-PAM has the potential to seriously change the security of your system. You can choose to have no

security or absolute security (no access permitted). In general, Linux-PAM errs towards the latter. Any

number of configuration errors can disable access to your system partially, or completely.

The most dramatic problem that is likely to be encountered when configuring Linux-PAM is that of deleting

the configuration file(s): /etc/pam.d/* and/or /etc/pam.conf. This will lock you out of your own

system!

To recover, your best bet is to restore the system from a backup or boot the system into a rescue system

and correct things from there.

5.2. Avoid having a weak `other' configuration

It is not a good thing to have a weak default (other) entry. This service is the default configuration for all

PAM aware applications and if it is weak, your system is likely to be vulnerable to attack.

Here is a sample "other" configuration file. The pam_deny module will deny access and the pam_warn

module will send a syslog message to auth.notice:

# The PAM configuration file for the `other' service

auth required pam_deny.so

auth required pam_warn.so

account required pam_deny.so

account required pam_warn.so

password required pam_deny.so

password required pam_warn.so

session required pam_deny.so

session required pam_warn.so

Chapter 6. A reference guide for

available modules

Here, we collect together the descriptions of the various modules coming with Linux-PAM.

6.1. pam_access - logdaemon style login ac-

cess control

pam_access.so [ debug ] [ nodefgroup ] [ noaudit ] [ accessfile=file ] [ fieldsep=sep ] [ listsep=sep

]

6.1.1. DESCRIPTION

The pam_access PAM module is mainly for access management. It provides logdaemon style login access

control based on login names, host or domain names, internet addresses or network numbers, or on terminal

line names, X $DISPLAY values, or PAM service names in case of non-networked logins.

By default rules for access management are taken from config file /etc/security/access.conf

if you don't specify another file.

If Linux PAM is compiled with audit support the module will report when it denies access based on origin

(host, tty, etc.).

6.1.2. DESCRIPTION

The /etc/security/access.conf file specifies (user/group, host), (user/group, net-

work/netmask), (user/group, tty), (user/group, X-$DISPLAY-value), or (user/group,

pam-service-name) combinations for which a login will be either accepted or refused.

When someone logs in, the file access.conf is scanned for the first entry that matches the (user/

group, host) or (user/group, network/netmask) combination, or, in case of non-networked

logins, the first entry that matches the (user/group, tty) combination, or in the case of non-net-

worked logins without a tty, the first entry that matches the (user/group, X-$DISPLAY-value) or

(user/group, pam-service-name/) combination. The permissions field of that table entry deter-

mines whether the login will be accepted or refused.

Each line of the login access control table has three fields separated by a ":" character (colon):

permission:users/groups:origins

The first field, the permission field, can be either a "+" character (plus) for access granted or a "-"

character (minus) for access denied.

The second field, the users/group field, should be a list of one or more login names, group names,

or ALL (which always matches). To differentiate user entries from group entries, group entries should be

written with brackets, e.g. (group).

The third field, the origins field, should be a list of one or more tty names (for non-networked logins),

X $DISPLAY values or PAM service names (for non-networked logins without a tty), host names, domain

names (begin with "."), host addresses, internet network numbers (end with "."), internet network addresses

with network mask (where network mask can be a decimal number or an internet address also), ALL (which

A reference guide for

available modules

always matches) or LOCAL. The LOCAL keyword matches if and only if pam_get_item(3), when called

with an item_type of PAM_RHOST, returns NULL or an empty string (and therefore the origins

field is compared against the return value of pam_get_item(3) called with an item_type of PAM_TTY

or, absent that, PAM_SERVICE).

If supported by the system you can use @netgroupname in host or user patterns. The @@netgroupname

syntax is supported in the user pattern only and it makes the local system hostname to be passed to the

netgroup match call in addition to the user name. This might not work correctly on some libc implemen-

tations causing the match to always fail.

The EXCEPT operator makes it possible to write very compact rules.

If the nodefgroup is not set, the group file is searched when a name does not match that of the logged-

in user. Only groups are matched in which users are explicitly listed. However the PAM module does not

look at the primary group id of a user.

The "#" character at start of line (no space at front) can be used to mark this line as a comment line.

6.1.3. OPTIONS

accessfile=/path/to/

access.conf

Indicate an alternative access.conf style configuration file to

override the default. This can be useful when different services need

different access lists.

debug A lot of debug information is printed with syslog(3).

noaudit Do not report logins from disallowed hosts and ttys to the audit

subsystem.

fieldsep=separators This option modifies the field separator character that pam_access

will recognize when parsing the access configuration file. For ex-

ample: fieldsep=| will cause the default `:' character to be treated

as part of a field value and `|' becomes the field separator. Doing

this may be useful in conjunction with a system that wants to use

pam_access with X based applications, since the PAM_TTY item is

likely to be of the form "hostname:0" which includes a `:' character

in its value. But you should not need this.

listsep=separators This option modifies the list separator character that pam_access

will recognize when parsing the access configuration file. For ex-

ample: listsep=, will cause the default ` ' (space) and `\t' (tab) char-

acters to be treated as part of a list element value and `,' becomes the

only list element separator. Doing this may be useful on a system

with group information obtained from a Windows domain, where

the default built-in groups "Domain Users", "Domain Admins" con-

tain a space.

nodefgroup User tokens which are not enclosed in parentheses will not be

matched against the group database. The backwards compatible de-

fault is to try the group database match even for tokens not enclosed

in parentheses.

6.1.4. MODULE TYPES PROVIDED

All module types (auth, account, password and session) are provided.

剩余85页未读，继续阅读

「已注销」

粉丝: 5
资源: 1

会员权益专享

Linux-PAM系统管理员指南1.1.2：配置与安全实践

The Linux-Pam System Administrator Guide.pdf

The Linux-Pam Application Developer's Guide.pdf

Linux-PAM-1.3.0.tar.gz_PAM_linux_pam 1.3.1

Linux-PAM-1.1.8.tar.bz2下载

1. Linux-RHCE-VSFTPD服务- 安装VSFTPD服务

13. Linux-RHCE-VSFTPD服务- 虚拟用户认证

17. Linux-RHCE-VSFTPD服务- 被动模式端口范围设置

linux-pam_SAG下载

linux-pam-1.3.1.tar.xz下载

linux-pam-1.3.1.tar.xz

linux-pam-1.3.1.tar

linux-pam源码包下载

基带4-pam信号在awng信道下的传输性能

统一身份认证-PAM

libssl-dev libpam-dev的源码安装包

disable-plugin-auth-pam

可见光4X4mimo-PAM4系统的信噪比和误码率的MATLAB代码

/etc/pam.d/system-auth

用matlab仿真，用基带等效的方式重新仿真4-PAM载波调制信号在AWGN信道下的误码率和误比特率性能,并与理论值相比较。假设符号周期为1s，载波频率为10Hz，每个符号周期内采样100个点。

会员权益专享

最新资源