SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Pluggable Authentication Module</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Pluggable Authentication Module</span></span>

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style>

<p>A <b>pluggable authentication module</b> (<b>PAM</b>) is a mechanism to integrate multiple low-level <a href="Authentication" title="Authentication">authentication</a> schemes into a high-level <a href="Application_programming_interface" class="mw-redirect" title="Application programming interface">application programming interface</a> (API). PAM allows programs that rely on authentication to be written independently of the underlying authentication scheme. It was first proposed by <a href="Sun_Microsystems" title="Sun Microsystems">Sun Microsystems</a> in an <a href="Open_Software_Foundation" title="Open Software Foundation">Open Software Foundation</a> <a href="Request_for_Comments" title="Request for Comments">Request for Comments</a> (RFC) 86.0 dated October 1995.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> It was adopted as the authentication framework of the <a href="Common_Desktop_Environment" title="Common Desktop Environment">Common Desktop Environment</a>. As a stand-alone <a href="Open-source" class="mw-redirect" title="Open-source">open-source</a> infrastructure, PAM first appeared in <a href="Red_Hat_Linux" title="Red Hat Linux">Red Hat Linux</a> 3.0.4 in August 1996 in the <a href="Linux_PAM" title="Linux PAM">Linux PAM</a> project. PAM is currently supported in the <a href="AIX_operating_system" class="mw-redirect" title="AIX operating system">AIX operating system</a>, <a href="DragonFly_BSD" title="DragonFly BSD">DragonFly BSD</a>,<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> <a href="FreeBSD" title="FreeBSD">FreeBSD</a>, <a href="HP-UX" title="HP-UX">HP-UX</a>, <a href="Linux" title="Linux">Linux</a>, <a href="MacOS" title="MacOS">macOS</a>, <a href="NetBSD" title="NetBSD">NetBSD</a> and <a href="Solaris_(operating_system)" class="mw-redirect" title="Solaris (operating system)">Solaris</a>.

</p><p>Since no central standard of PAM behavior exists, there was a later attempt to standardize PAM as part of the <a href="X/Open" title="X/Open">X/Open</a> UNIX standardization process, resulting in the <b>X/Open Single Sign-on</b> (<b>XSSO</b>) standard. This standard was not ratified, but the standard draft has served as a reference point for later PAM implementations (for example, <a href="OpenPAM" title="OpenPAM">OpenPAM</a>).

</p>

<div class="mw-heading mw-heading2"><h2 id="Criticisms">Criticisms</h2></div>

<p>Since most PAM implementations do not interface with remote clients themselves, PAM, on its own, cannot implement <a href="Kerberos_(protocol)" title="Kerberos (protocol)">Kerberos</a>, the most common type of <a href="Single_sign-on" title="Single sign-on">SSO</a> used in Unix environments. This led to SSO's incorporation as the "primary authentication" portion of the would-be XSSO standard and the advent of technologies such as <a href="SPNEGO" title="SPNEGO">SPNEGO</a> and <a href="Simple_Authentication_and_Security_Layer" title="Simple Authentication and Security Layer">SASL</a>. This lack of functionality is also the reason <a href="Secure_Shell" title="Secure Shell">SSH</a> does its own authentication mechanism negotiation.

</p><p>In most PAM implementations, pam_krb5 only fetches <a href="Ticket_Granting_Ticket" title="Ticket Granting Ticket">Ticket Granting Tickets</a>, which involves prompting the user for credentials, and this is only used for the initial login in an SSO environment. To fetch a service ticket for a particular application, and not prompt the user to enter credentials again, that application must be specifically coded to support Kerberos. This is because pam_krb5 cannot itself get service tickets, although there are versions of PAM-KRB5 that are attempting to work around the issue.<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup>

</p>

<ul><li>Implementations:

<ul><li><a href="Java_Authentication_and_Authorization_Service" title="Java Authentication and Authorization Service">Java Authentication and Authorization Service</a></li>

<li><a href="Linux_PAM" title="Linux PAM">Linux PAM</a></li>

<li><a href="OpenPAM" title="OpenPAM">OpenPAM</a></li></ul></li>

<li><a href="Identity_management" class="mw-redirect" title="Identity management">Identity management</a> – the general topic</li>

<li><a href="Name_Service_Switch" title="Name Service Switch">Name Service Switch</a> – manages user databases</li>

<li><a href="System_Security_Services_Daemon" title="System Security Services Daemon">System Security Services Daemon</a> – SSO implementation based on PAM and NSS</li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

<li id="cite_note-1"><span class="mw-cite-backlink"><b><a href="#cite_ref-1">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="https://www.kernel.org/pub/linux/libs/pam/pre/doc/rfc86.0.txt.gz">The Original Solaris PAM RFC</a></span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://leaf.dragonflybsd.org/cgi/web-man?command=pam&section=ANY">PAM manual page of DragonFly BSD</a></span>

</li>

</li>

</ol></div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<p>Specifications:

</p>

<ul><li><a rel="nofollow" class="external text" href="https://www.kernel.org/pub/linux/libs/pam/pre/doc/rfc86.0.txt.gz">The Original Solaris PAM RFC</a></li>

<li><a rel="nofollow" class="external text" href="https://pubs.opengroup.org/onlinepubs/8329799/toc.pdf">X/Open Single Sign-on (XSSO) 1997 Draft Working Paper</a></li></ul>

<p>Guides:

</p>

<ul><li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20130819174111/http://www.linux.ie/articles/pam.php">PAM and password control</a> at the <a href="Wayback_Machine" title="Wayback Machine">Wayback Machine</a> (archived August 19, 2013)</li>

<li><a rel="nofollow" class="external text" href="http://www.linuxjournal.com/article/2120">Pluggable Authentication Modules for Linux</a></li>

<li><a rel="nofollow" class="external text" href="http://www.informit.com/articles/article.aspx?p=20968">Making the Most of Pluggable Authentication Modules (PAM)</a></li>

<li><a rel="nofollow" class="external text" href="http://docs.oracle.com/cd/E23824_01/html/821-1456/pam-1.html">Oracle Solaris Administration: Security Services: Using PAM</a></li></ul>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1236075235">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox" aria-labelledby="Authentication330" style="padding:3px"><table class="nowraplinks hlist mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><style data-mw-deduplicate="TemplateStyles:r1239400231">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div id="Authentication330" style="font-size:114%;margin:0 4em"><a href="Authentication" title="Authentication">Authentication</a></div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%">Authentication<br>APIs</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="BSD_Authentication" title="BSD Authentication">BSD Authentication</a> (BSD Auth)</li>

<li><a href="EAuthentication" class="mw-redirect" title="EAuthentication">eAuthentication</a> (eAuth)</li>

<li><a href="Generic_Security_Services_Application_Program_Interface" class="mw-redirect" title="Generic Security Services Application Program Interface">Generic Security Services API</a> (GSSAPI)</li>

<li><a href="Java_Authentication_and_Authorization_Service" title="Java Authentication and Authorization Service">Java Authentication and Authorization Service</a> (JAAS)</li>

<li><a href="Pluggable_authentication_module" class="mw-redirect" title="Pluggable authentication module">Pluggable Authentication Modules</a> (PAM)</li>

<li><a href="Simple_Authentication_and_Security_Layer" title="Simple Authentication and Security Layer">Simple Authentication and Security Layer</a> (SASL)</li>

<li><a href="Security_Support_Provider_Interface" title="Security Support Provider Interface">Security Support Provider Interface</a> (SSPI)</li>

<li><a href="XUDA" title="XUDA">XCert Universal Database API</a> (XUDA)</li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Authentication_protocol" title="Authentication protocol">Authentication<br>protocols</a></th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">

<li><a href="Authentication_and_Key_Agreement_(protocol)" class="mw-redirect" title="Authentication and Key Agreement (protocol)">Authentication and Key Agreement</a> (AKA)</li>

<li><a href="CAVE-based_authentication" title="CAVE-based authentication">CAVE-based authentication</a></li>

<li><a href="Challenge-Handshake_Authentication_Protocol" title="Challenge-Handshake Authentication Protocol">Challenge-Handshake Authentication Protocol</a> (CHAP)

<li><a href="Central_Authentication_Service" title="Central Authentication Service">Central Authentication Service</a> (CAS)</li>

<li><a href="Diameter_(protocol)" title="Diameter (protocol)">Diameter</a></li>

<li><a href="Extensible_Authentication_Protocol" title="Extensible Authentication Protocol">Extensible Authentication Protocol</a> (EAP)</li>

<li><a href="Host_Identity_Protocol" title="Host Identity Protocol">Host Identity Protocol</a> (HIP)</li>

<li><a href="IndieAuth" title="IndieAuth">IndieAuth</a></li>

<li><a href="Kerberos_(protocol)" title="Kerberos (protocol)">Kerberos</a></li>

<li><a href="LAN_Manager" title="LAN Manager">LAN Manager</a></li>

<li><a href="NT_LAN_Manager" class="mw-redirect" title="NT LAN Manager">NT LAN Manager</a> (NTLM)</li>

<li><a href="OAuth" title="OAuth">OAuth</a></li>

<li><a href="OpenID" title="OpenID">OpenID</a></li>

<li><a href="OpenID_Connect" class="mw-redirect" title="OpenID Connect">OpenID Connect</a> (OIDC)</li>

<li><a href="Password-authenticated_key_agreement" title="Password-authenticated key agreement">Password-authenticated key agreement</a> protocols</li>

<li><a href="Password_Authentication_Protocol" title="Password Authentication Protocol">Password Authentication Protocol</a> (PAP)</li>

<li><a href="Protected_Extensible_Authentication_Protocol" title="Protected Extensible Authentication Protocol">Protected Extensible Authentication Protocol</a> (PEAP)</li>

<li><a href="RADIUS" title="RADIUS">Remote Access Dial In User Service</a> (RADIUS)</li>

<li><a href="Resource_Access_Control_Facility" title="Resource Access Control Facility">Resource Access Control Facility</a> (RACF)</li>

<li><a href="Secure_Remote_Password_protocol" title="Secure Remote Password protocol">Secure Remote Password protocol</a> (SRP)</li>

<li><a href="TACACS" title="TACACS">TACACS</a></li>

</div></td></tr><tr><td class="navbox-abovebelow" colspan="2"><div>

<ul><li><span class="noviewer" typeof="mw:File"><span title="Category"></span></span> Category</li>

<li><span class="noviewer" typeof="mw:File"><span title="Commons page"></span></span> <a href="https://commons.wikimedia.org/wiki/Category:Authentication" class="extiw external" title="commons:Category:Authentication">Commons</a></li></ul>

</div></td></tr></tbody></table></div>

<p><br>

</p>

/* start https://en.wikipedia.org/ */

.mw-parser-output .asbox{position:relative;overflow:hidden}.mw-parser-output .asbox table{background:transparent}.mw-parser-output .asbox p{margin:0}.mw-parser-output .asbox p+p{margin-top:0.25em}.mw-parser-output .asbox-body{font-style:italic}.mw-parser-output .asbox-note{font-size:smaller}.mw-parser-output .asbox .navbar{position:absolute;top:-0.75em;right:1em;display:none}.mw-parser-output :not(p):not(.asbox)+style+.asbox,.mw-parser-output :not(p):not(.asbox)+link+.asbox{margin-top:3em}

/* end https://en.wikipedia.org/ */

</style></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-02-08" href="https://en.wikipedia.org/wiki/?title=Pluggable_Authentication_Module&oldid=1274615444">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>