Linux-PAM

2013-04-15

PAM=Pluggable authentication module

Linux-PAM is a free implementation of the following DCE-RFC from Sunsoft.

Basically, it is a flexible mechanism for authenticating users.

Since the beginnings of UNIX, authenticating a user has been accomplished via the user entering a password and the system checking if the entered password corresponds to the encrypted official password that is stored in /etc/passwd . The idea being that the user *is* really that user if and only if they can correctly enter their secret password.

That was in the beginning. Since then, a number of new ways of authenticating users have become popular. Including more complicated replacements for the /etc/passwd file, and hardware devices Smart cards etc..

The problem is that each time a new authentication scheme is developed, it requires all the necessary programs (login, ftpd etc...) to be rewritten to support it.

PAM provides a way to develop programs that are independent of authentication scheme. These programs need "authentication modules" to be attatched to them at run-time in order to work. Which authentication module is to be attatched is dependent upon the local system setup and is at the discretion of the local system administrator.

Linux-PAM(Pluggable Authentication Modules for Linux.基于Linux的插入式验证模块)是一组共享库,使用这些模块,系统管理者可以自由选择应用程序使用的验证机制。也就是说,勿需重新编译应用程序就可以切换应用程序使用的验证机制。甚至,不必触动应用程序就可以完全升级系统使用的验证机制。

在历史上,需要对用户进行验证的应用程序,必须同某种验证机制编译到一起。例如,传统的UN*X系统是使用密码对用户进行校验的。用户输入的密码经过crypt加密后,然后和/etc/passwd文件中的密文进行比较。在这种系统中,如果优先权的识别不是基于这种方式,就需要通过用户识别符和用户组识别符对优先权进行验证。服务和应用程序可以使用基于用户和用户组识别的验证方式。通常,用户组的分配是通过/etc/group文件。

不幸的是,随着计算机速度的加快和网络的大范围普及,使用这种验证方式越来越不安全了。因此,人们开发了许多新的验证方法。

Linux-PAM工程的目的就是分离应用软件和验证机制的开发。通过验证函数库可以实现上述目的。PAM库由本地的系统配置文件 /etc/pam.conf或者/etc/pam.d/目录下的一些配置文件来设置。而模块以动态可加载目标文件(使用dloptn(3)函数打开)的形式保存在/usr/lib/security目录中。

Linux-PAM处理四种独立的(管理)工作。它们是: 认证管理; 帐号管理; 会话期间管理;和密码管理。 The association of the preferred management scheme with the behavior of an application is made with entries in the relevant Linux-PAM configuration file. 管理的功能由配置文件中指定的模块来完成。

参考:
http://www.linux-pam.org/

分类:操作系统 | 标签: |

相关日志

评论被关闭!