LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 10-26-2008, 12:42 PM   #1
bourne
Member
 
Registered: Feb 2006
Location: Toronto, Ontario
Distribution: Fedora 10, centos
Posts: 181

Rep: Reputation: 30
Help with PAM and PAM modules


Hey guys..

I am attempting to experiment with PAM on an extra machine that I have laying around. I don't know very much about PAM other then the fact that it deals with security on the system.

I am currently playing around with the syste-config-network command in the /etc/pam.d file. I read somewhere that it was possible to make the file so that users using the console could access the network config without having to enter the root password and then make it so that anyone else would have to enter the root password. I think I have managed to narrow down the module that I need to use to accomplish this: pam_console.so

So far though I haven't been able to get the syntax proper. I have been able to make it so that anyone can access the file both from the console and using the GUI without having to enter the root password. But I haven't been able to make it so that only users using something other then the console have to enter the root password.

Can anyone possible point me to some documentation on the proper syntax to achieve this?

Any suggestions or help would greatly be appreciated
Thank you in advance

cheers
 
Old 10-27-2008, 04:07 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,666
Blog Entries: 54

Rep: Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952
Quote:
Originally Posted by bourne View Post
I have been able to make it so that anyone can access the file both from the console and using the GUI without having to enter the root password.
In general the GUI part AFAIK relies on regular users having /usr/bin before /bin and /sbin in their path and the app being linked to (/usr/bin/?)userhelper. So I'm wondering if you could you describe how you did achieve your goal by other means? And do you have any reason for not using a Sudo NOPASSWD entry?
 
Old 10-28-2008, 10:12 PM   #3
bourne
Member
 
Registered: Feb 2006
Location: Toronto, Ontario
Distribution: Fedora 10, centos
Posts: 181

Original Poster
Rep: Reputation: 30
Quote:
Originally Posted by unSpawn View Post
In general the GUI part AFAIK relies on regular users having /usr/bin before /bin and /sbin in their path and the app being linked to (/usr/bin/?)userhelper. So I'm wondering if you could you describe how you did achieve your goal by other means? And do you have any reason for not using a Sudo NOPASSWD entry?
Well I hope that I am able to answer your question. I am still very new to the configuration of PAM and its modules.

I managed to achieve what I did using the pam_console.so. I added this option to the system-config-network file in the /etc/pam.d. I am not sure if it was the addition of that module or if it was me just messing around with the entries in that file that enabled the ability to bypass the login or not.

and I didn't use the sudo NOPASSWD entry because I was not aware of it before to be honest . As I mentioned before I still very new to PAM and security in general so I am doing my best to learn

hope I was able to somewhat answer your question
Sorry for the late response


cheers

todd
 
Old 10-29-2008, 03:54 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,666
Blog Entries: 54

Rep: Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952Reputation: 2952
NP, you're not late.


Wrt your OP question
Quote:
Originally Posted by bourne View Post
HI have been able to make it so that anyone can access the file both from the console and using the GUI without having to enter the root password. But I haven't been able to make it so that only users using something other then the console have to enter the root password.
I would roll back your edits and read the /usr/share/doc/pam-.*/txts/README.pam_.* files and the manual pages for consolehelper and userhelper. That could help give you better understanding of PAM to discuss the things you're trying to do?...
 
Old 10-30-2008, 10:53 AM   #5
bourne
Member
 
Registered: Feb 2006
Location: Toronto, Ontario
Distribution: Fedora 10, centos
Posts: 181

Original Poster
Rep: Reputation: 30
Quote:
Originally Posted by unSpawn View Post
NP, you're not late.


Wrt your OP question

I would roll back your edits and read the /usr/share/doc/pam-.*/txts/README.pam_.* files and the manual pages for consolehelper and userhelper. That could help give you better understanding of PAM to discuss the things you're trying to do?...
Thank you very much for your suggestion I will indeed attempt to do that. PAM to me seems to be very confusing but I realize that it is something important that I should learn. I will read the documentation and hopefully be able to better formulate a question

thank you again


cheers

todd
 
Old 11-01-2008, 01:09 PM   #6
aclark
LQ Newbie
 
Registered: Nov 2008
Distribution: RHEL
Posts: 2

Rep: Reputation: 0
Have you checked out the PAM-USB module?

Andy
 
Old 11-03-2008, 12:48 AM   #7
bourne
Member
 
Registered: Feb 2006
Location: Toronto, Ontario
Distribution: Fedora 10, centos
Posts: 181

Original Poster
Rep: Reputation: 30
Quote:
Originally Posted by aclark View Post
Have you checked out the PAM-USB module?

Andy
No actually I have not checked it out. Is it able to do something similar to what I am trying to do? I will have to check it out and see if I can get it and use it in the way I need it to

thank you for your suggestion


cheers

todd
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
PAM module:passwd:- how many character validate by pam library amit_pansuria Linux - General 3 10-21-2008 02:19 AM
Detailed Examples of PAM Modules? krishvij Linux - Newbie 1 03-14-2005 08:32 PM
vsftpd + pam + virtual users - Pam cannot load database file. mdkelly069 Linux - Networking 3 09-23-2004 12:07 AM
Pam Mephisto Slackware 1 01-22-2003 03:35 AM


All times are GMT -5. The time now is 06:09 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration