In this video, you'll learn about PAM.
So PAM is Pluggable Authentication Modules.
It is what makes authentication pluggable, and that is useful.
Let's imagine that you are a device vendor and you want to introduce your fingerprint
reader.
And in order to integrate this in the Linux authentication, it uses a specific library.
Well, that is what PAM is doing.
It integrates libraries into the authentication procedure to extend the possibilities of authentication.
And the nice thing about it is that it helps separating the specific authentication approach
from the binary that is actually going to need it.
PAM also helps in providing modules that may be used by different binaries, and it can
be used to enhance security in different environments.
PAM Tally 2, for instance, can be used to put restrictions on errors that may happen
during the boot procedure.
Now let's have a quick look at PAM so that you understand what is going on.
It's not my purpose to make you a specialist here, but the goal is to know how it can be
used to influence the authentication procedure.
To start with, I'm going to use LDD on which logging.
And there we can see that it is using libpam and libpam-misc.
Now what does that mean?
Well, that means that in etcpam.d, there is a configuration, and here we can find this
login configuration file.
And in this login configuration file, it distinguishes four different phases in the authentication.
Auth is where the user makes initial contact.
Account is where account settings are checked.
Password is where password requirements are verified.
And then session is for opening a session and providing access to the specific resources.
Now you can see that for some of them, a specific module is called.
Like here, session require pam-se-linux.so.
That's something that makes sense on a Red Hat system, but on an Ubuntu system that doesn't
come with SE Linux by default, you won't find this.
What do you think of this?
Auth required pam-nologin.so.
This is what makes it if you create a file with the name nologin in the root of your
file system, then nobody except the root user can log in.
We can also see an include of system auth.
Now behind this system auth is the idea that the same thing needs to happen over and over
again by many different services.
So here we can see the common modules, where for auth, it reads the environment.
We have a fill delay, which makes it you can only try it for so long.
Then we have pam-unix.so, and pam-unix.so is making sure that you authenticate based
on etc passwd.
Here we have another one that is interesting as well, pam-pw-quality, which is integrated
in the password phase.
That makes sure that your password meets the appropriate quality.
You can also see that most of the phases have a pam-deny at the end, meaning that if you
don't pass the required option here and the sufficient option here, well, then you will
hit the pam-deny and you won't get into the system.
Now what about the pw-quality?
Well the fun thing is that TAM has many man pages.
So let's do a pw-quality in man-k, and now we can see pam-pw-quality.
And I think you don't have to guess where this is configured.
So let's check out etc security.
That's where they typically are, pw-quality.com.
Yes, pam modules normally are configured through files in etc security.
And here we can see an example of pw-quality, including an explanation of all that you can
do to make sure that your passwords are secure.
You don't need to know all the details about pam, but you do need to know that it is used
in the authentication procedure to make authentication really modular.