Linux PAM

Linux PAM
Name	Linux PAM
Operating system	Linux
Genre	Authentication framework
License	GNU General Public License

Linux PAM

Linux PAM is a modular authentication framework used on Linux systems to integrate multiple authentication technologies and services. It provides a pluggable interface that allows system administrators and developers to combine modules from projects like OpenLDAP, Kerberos, SSSD, PAM-aware software stacks, and vendor-specific solutions. The framework is embedded in many distributions such as Debian, Red Hat Enterprise Linux, Ubuntu, and SUSE Linux Enterprise, enabling interoperability with services like Systemd, sudo, sshd, lightdm, and graphical display managers.

Overview

Linux PAM acts as an intermediary between application programs and authentication mechanisms, providing a unified API used by services including systemd-logind, cron, NetworkManager, and Postfix. Its design allows integration with centralized identity stores such as FreeIPA, Microsoft Active Directory, and Red Hat Identity Management. Linux PAM originated from efforts tied to projects like Sun Microsystems's PAM work and was standardized in implementations referenced by distributions maintained by organizations such as The Debian Project and Red Hat, Inc.. Typical deployments connect to infrastructure components like NSS and directory servers using protocols such as LDAP and Kerberos.

Architecture and Modules

The architecture separates responsibilities into discrete module types: auth, account, session, and password handlers. Modules are implemented as shared libraries written in languages like C and loaded by PAM-aware applications such as sshd, sudo, gdm, and sssd. Common third-party and upstream modules originate from projects such as pam_unix (traditional Unix authentication), pam_ldap (LDAP integration), pam_krb5 (Kerberos integration), and modules provided by Linux-PAM reference implementations. Module interactions follow control flags like required, requisite, sufficient, and optional—concepts used in documentation maintained by communities including Debian and Red Hat, Inc..

Configuration and Files

Configuration is typically located under /etc/pam.d and in a legacy file /etc/pam.conf; distributions manage package-specific configuration snippets for services like sshd, login, cron, and gdm. Files reference modules by pathname and control flags, directing behavior for stacks used by processes and daemons such as systemd, sshd, cupsd, and vsftpd. Administrators often coordinate PAM configuration with files governing account databases and name resolution such as /etc/nsswitch.conf and services tied to SSSD or Winbind from Samba when integrating with Microsoft Active Directory.

Authentication Management

Authentication management uses auth modules to verify credentials, interact with token services, and invoke challenge–response workflows used by systems like Kerberos, RSA SecurID, or hardware tokens managed through vendors and standards such as FIDO and Yubico. PAM-aware applications like sshd and sudo call the PAM API to apply multi-factor stacks combining modules from projects including pam_pwquality, pam_tally2, and pam_google_authenticator. Integration with networked identity systems such as FreeIPA and OpenLDAP enables single sign-on and cross-service authentication workflows used in enterprise environments run by organizations such as Red Hat, Inc. and Canonical.

Account, Session, and Password Management

Account management modules enforce authorization policies, account expiration, and resource limits working alongside tools like login, systemd-logind, and container runtimes influenced by LXC and Docker. Session modules perform setup and teardown actions such as mounting home directories via autofs or triggering user session records in systems like auditd and systemd-journald. Password modules handle hashing policies and complexity enforcement interoperating with libraries and standards such as OpenSSL, libgcrypt, and hashing algorithms standardized by organizations like IETF and implementations in projects like cryptsetup.

Implementations and Integrations

Multiple implementations and distributions provide PAM stacks and modules: reference implementations from projects historically tied to Sun Microsystems and maintained by communities including The Open Group standards influences, distribution packages from Debian, Red Hat Enterprise Linux, SUSE Linux Enterprise, and third-party modules from vendors such as Microsoft (via SSSD/Winbind), Yubico, and commercial identity providers. Integrations extend to authentication services such as Kerberos realms managed by MIT or Heimdal, directory services like OpenLDAP and 389 Directory Server, and cloud identity providers used by organizations like Amazon Web Services and Google.

Security and Best Practices

Security guidance emphasizes least-privilege, auditability, and defense in depth: combine modules from vetted sources such as OpenSSL-linked packages and distribution-maintained modules from Debian or Red Hat, Inc. repositories. Best practices include using multi-factor authentication with protocols endorsed by FIDO and IETF specifications, centralizing authentication with FreeIPA or Active Directory via SSSD, and monitoring with tools like auditd and osquery. Administrators should test PAM configurations in staging environments and follow advisories from organizations such as CERT Coordination Center and distribution security teams at Debian Security Team and Red Hat Product Security.

Category:Linux security