/usr/share/doc/pam/html/

/usr/share/doc/pam/html

Name	Size	Mode	Actions
Linux-PAM_SAG.html	9196	0644	edit dl rm
sag-author.html	3111	0644	edit dl rm
sag-configuration-directory.html	2966	0644	edit dl rm
sag-configuration-example.html	5522	0644	edit dl rm
sag-configuration-file.html	17519	0644	edit dl rm
sag-configuration.html	3065	0644	edit dl rm
sag-copyright.html	3617	0644	edit dl rm
sag-introduction.html	4446	0644	edit dl rm
sag-module-reference.html	38152	0644	edit dl rm
sag-overview.html	7995	0644	edit dl rm
sag-pam_access.html	18120	0644	edit dl rm
sag-pam_cracklib.html	20271	0644	edit dl rm
sag-pam_debug.html	8087	0644	edit dl rm
sag-pam_deny.html	4704	0644	edit dl rm
sag-pam_echo.html	5752	0644	edit dl rm
sag-pam_env.html	12796	0644	edit dl rm
sag-pam_exec.html	8371	0644	edit dl rm
sag-pam_faildelay.html	4590	0644	edit dl rm
sag-pam_filter.html	9342	0644	edit dl rm
sag-pam_ftp.html	6203	0644	edit dl rm
sag-pam_group.html	10136	0644	edit dl rm
sag-pam_issue.html	6378	0644	edit dl rm
sag-pam_keyinit.html	7015	0644	edit dl rm
sag-pam_lastlog.html	8524	0644	edit dl rm
sag-pam_limits.html	18114	0644	edit dl rm
sag-pam_listfile.html	10534	0644	edit dl rm
sag-pam_localuser.html	5446	0644	edit dl rm
sag-pam_loginuid.html	5209	0644	edit dl rm
sag-pam_mail.html	7762	0644	edit dl rm
sag-pam_mkhomedir.html	6196	0644	edit dl rm
sag-pam_motd.html	7753	0644	edit dl rm
sag-pam_namespace.html	20640	0644	edit dl rm
sag-pam_nologin.html	5332	0644	edit dl rm
sag-pam_permit.html	4304	0644	edit dl rm
sag-pam_pwhistory.html	8476	0644	edit dl rm
sag-pam_rhosts.html	6404	0644	edit dl rm
sag-pam_rootok.html	5109	0644	edit dl rm
sag-pam_securetty.html	6480	0644	edit dl rm
sag-pam_selinux.html	8313	0644	edit dl rm
sag-pam_shells.html	4261	0644	edit dl rm
sag-pam_succeed_if.html	9154	0644	edit dl rm
sag-pam_time.html	9725	0644	edit dl rm
sag-pam_timestamp.html	6889	0644	edit dl rm
sag-pam_umask.html	6318	0644	edit dl rm
sag-pam_unix.html	15056	0644	edit dl rm
sag-pam_userdb.html	8585	0644	edit dl rm
sag-pam_warn.html	4569	0644	edit dl rm
sag-pam_wheel.html	7181	0644	edit dl rm
sag-pam_xauth.html	8420	0644	edit dl rm
sag-security-issues-other.html	2993	0644	edit dl rm
sag-security-issues-wrong.html	2963	0644	edit dl rm
sag-security-issues.html	2161	0644	edit dl rm
sag-see-also.html	2283	0644	edit dl rm
sag-text-conventions.html	3187	0644	edit dl rm

Edit: /usr/share/doc/pam/html/sag-introduction.html (4446B)

<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Chapter 1. Introduction</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="up" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="prev" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="next" href="sag-text-conventions.html" title="Chapter 2. Some comments on the text"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. Introduction</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Linux-PAM_SAG.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="sag-text-conventions.html">Next</a></td></tr></table><hr></div><div class="chapter"><div class="titlepage"><div><div><h1 class="title"><a name="sag-introduction"></a>Chapter 1. Introduction</h1></div></div></div><p>
      <span class="emphasis"><em>Linux-PAM</em></span> (Pluggable Authentication
      Modules for Linux) is a suite of shared libraries that enable the
      local system administrator to choose how applications authenticate users.
    </p><p>
      In other words, without (rewriting and) recompiling a PAM-aware
      application, it is possible to switch between the authentication
      mechanism(s) it uses. Indeed, one may entirely upgrade the local
      authentication system without touching the applications themselves.
    </p><p>
      Historically an application that has required a given user to be
      authenticated, has had to be compiled to use a specific authentication
      mechanism.  For example, in the case of traditional UN*X systems, the
      identity of the user is verified by the user entering a correct
      password.  This password, after being prefixed by a two character
      ``salt'', is encrypted (with crypt(3)). The user is then authenticated
      if this encrypted password is identical to the second field of the
      user's entry in the system password database (the
      <code class="filename">/etc/passwd</code> file).  On such systems, most if
      not all forms of privileges are granted based on this single
      authentication scheme. Privilege comes in the form of a personal
      user-identifier (UID) and membership of various groups. Services and
      applications are available based on the personal and group identity
      of the user. Traditionally, group membership has been assigned based
      on entries in the <code class="filename">/etc/group</code> file.
    </p><p>
      It is the purpose of the <span class="emphasis"><em>Linux-PAM</em></span>
      project to separate the development of privilege granting software
      from the development of secure and appropriate authentication schemes.
      This is accomplished by providing a library of functions that an
      application may use to request that a user be authenticated. This
      PAM library is configured locally with a system file,
      <code class="filename">/etc/pam.conf</code> (or a series of configuration
      files located in <code class="filename">/etc/pam.d/</code>) to authenticate a
      user request via the locally available authentication modules. The
      modules themselves will usually be located in the directory
      <code class="filename">/lib/security</code> or
      <code class="filename">/lib64/security</code> and take the form of dynamically
      loadable object files (see <span class="citerefentry"><span class="refentrytitle">dlopen</span>(3)</span>).
    </p></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="Linux-PAM_SAG.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="sag-text-conventions.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">The Linux-PAM System Administrators' Guide </td><td width="20%" align="center"><a accesskey="h" href="Linux-PAM_SAG.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 2. Some comments on the text</td></tr></table></div></body></html>

Chapter 1. Introduction

Chapter 1. Introduction
Prev		Next

Chapter 1. Introduction

Linux-PAM (Pluggable Authentication Modules for Linux) is a suite of shared libraries that enable the local system administrator to choose how applications authenticate users.

In other words, without (rewriting and) recompiling a PAM-aware application, it is possible to switch between the authentication mechanism(s) it uses. Indeed, one may entirely upgrade the local authentication system without touching the applications themselves.

Historically an application that has required a given user to be authenticated, has had to be compiled to use a specific authentication mechanism. For example, in the case of traditional UN*X systems, the identity of the user is verified by the user entering a correct password. This password, after being prefixed by a two character ``salt'', is encrypted (with crypt(3)). The user is then authenticated if this encrypted password is identical to the second field of the user's entry in the system password database (the /etc/passwd file). On such systems, most if not all forms of privileges are granted based on this single authentication scheme. Privilege comes in the form of a personal user-identifier (UID) and membership of various groups. Services and applications are available based on the personal and group identity of the user. Traditionally, group membership has been assigned based on entries in the /etc/group file.

It is the purpose of the Linux-PAM project to separate the development of privilege granting software from the development of secure and appropriate authentication schemes. This is accomplished by providing a library of functions that an application may use to request that a user be authenticated. This PAM library is configured locally with a system file, /etc/pam.conf (or a series of configuration files located in /etc/pam.d/) to authenticate a user request via the locally available authentication modules. The modules themselves will usually be located in the directory /lib/security or /lib64/security and take the form of dynamically loadable object files (see dlopen(3)).

Prev		Next
The Linux-PAM System Administrators' Guide	Home	Chapter 2. Some comments on the text