#### Beyond Linux® From Scratch (System V Edition) - Version 12.3

### Chapter 4. Security

- Prev

  libcap-2.73 with PAM

- Next

  liboauth-1.0.3

- Up
- Home

# Linux-PAM-1.7.0

## Introduction to Linux PAM

The Linux PAM package contains Pluggable Authentication Modules used by the local system administrator to control how application programs authenticate users.

This package is known to build and work properly using an LFS 12.3 platform.

### Package Information

- Download (HTTP): https://github.com/linux-pam/linux-pam/releases/download/v1.7.0/Linux-PAM-1.7.0.tar.xz

- Download MD5 sum: c1e41d59d6852e45d0f953c8c8f869d6

- Download size: 496 KB

- Estimated disk space required: 16 MB (with tests)

- Estimated build time: 0.3 SBU (with tests)

### Additional Downloads

Optional Documentation

- Download (HTTP): https://anduin.linuxfromscratch.org/BLFS/Linux-PAM/Linux-PAM-1.7.0-docs.tar.xz

- Download MD5 sum: dba9e555df98004fe9cea233c927a551

- Download size: 495 KB

### Linux PAM Dependencies

#### Optional

libnsl-2.0.1, libtirpc-1.3.6, rpcsvc-proto-1.4.4, Berkeley DB (deprecated), libaudit, and libeconf

#### Optional (To build the Documentation and Man Pages)

docbook-xml-5.0, docbook-xsl-ns-1.79.2, fop-2.10 (for the PDF format), libxslt-1.1.42, and Lynx-2.9.2 (for the plain text format)

### Note

Shadow-4.17.3 must be reinstalled and reconfigured after installing and configuring Linux PAM.

With Linux-PAM-1.4.0 and higher, the pam_cracklib module is not installed by default. Use libpwquality-1.4.5 to enforce strong passwords.

## Kernel Configuration

For the PAM module `pam_loginuid.so` (referred by the PAM configuration file `system-session` if elogind-255.17 is built later) to work, a kernel configuration parameter need to be set or the module will just do nothing:

    General setup --->
      [*] Auditing support                                                   [AUDIT]

## Installation of Linux PAM

If you've installed docbook-xml-5.0, docbook-xsl-ns-1.79.2, libxslt-1.1.42, and Lynx-2.9.2 and you wish to generate the plain text format of the documentations, modify `meson.build` to use Lynx-2.9.2 instead of W3m or Elinks that BLFS does not provide:

    sed -e "s/'elinks'/'lynx'/"                       \
        -e "s/'-no-numbering', '-no-references'/      \
              '-force-html', '-nonumbers', '-stdin'/" \
        -i meson.build

Compile and link Linux PAM by running the following commands:

    mkdir build &&
    cd    build &&

    meson setup ..        \
      --prefix=/usr       \
      --buildtype=release \
      -D docdir=/usr/share/doc/Linux-PAM-1.7.0 &&

    ninja

To test the results, a suitable `/etc/pam.d/other` configuration file must exist.

### Reinstallation or Upgrade of Linux PAM

If you have a system with Linux PAM installed and working, be careful when modifying the files in `/etc/pam.d`, since your system may become totally unusable. If you want to run the tests, you do not need to create another `/etc/pam.d/other` file. The existing file can be used for the tests.

You should also be aware that ninja install overwrites the configuration files in `/etc/security` as well as `/etc/environment`. If you have modified those files, be sure to back them up.

For a first-time installation, create a configuration file by issuing the following commands as the `root` user:

    install -v -m755 -d /etc/pam.d &&

    cat > /etc/pam.d/other << "EOF"
    auth     required       pam_deny.so
    account  required       pam_deny.so
    password required       pam_deny.so
    session  required       pam_deny.so
    EOF

Now run the tests by issuing ninja test. Be sure the tests produced no errors before continuing the installation.

For a first-time installation, remove the configuration file created earlier by issuing the following command as the `root` user:

    rm -fv /etc/pam.d/other

Now, as the `root` user:

    ninja install &&
    chmod -v 4755 /usr/sbin/unix_chkpwd

Now remove an unneeded directory as `root`:

    rm -rf /usr/lib/systemd

If you do not have the optional dependencies installed to build the documentation and downloaded the optional pre-built documentation, again as the `root` user:

    tar -C / -xvf ../../Linux-PAM-1.7.0-docs.tar.xz

## Configuring Linux-PAM

### Configuration Files

`/etc/security/*` and `/etc/pam.d/*`

### Configuration Information

Configuration information is placed in `/etc/pam.d/`. Here is a sample file:

    # Begin /etc/pam.d/other

    auth            required        pam_unix.so     nullok
    account         required        pam_unix.so
    session         required        pam_unix.so
    password        required        pam_unix.so     nullok

    # End /etc/pam.d/other

Now create some generic configuration files. As the `root` user:

    install -vdm755 /etc/pam.d &&
    cat > /etc/pam.d/system-account << "EOF" &&
    # Begin /etc/pam.d/system-account

    account   required    pam_unix.so

    # End /etc/pam.d/system-account
    EOF

    cat > /etc/pam.d/system-auth << "EOF" &&
    # Begin /etc/pam.d/system-auth

    auth      required    pam_unix.so

    # End /etc/pam.d/system-auth
    EOF

    cat > /etc/pam.d/system-session << "EOF" &&
    # Begin /etc/pam.d/system-session

    session   required    pam_unix.so

    # End /etc/pam.d/system-session
    EOF

    cat > /etc/pam.d/system-password << "EOF"
    # Begin /etc/pam.d/system-password

    # use yescrypt hash for encryption, use shadow, and try to use any
    # previously defined authentication token (chosen password) set by any
    # prior module.
    password  required    pam_unix.so       yescrypt shadow try_first_pass

    # End /etc/pam.d/system-password
    EOF

If you wish to enable strong password support, install libpwquality-1.4.5, and follow the instructions on that page to configure the pam_pwquality PAM module with strong password support.

Next, add a restrictive `/etc/pam.d/other` configuration file. With this file, programs that are PAM aware will not run unless a configuration file specifically for that application exists.

    cat > /etc/pam.d/other << "EOF"
    # Begin /etc/pam.d/other

    auth        required        pam_warn.so
    auth        required        pam_deny.so
    account     required        pam_warn.so
    account     required        pam_deny.so
    password    required        pam_warn.so
    password    required        pam_deny.so
    session     required        pam_warn.so
    session     required        pam_deny.so

    # End /etc/pam.d/other
    EOF

The PAM man page (man pam) provides a good starting point to learn about the several fields, and allowable entries. The Linux-PAM System Administrators' Guide at `/usr/share/doc/Linux-PAM-1.7.0/Linux-PAM_SAG.txt` is recommended for additional information.

### Important

You should now reinstall the Shadow-4.17.3 package .

## Contents

Installed Program: faillock, mkhomedir_helper, pam_namespace_helper, pam_timestamp_check, pwhistory_helper, unix_chkpwd and unix_update
Installed Libraries: libpam.so, libpamc.so and libpam_misc.so
Installed Directories: /etc/security, /usr/lib/security, /usr/include/security and /usr/share/doc/Linux-PAM-1.7.0

### Short Descriptions

faillock | displays and modifies the authentication failure record files
mkhomedir_helper | is a helper binary that creates home directories
pam_namespace_helper | is a helper program used to configure a private namespace for a user session
pwhistory_helper | is a helper program that transfers password hashes from passwd or shadow to opasswd
pam_timestamp_check | is used to check if the default timestamp is valid
unix_chkpwd | is a helper binary that verifies the password of the current user
unix_update | is a helper binary that updates the password of a given user
`libpam.so` | provides the interfaces between applications and the PAM modules

- Prev

  libcap-2.73 with PAM

- Next

  liboauth-1.0.3

- Up
- Home