系统安全-PAM

[root@localhost ~]# ldd `which login` | grep pam.so

    libpam.so. => /lib64/libpam.so. (0x00007ff2566cc000)

[root@localhost ~]# ldd `which sshd` | grep pam.so

    libpam.so. => /lib64/libpam.so. (0x00007f83bdf05000)

[root@localhost ~]# 

/etc/pam.d/login

/etc/pam.d/sshd

[root@localhost ~]# cat /etc/pam.d/login

#%PAM-1.0

auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so

auth       substack     system-auth

auth       include      postlogin

account    required     pam_nologin.so

account    include      system-auth

password   include      system-auth

# pam_selinux.so close should be the first session rule

session    required     pam_selinux.so close

session    required     pam_loginuid.so

session    optional     pam_console.so

# pam_selinux.so open should only be followed by sessions to be executed in the user context

session    required     pam_selinux.so open

session    required     pam_namespace.so

session    optional     pam_keyinit.so force revoke

session    include      system-auth

session    include      postlogin

-session   optional     pam_ck_connector.so

[root@localhost ~]# 

*auth验证使用者身份，提示输入账号和密码

*account基于时间或者密码有效期来决定是否允许访问

*password禁止用户反复尝试登陆，在变更密码时进行密码复杂性控制

*session进行日志记录，或者限制用户登录的次数，资源使用

[root@localhost ~]# cat /etc/pam.d/system-auth

#%PAM-1.0

# This file is auto-generated.

# User changes will be destroyed the next time authconfig is run.

auth        required      pam_env.so

auth        required      pam_faildelay.so delay=

auth        sufficient    pam_fprintd.so

auth        sufficient    pam_unix.so nullok try_first_pass

auth        requisite     pam_succeed_if.so uid >=  quiet_success

auth        required      pam_deny.so

account     required      pam_unix.so

account     sufficient    pam_localuser.so

account     sufficient    pam_succeed_if.so uid <  quiet

account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry= authtok_type=

password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok

password    required      pam_deny.so

session     optional      pam_keyinit.so revoke

session     required      pam_limits.so

-session     optional      pam_systemd.so

session     [success= default=ignore] pam_succeed_if.so service in crond quiet use_uid

session     required      pam_unix.so

[root@localhost ~]# 

[root@localhost ~]# cat /etc/securetty

console

vc/

vc/

vc/

vc/

vc/

vc/

vc/

vc/

vc/

vc/

vc/

tty1

tty2

tty3

tty4

tty5

tty6

tty7

tty8

tty9

tty10

tty11

ttyS0

ttysclp0

sclp_line0

/tty1

hvc0

hvc1

hvc2

hvc3

hvc4

hvc5

hvc6

hvc7

hvsi0

hvsi1

hvsi2

xvc0

[root@localhost ~]# cat /etc/security/pam_env.conf

#

# This is the configuration file for pam_env, a PAM module to load in

# a configurable list of environment variables for a

#

# The original idea for this came from Andrew G. Morgan ...

#<quote>

#   Mmm. Perhaps you might like to write a pam_env module that reads a

#   default environment from a file? I can see that as REALLY

#   useful... Note it would be an "auth" module that returns PAM_IGNORE

#   for the auth part and sets the environment returning PAM_SUCCESS in

#   the setcred function...

#</quote>

#

# What I wanted was the REMOTEHOST variable set, purely for selfish

# reasons, and AGM didn't want it added to the SimpleApps login

# program (which is where I added the patch). So, my first concern is

# that variable, from there there are numerous others that might/would

# be useful to be set: NNTPSERVER, LESS, PATH, PAGER, MANPAGER .....

#

# Of course, these are a different kind of variable than REMOTEHOST in

# that they are things that are likely to be configured by

# administrators rather than set by logging in, how to treat them both

# in the same config file?

#

# Here is my idea:

#

# Each line starts with the variable name, there are then two possible

# options for each variable DEFAULT and OVERRIDE.

# DEFAULT allows and administrator to set the value of the

# variable  to some default value, if none is supplied then the empty

# string is assumed. The OVERRIDE option tells pam_env that it should

# enter in its value (overriding the default value) if there is one

# to use. OVERRIDE is not used, "" is assumed and no override will be

# done.

#

# VARIABLE   [DEFAULT=[value]]  [OVERRIDE=[value]]

#

# (Possibly non-existent) environment variables may be used in values

# using the ${string} syntax and (possibly non-existent) PAM_ITEMs may

# be used in values using the @{string} syntax. Both the $ and @

# characters can be backslash escaped to be used as literal values

# values can be delimited with "", escaped " not supported.

# Note that many environment variables that you would like to use

# may not be set by the time the module is called.

# For example, HOME is used below several times, but

# many PAM applications don't make it available by the time you need it.

#

#

# First, some special variables

#

# Set the REMOTEHOST variable for any hosts that are remote, default

# to "localhost" rather than not being set at all

#REMOTEHOST    DEFAULT=localhost OVERRIDE=@{PAM_RHOST}

#

# Set the DISPLAY variable if it seems reasonable

#DISPLAY        DEFAULT=${REMOTEHOST}:0.0 OVERRIDE=${DISPLAY}

#

#

#  Now some simple variables

#

#PAGER        DEFAULT=less

#MANPAGER    DEFAULT=less

#LESS        DEFAULT="M q e h15 z23 b80"

#NNTPSERVER    DEFAULT=localhost

#PATH        DEFAULT=${HOME}/bin:/usr/local/bin:/bin\

#:/usr/bin:/usr/local/bin/X11:/usr/bin/X11

#

# silly examples of escaped variables, just to show how they work.

#

#DOLLAR        DEFAULT=\$

#DOLLARDOLLAR    DEFAULT=    OVERRIDE=\$${DOLLAR}

#DOLLARPLUS    DEFAULT=\${REMOTEHOST}${REMOTEHOST}

#ATSIGN        DEFAULT=""    OVERRIDE=\@

[root@localhost ~]# 

[root@localhost ~]# cat /etc/pam.d/system-auth

#%PAM-1.0

# This file is auto-generated.

# User changes will be destroyed the next time authconfig is run.

auth        required      pam_env.so

auth        required      pam_faildelay.so delay=

auth        sufficient    pam_fprintd.so

auth        sufficient    pam_unix.so nullok try_first_pass

auth        requisite     pam_succeed_if.so uid >=  quiet_success

auth        required      pam_deny.so

account     required      pam_unix.so

account     sufficient    pam_localuser.so

account     sufficient    pam_succeed_if.so uid <  quiet

account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry= authtok_type=

password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok

password    required      pam_deny.so

session     optional      pam_keyinit.so revoke

session     required      pam_limits.so

-session     optional      pam_systemd.so

session     [success= default=ignore] pam_succeed_if.so service in crond quiet use_uid

session     required      pam_unix.so

[root@localhost ~]# 

[root@localhost ~]# cat /etc/pam.d/login

#%PAM-1.0

auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so

auth       substack     system-auth

auth       include      postlogin

account    required     pam_nologin.so

account    include      system-auth

password   include      system-auth

# pam_selinux.so close should be the first session rule

session    required     pam_selinux.so close

session    required     pam_loginuid.so

session    optional     pam_console.so

# pam_selinux.so open should only be followed by sessions to be executed in the user context

session    required     pam_selinux.so open

session    required     pam_namespace.so

session    optional     pam_keyinit.so force revoke

session    include      system-auth

session    include      postlogin

-session   optional     pam_ck_connector.so

[root@localhost ~]# 

[root@localhost ~]# cat /etc/pam.d/passwd

#%PAM-1.0

auth       include    system-auth

account    include    system-auth

password   substack    system-auth

-password   optional    pam_gnome_keyring.so use_authtok

password   substack    postlogin

[root@localhost ~]# 

[root@localhost ~]# cat /etc/pam.d/sshd

#%PAM-1.0

auth       required    pam_sepermit.so

auth       substack     password-auth

auth       include      postlogin

# Used with polkit to reauthorize users in remote sessions

-auth      optional     pam_reauthorize.so prepare

account    required     pam_nologin.so

account    include      password-auth

password   include      password-auth

# pam_selinux.so close should be the first session rule

session    required     pam_selinux.so close

session    required     pam_loginuid.so

# pam_selinux.so open should only be followed by sessions to be executed in the user context

session    required     pam_selinux.so open env_params

session    required     pam_namespace.so

session    optional     pam_keyinit.so force revoke

session    include      password-auth

session    include      postlogin

# Used with polkit to reauthorize users in remote sessions

-session   optional     pam_reauthorize.so prepare

[root@localhost ~]# 

[root@localhost ~]# cat /etc/security/time.conf

# this is an example configuration file for the pam_time module. Its syntax

# was initially based heavily on that of the shadow package (shadow-).

#

# the syntax of the lines is as follows:

#

#       services;ttys;users;times

#

# white space is ignored and lines maybe extended with '\\n' (escaped

# newlines). As should be clear from reading these comments,

# text following a '#' is ignored to the end of the line.

#

# the combination of individual users/terminals etc is a logic list

# namely individual tokens that are optionally prefixed with '!' (logical

# not) and separated with '&' (logical and) and '|' (logical or).

#

# services

#    is a logic list of PAM service names that the rule applies to.

#

# ttys

#    is a logic list of terminal names that this rule applies to.

#

# users

#    is a logic list of users or a netgroup of users to whom this

#    rule applies.

#

# NB. For these items the simple wildcard '*' may be used only once.

#

# times

#    the format here is a logic list of day/time-range

#    entries the days are specified by a sequence of two character

#    entries, MoTuSa for example is Monday Tuesday and Saturday. Note

#    that repeated days are unset MoMo = no day, and MoWk = all weekdays

#    bar Monday. The two character combinations accepted are

#

#        Mo Tu We Th Fr Sa Su Wk Wd Al

#

#    the last two being week-end days and all  days of the week

#    respectively. As a final example, AlFr means all days except Friday.

#

#    each day/time-range can be prefixed with a '!' to indicate "anything

#    but"

#

#    The time-range part is two -hour times HHMM separated by a hyphen

#    indicating the start and finish time (if the finish time is smaller

#    than the start time it is deemed to apply on the following day).

#

# for a rule to be active, ALL of service+ttys+users must be satisfied

# by the applying process.

#

#

# Here is a simple example: running blank on tty* (any ttyXXX device),

# the users 'you' and 'me' are denied service all of the time

#

#blank;tty* & !ttyp*;you|me;!Al0000-

# Another silly example, user 'root' is denied xsh access

# from pseudo terminals at the weekend and on mondays.

#xsh;ttyp*;root;!WdMo0000-

#

# End of example file.

#

[root@localhost ~]#