Pluggable Authentication Modules (PAM) | Hacker News Reader

Pluggable Authentication Modules (PAM)

netbsd.org

37 pointsnetworked11 comments

My one rule about PAM is always have an ssh session going when you mess with it and never drop it until you've tested logins 7 ways to Sunday. I remember one time making a seemingly minor change - testing it; huzzah! logins still work - dropping the connection and much much later realizing that you didn't need any password to login. Oops.

I made a similar learning when messing with PAM to enable TouchID with sudo on a Mac!

Edited the config with "sudo nano /etc/pam.d/sudo", a typo slipped in, saved the file and closed nano. After that sudo was broken and I had to go down the rabbit hole of changing a root owned system file without sudo to fix it.

The next time I opened a root shell with "sudo -s" and THEN opened nano. Made absolutely sure sudo still works in a new Terminal window before closing anything.

Does "su" not work on macOS?

Not by default, similar like on Ubuntu etc.

OpenSSH developers documented some issues they found with PAM, in implementation and design.

https://www.dtucker.net/pam/

BSD Authentication is much nicer, but has only been adopted by OpenBSD.

https://man.openbsd.org/authenticate.3

https://man.openbsd.org/auth_subr.3

PAM lets you do some pretty slick things. I did a bunch of Samba/Active Directory integrations on Solaris[0] back in the late aughts. I never got super deep into the PAM side of things, but it was pretty clear that you could go absolutely wild with it.

[0] For people rolling their own NAS, mostly with SAMFS, at least one with ZFS.

Yep, it's powerful, complicated, and easy to jack things up, but very useful. It's been a while but I had a whole company on three factor ssh via the google auth libpam module at one point and it worked quite well once I ironed out the bugs.

Having had to use it to connect authentication to LDAP via sssd, I’m not sure I would describe it as nicely as you do.

To put it bluntly, my personal opinion is that it is a massive piece of shit. It makes even simple things feel complicated for no reason whatsoever and is so brittle. The whole thing is a huge design failure.

Is it possible in Ubuntu to never have to type my sudo password again so long as I’ve got some sort of security dongle plugged in?

Specifically: it just skips asking at all. No extra step like pushing a button.

You could probably make something like this work using pam_listfile

https://www.systutorials.com/docs/linux/man/8-pam_listfile/

I hear you [0].

[0]: https://github.com/m00dy/pam-backdoor/blob/master/pam-backdo...

Reply on news.ycombinator.com