Devco1 Shell

Filename : sag-introduction.html
back
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Chapter 1. Introduction</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="up" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="prev" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="next" href="sag-text-conventions.html" title="Chapter 2. Some comments on the text"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. Introduction</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Linux-PAM_SAG.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="sag-text-conventions.html">Next</a></td></tr></table><hr></div><div class="chapter"><div class="titlepage"><div><div><h1 class="title"><a name="sag-introduction"></a>Chapter 1. Introduction</h1></div></div></div><p>
      <span class="emphasis"><em>Linux-PAM</em></span> (Pluggable Authentication
      Modules for Linux) is a suite of shared libraries that enable the
      local system administrator to choose how applications authenticate users.
    </p><p>
      In other words, without (rewriting and) recompiling a PAM-aware
      application, it is possible to switch between the authentication
      mechanism(s) it uses. Indeed, one may entirely upgrade the local
      authentication system without touching the applications themselves.
    </p><p>
      Historically an application that has required a given user to be
      authenticated, has had to be compiled to use a specific authentication
      mechanism.  For example, in the case of traditional UN*X systems, the
      identity of the user is verified by the user entering a correct
      password.  This password, after being prefixed by a two character
      ``salt'', is encrypted (with crypt(3)). The user is then authenticated
      if this encrypted password is identical to the second field of the
      user's entry in the system password database (the
      <code class="filename">/etc/passwd</code> file).  On such systems, most if
      not all forms of privileges are granted based on this single
      authentication scheme. Privilege comes in the form of a personal
      user-identifier (UID) and membership of various groups. Services and
      applications are available based on the personal and group identity
      of the user. Traditionally, group membership has been assigned based
      on entries in the <code class="filename">/etc/group</code> file.
    </p><p>
      It is the purpose of the <span class="emphasis"><em>Linux-PAM</em></span>
      project to separate the development of privilege granting software
      from the development of secure and appropriate authentication schemes.
      This is accomplished by providing a library of functions that an
      application may use to request that a user be authenticated. This
      PAM library is configured locally with a system file,
      <code class="filename">/etc/pam.conf</code> (or a series of configuration
      files located in <code class="filename">/etc/pam.d/</code>) to authenticate a
      user request via the locally available authentication modules. The
      modules themselves will usually be located in the directory
      <code class="filename">/lib/security</code> or
      <code class="filename">/lib64/security</code> and take the form of dynamically
      loadable object files (see <span class="citerefentry"><span class="refentrytitle">dlopen</span>(3)</span>).
    </p></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="Linux-PAM_SAG.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="sag-text-conventions.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">The Linux-PAM System Administrators' Guide </td><td width="20%" align="center"><a accesskey="h" href="Linux-PAM_SAG.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 2. Some comments on the text</td></tr></table></div></body></html>