Lesson 4.33: Auditing the PAM stack
Every password check on Linux, for ssh, sudo, su and the console, runs through PAM: a stack of modules in /etc/pam.d, evaluated line by line with control flags that decide what a success or a failure means. Change one word and any password works; add one line and every password typed gets written to a file. In the lab Northwind's bastion host had its PAM configuration changed overnight. You read the stack the way PAM does, compare it with the known-good copy, prove the effect with pamtester, restore it, keep the evidence and force new passwords for every captured account.
19 min
You will learn to
- Explain PAM services, module types and control flags
- Read a stack including @include files
- Spot backdoors such as a weakened pam_deny or pam_exec expose_authtok
- Test a stack with pamtester
- Respond: restore, preserve evidence, expire passwords
Key terms
- PAM
- Pluggable Authentication Modules: the library programs use to check who someone is.
- Module type
- auth (prove identity), account (is access allowed now), password (change it), session (set up the login).
- Control flag
- What a module's result means: required, requisite (fail at once), sufficient (success ends it), optional, or [success=N default=ignore].
- pam_deny / pam_permit
- Modules that always fail / always succeed; the stack's safety net.
- pam_exec expose_authtok
- Runs a program during login and passes it the typed password on standard input.
- pamtester
- Runs a service's PAM stack for a user without a real login.
← LVM snapshots before risky changes · All lessons · Seccomp: a system call allow-list →