Hey everyone and welcome back. Now in the previous nugget we had introduced the concept
of Plugable Authentication Modules. Now we learned that within the configuration files
that we were going to actually reference particular modules to handle particular tasks. In this
nugget right here we're actually going to look at the available PAM modules in a little bit more
detail. Now the very first thing that I should just clarify is that there are a lot of PAM modules
and we ultimately don't have to know too much about many of them. There are four particular ones
that we want to focus in on for the purposes of the LPIC2 certification. So with that said,
how about we actually dive in and look at these modules with a little bit more detail then shall
we? Okay so what I will do here is if I clear the screen. In fact let me just change back to IPv0.
Okay so the very first module that I want to show you is one called PAM underscore
UNIX. Now this is really related to the setting of passwords so what I can do here is if I say
MAN PAM underscore UNIX and hit enter we can see here it says this is a module for traditional
password authentication. Now you can go through all of the information within this MAN page but
we can see here some of the options which are available to us. Say for example we can see the
MD5 option. That means that when the user is going to change their password that password is going to
be hashed using the MD5 algorithm whereas as we saw in the previous nugget we saw SHA512 I do believe
and this time when a user changes the password it's going to be encrypted with SHA512 or if that
fails fall back to use MD5. We can see the null okay value. Pretty much what this means as we can
see right here is that if the root user wants to allow regular users on the system to use empty
passwords i.e blank passwords that is going to be allowed if we set this value within the PAM
UNIX module as an argument. Remember we talked about password history well we can see here this
option remembered equals N. N denotes the number of passwords we want to keep in our history so you
could say remember equals three so that means that the system is going to remember the last
three passwords and that means that they cannot be reused whilst they have been remembered. So again
to use the example if the user happened to have the password john and then the password john one
and then the password john two and remember was set to the value three well the system would remember
these three passwords and if the user then went to change the password once again to one of these
values say for example john well that would be within the three store passwords and we could
ultimately deny the user the ability to use that password they would say hey by the way this is a
recently used password you cannot use it choose something different so maybe they would go and
choose the password bob one okay whatever it may be again neither of these passwords happen to be
very secure or very good choose more complex passwords but you get the drift so again i encourage
you to check out the man pages in full detail to see all of the available options here now the next
module we want to know about is one called PAM underscore cracklib now this one here is going
to be how users themselves can actually change their own passwords so this could be say for example
the minimum length of characters that a user can change their password to we can also have
particular checks whereby does the password actually contain the user's username maybe we
don't want to allow such a thing maybe the password we deem is too simple like i say maybe one
password was john the next one it was changed to by the user was john one we may say hey by the way
this is too simple it's too close this is a security risk we don't want your password to be
correct so easily we could check that maybe the user's old password was john and then they changed it to
john i.e that is one was lowercase and all they did was change it to uppercase we could deny such
behavior again all of this made possible by the cracklib module the next one is the PAM limits
module if you go into the man page this one here relates to the limiting of particular resources
we can see we can actually control system resources relating to a particular user session that has
been authenticated notice crucially that there are default limits and we really want to be remembering
this part here the default limits that are going to be drawn from are going to be within this
particular configuration fail the etsy directory the security directory and then limits.conf and
similarly we also have the etsy security limits directory and any files within that directory
which end in .conf they can be read in and applied also so let's imagine we wanted to limit the amount
of concurrent logins for example this would be relating to the controlling of resources i.e this
is something we could control via PAM limits now the last one that we want to talk about if i just
quit this the last one is the PAM list file module if i go into the man page here what we can do here
is we can as we see allow or deny services based on an arbitrary file so what this means is that if
you wanted to let's maybe say deny users for a particular ssh session you could create an arbitrary
file so that would be a file that you just make you could just call the file myrandom.txt and
within this file you could specify the names john and then the name michelle and depending
whether you specified and the arguments of that module to allow whatever you had in that arbitrary
file you could allow access to just john and michelle or you could specify deny meaning that we would
read the same file containing the user names john and michelle but you could deny the access and again
we can see here if we scroll on down what we would do here is specify the keyword sense equal to either
allow to allow the users or deny then we would specify the file which would give us the path to
the arbitrary file that we just created which contained say for example those user names
john and michelle now john and michelle what is that going to be is that going to be a group name is
that going to be a username well we would specify the item so let's just say that it was going to be
user names we could say item is equal to user which we see here or we could say equal to grip
whatever it may be and then we could say file is equal to let's just say forward slash my random
dot txt and the sense is we could allow so that would mean that we could specify users within a
particular text file located here and whatever users that are specified within this text file
we are going to allow them particular access and this really is what the palm list file module
is all about now like i say when you happen to be using palm there are a ton more modules than we
just saw here but again for the purposes of the examination these are the four that we really
want to have drilled and well understood so that if we happen to be getting any questions on these
particular modules we know exactly what to do and how we can modify their values so once again
as always i recommend go to the man pages to get familiar with all the different options that we
have available within these particular modules but for now that is us for palm authentication i hope
this has been informative for you and i'd like to thank you for viewing