[HN Gopher] Pluggable Authentication Modules (PAM)
       ___________________________________________________________________
        
       Pluggable Authentication Modules (PAM)
        
       Author : networked
       Score  : 36 points
       Date   : 2023-02-02 06:47 UTC (2 days ago)
        
 (HTM) web link (www.netbsd.org)
 (TXT) w3m dump (www.netbsd.org)
        
       | hackeraccount wrote:
       | My one rule about PAM is always have an ssh session going when
       | you mess with it and never drop it until you've tested logins 7
       | ways to Sunday. I remember one time making a seemingly minor
       | change - testing it; huzzah! logins still work - dropping the
       | connection and much much later realizing that you didn't need any
       | password to login. Oops.
        
         | towawy wrote:
         | I made a similar learning when messing with PAM to enable
         | TouchID with sudo on a Mac!
         | 
         | Edited the config with "sudo nano /etc/pam.d/sudo", a typo
         | slipped in, saved the file and closed nano. After that sudo was
         | broken and I had to go down the rabbit hole of changing a root
         | owned system file without sudo to fix it.
         | 
         | The next time I opened a root shell with "sudo -s" and THEN
         | opened nano. Made absolutely sure sudo still works in a new
         | Terminal window before closing anything.
        
           | tadfisher wrote:
           | Does "su" not work on macOS?
        
             | Schnitz wrote:
             | Not by default, similar like on Ubuntu etc.
        
       | mauvehaus wrote:
       | PAM lets you do some pretty slick things. I did a bunch of
       | Samba/Active Directory integrations on Solaris[0] back in the
       | late aughts. I never got super deep into the PAM side of things,
       | but it was pretty clear that you could go absolutely wild with
       | it.
       | 
       | [0] For people rolling their own NAS, mostly with SAMFS, at least
       | one with ZFS.
        
         | arminiusreturns wrote:
         | Yep, it's powerful, complicated, and easy to jack things up,
         | but very useful. It's been a while but I had a whole company on
         | three factor ssh via the google auth libpam module at one point
         | and it worked quite well once I ironed out the bugs.
        
           | brmgb wrote:
           | Having had to use it to connect authentication to LDAP via
           | sssd, I'm not sure I would describe it as nicely as you do.
           | 
           | To put it bluntly, my personal opinion is that it is a
           | massive piece of shit. It makes even simple things feel
           | complicated for no reason whatsoever and is so brittle. The
           | whole thing is a huge design failure.
        
       | notaplumber1 wrote:
       | OpenSSH developers documented some issues they found with PAM, in
       | implementation and design.
       | 
       | https://www.dtucker.net/pam/
       | 
       | BSD Authentication is much nicer, but has only been adopted by
       | OpenBSD.
       | 
       | https://man.openbsd.org/authenticate.3
       | 
       | https://man.openbsd.org/auth_subr.3
        
       | m00dy wrote:
       | I hear you [0].
       | 
       | [0]: https://github.com/m00dy/pam-backdoor/blob/master/pam-
       | backdo...
        
       | Waterluvian wrote:
       | Is it possible in Ubuntu to never have to type my sudo password
       | again so long as I've got some sort of security dongle plugged
       | in?
       | 
       | Specifically: it just skips asking at all. No extra step like
       | pushing a button.
        
       ___________________________________________________________________
       (page generated 2023-02-04 23:02 UTC)