C pam module - Revision history

Jfreier: /* Resources */

2014-06-25T16:56:19Z

‎Resources

Jfreier at 16:56, 25 June 2014

2014-06-25T16:56:00Z

Jfreier at 16:52, 25 June 2014

2014-06-25T16:52:27Z

Jfreier at 16:51, 25 June 2014

2014-06-25T16:51:43Z

Jfreier at 16:47, 25 June 2014

2014-06-25T16:47:32Z

Jfreier at 16:44, 25 June 2014

2014-06-25T16:44:57Z

Jfreier at 16:43, 25 June 2014

2014-06-25T16:43:22Z

Jfreier at 16:41, 25 June 2014

2014-06-25T16:41:28Z

Jfreier at 16:37, 25 June 2014

2014-06-25T16:37:28Z

Jfreier: Created page with 'PAM - Pluggable Authentication Module PAM Modules are modules that can hook up to different applications that implement PAM patterns, such as SSH. == Setup == To begin develop…'

2014-06-25T16:29:54Z

Created page with 'PAM - Pluggable Authentication Module PAM Modules are modules that can hook up to different applications that implement PAM patterns, such as SSH. == Setup == To begin develop…'

New page

PAM - Pluggable Authentication Module

PAM Modules are modules that can hook up to different applications that implement PAM patterns, such as SSH.

== Setup ==
To begin development

@@ Line 116: / Line 116: @@
 == Resources ==
 http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/
 https://code.google.com/p/google-authenticator/
 http://www.rkeene.org/projects/info/wiki/222
 http://www.informit.com/articles/article.aspx?p=30602&seqNum=3
 http://ditesh.gathani.org/blog/2011/06/pam-authentication-for-fun-and-profit/

← Older revision		Revision as of 16:56, 25 June 2014
Line 112:		Line 112:
	Add the following line to /etc/pam.d/sshd		Add the following line to /etc/pam.d/sshd
	auth required pam_ignore.so debug		auth required pam_ignore.so debug
		+
		+
		+	== Resources ==
		+	http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/
		+	https://code.google.com/p/google-authenticator/
		+	http://www.rkeene.org/projects/info/wiki/222
		+	http://www.informit.com/articles/article.aspx?p=30602&seqNum=3
		+	http://ditesh.gathani.org/blog/2011/06/pam-authentication-for-fun-and-profit/

@@ Line 73: / Line 73: @@
+           }
            pam_err = conv->conv(1, &msgp, &resp, conv->appdata_ptr);
            return(PAM_SUCCESS);

@@ Line 22: / Line 22: @@
 == C Code ==
-/* Define which PAM interfaces we provide */
+  /* Define which PAM interfaces we provide */
    #define PAM_SM_ACCOUNT
    #define PAM_SM_AUTH
@@ Line 49: / Line 49: @@
    int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv) {
            printf("acct_mgmt\n");
            return(PAM_IGNORE);
+   }
    /* PAM entry point for authentication verification */
-PAM_EXTERN
+  PAM_EXTERN
    int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) {
            printf("authentication 2\n");
            int pam_err;
            struct pam_response *resp = NULL;
            struct pam_message msg;
            const struct pam_message *msgp;
            msg.msg_style = PAM_PROMPT_ECHO_ON;
@@ Line 80: / Line 67: @@
            msgp = &msg;
-           if (pam_err != PAM_SUCCESS)
+           struct pam_conv *conv;
-                printf("No Luck!\n");
+          int retval = pam_get_item(pamh, PAM_CONV, (void *)&conv);
-          else
+          if (retval != PAM_SUCCESS) {
-                printf("Lucky!\n");
+               return retval;
-−
 struct pam_conv *conv;
-  int retval = pam_get_item(pamh, PAM_CONV, (void *)&conv);
-  if (retval != PAM_SUCCESS) {
-    return retval;
-−
-  pam_err = conv->conv(1, &msgp, &resp, conv->appdata_ptr);
-−
-−
-−
-          if (pam_err == PAM_CONV_ERR) {
-               printf("PAM_CONV_ERR\n");
+           }
-          printf("error:%d\n", pam_err);
+           return(PAM_SUCCESS);
-−
-          if (resp != NULL) {
-                printf("No null\n");
-                resp->resp;
-          } else {
-                printf("NULL Time!\n");
-−
-−
-−
-           return(result);
+   }
-−
- int converse(pam_handle_t *pamh, int nargs,
-                    const struct pam_message **message,
-                    struct pam_response **response) {
-   struct pam_conv *conv;
-  int retval = pam_get_item(pamh, PAM_CONV, (void *)&conv);
-  if (retval != PAM_SUCCESS) {
-    return retval;
-−
-  return conv->conv(nargs, message, response, conv->appdata_ptr);
-−
-−
-−
    /*
       PAM entry point for setting user credentials (that is, to actually

← Older revision		Revision as of 16:47, 25 June 2014
Line 14:		Line 14:
	/etc/ssh/sshd_config		/etc/ssh/sshd_config
	Line: ChallengeResponseAuthentication yes		Line: ChallengeResponseAuthentication yes
		+
		+
		+	Need to install the PAM development files.
		+	apt-get install libpam0g-dev

← Older revision		Revision as of 16:44, 25 June 2014
Line 133:		Line 133:
	return(PAM_IGNORE);		return(PAM_IGNORE);
	}		}
		+
		+
		+	== Build ==
		+	gcc -fPIC -DPIC -shared -rdynamic -std=c99 -o pam_ignore.so pam_ignore.c
		+
		+	== Install ==
		+	cp pam_ignore.so /lib/x86_64-linux-gnu/security/
		+
		+	chown root:root /lib/x86_64-linux-gnu/security/pam_ignore.so
		+
		+	chmod 755 /lib/x86_64-linux-gnu/security/pam_ignore.so
		+

← Older revision		Revision as of 16:43, 25 June 2014
Line 133:		Line 133:
	return(PAM_IGNORE);		return(PAM_IGNORE);
	}		}
		+
		+
		+	== More setup ==
		+	Need to activate the PAM module in SSH PAM config
		+
		+	Add the following line to /etc/pam.d/sshd
		+	auth required pam_ignore.so debug

← Older revision		Revision as of 16:41, 25 June 2014
Line 14:		Line 14:
	/etc/ssh/sshd_config		/etc/ssh/sshd_config
	Line: ChallengeResponseAuthentication yes		Line: ChallengeResponseAuthentication yes
		+
		+
		+
		+	== C Code ==
		+	/* Define which PAM interfaces we provide */
		+	#define PAM_SM_ACCOUNT
		+	#define PAM_SM_AUTH
		+	#define PAM_SM_PASSWORD
		+	#define PAM_SM_SESSION
		+
		+	/* Include PAM headers */
		+	#include <stdio.h>
		+	#include <security/pam_appl.h>
		+	#include <security/pam_modules.h>
		+	#include <syslog.h>
		+
		+	/* PAM entry point for session creation */
		+	int pam_sm_open_session(pam_handle_t pamh, int flags, int argc, const char *argv) {
		+	printf("open_session\n");
		+	return(PAM_IGNORE);
		+	}
		+
		+	/* PAM entry point for session cleanup */
		+	int pam_sm_close_session(pam_handle_t pamh, int flags, int argc, const char *argv) {
		+	printf("close_session\n");
		+	return(PAM_IGNORE);
		+	}
		+
		+	/* PAM entry point for accounting */
		+	int pam_sm_acct_mgmt(pam_handle_t pamh, int flags, int argc, const char *argv) {
		+	printf("acct_mgmt\n");
		+
		+	return(PAM_IGNORE);
		+	}
		+
		+	/* PAM entry point for authentication verification */
		+	PAM_EXTERN
		+	int pam_sm_authenticate(pam_handle_t pamh, int flags, int argc, const char *argv) {
		+	printf("authentication 2\n");
		+
		+	//struct pam_conv *conv;
		+	int pam_err;
		+	struct pam_response *resp = NULL;
		+
		+	int result = PAM_SUCCESS;
		+
		+	if (1 == 1)
		+	{
		+	result = PAM_SESSION_ERR;
		+	}
		+
		+	struct pam_message msg;
		+	const struct pam_message *msgp;
		+
		+	//pam_err = pam_get_item(pamh, PAM_CONV, (const void **)&conv);
		+	printf("pam_get_item:%d\n", pam_err);
		+
		+	msg.msg_style = PAM_PROMPT_ECHO_ON;
		+	msg.msg = "What color is the sky:";
		+
		+	msgp = &msg;
		+
		+	if (pam_err != PAM_SUCCESS)
		+	printf("No Luck!\n");
		+	else
		+	printf("Lucky!\n");
		+
		+	struct pam_conv *conv;
		+	int retval = pam_get_item(pamh, PAM_CONV, (void *)&conv);
		+	if (retval != PAM_SUCCESS) {
		+	return retval;
		+	}
		+	pam_err = conv->conv(1, &msgp, &resp, conv->appdata_ptr);
		+
		+
		+
		+	if (pam_err == PAM_CONV_ERR) {
		+	printf("PAM_CONV_ERR\n");
		+	}
		+
		+	printf("error:%d\n", pam_err);
		+
		+	if (resp != NULL) {
		+	printf("No null\n");
		+	resp->resp;
		+	} else {
		+	printf("NULL Time!\n");
		+	}
		+
		+
		+	return(result);
		+	}
		+
		+	int converse(pam_handle_t *pamh, int nargs,
		+	const struct pam_message **message,
		+	struct pam_response **response) {
		+	struct pam_conv *conv;
		+	int retval = pam_get_item(pamh, PAM_CONV, (void *)&conv);
		+	if (retval != PAM_SUCCESS) {
		+	return retval;
		+	}
		+	return conv->conv(nargs, message, response, conv->appdata_ptr);
		+	}
		+
		+
		+	/*
		+	PAM entry point for setting user credentials (that is, to actually
		+	establish the authenticated user's credentials to the service provider)
		+	*/
		+	int pam_sm_setcred(pam_handle_t pamh, int flags, int argc, const char *argv) {
		+	printf("setcred\n");
		+	return(PAM_IGNORE);
		+	}
		+
		+	/* PAM entry point for authentication token (password) changes */
		+	int pam_sm_chauthtok(pam_handle_t pamh, int flags, int argc, const char *argv) {
		+	printf("chauthtok\n");
		+	return(PAM_IGNORE);
		+	}

← Older revision		Revision as of 16:37, 25 June 2014
Line 5:		Line 5:

	== Setup ==		== Setup ==
−	To begin development	+	To begin development, some configuration may need to be done to some of the PAM configuration files. For this example I will use SSH.
		+
		+	These files are located
		+	/etc/pam.d/sshd
		+
		+	Tip*
		+	For SSH, if you need to conversate, turn on Challenge Response in the SSHD config file.
		+	/etc/ssh/sshd_config
		+	Line: ChallengeResponseAuthentication yes