PAM - It's NOT The Non-Stick Cooking Spray

To combat brute force password cracking attempts in Unix, shadow passwords were introduced. While the user specific information remained in the /etc/passwd file, the encrypted password and other sensitive information was moved to an /etc/shadow file that was only readable by 'root'. This change in the file structure meant the programs or services used for user authentication had to change as well. A recompile of the various application and service source codes to institute the changes was required. In the example above changing your method of authentication meant that every single program that relied on accessing that information had to be modified and recompiled in order to use the new method. What happened if you missed one? With today's Unix variants there is a new solution - pluggable authentication modules or PAM. PAM aware applications and services allow transparent authentication logging or the setting of limits for users regardless of the method used. PAM eliminates the need to replace binaries or recompile code. Pam can be a common authentication scheme that is used with a variety of applications and services. This paper will introduce the reader to PAM. It will provide an overview of PAM it's origins what PAM is and an example of how it works.