Appendix D - Linux-PAM
348
BLACK BOX
®
Advanced Console Server
The only difference between the two is that the service-name is not present. The service-
name is of course the name of the given configuration file. For example, /etc/pam.d/login
contains the configuration for the login service.
Default Policy
If a system is to be considered secure, it had better have a reasonably secure ‘OTHER’ entry.
The following is a “severe” setting (which is not a bad place to start!):
#
# default; deny access
#
OTHER auth required pam_deny.so
OTHER account required pam_deny.so
OTHER password required pam_deny.so
OTHER session required pam_deny.so
While fundamentally a secure default, this is not very sympathetic to a misconfigured system.
For example, such a system is vulnerable to locking everyone out should the rest of the file
become badly written.
The module pam_deny not very sophisticated. For example, it logs no information when it is
invoked, so unless the users of a system contact the administrator when failing to execute a
service application, the administrator may not know for a long while that his system is mis-
configured.
The addition of the following line before those in the above example would provide a suitable
warning to the administrator.
#
# default; wake up! This application is not configured
#
