Cyclades AlterPath ACS, Command Reference Manual

Page: 100 / 420

84
Authentication
The Linux-PAM library interprets these keywords in the following manner:
Module-type (cont.)
•
Account - This module performs non-authentication-based
account management. It is typically used to restrict or permit
access to a service based on the time of day, currently available
system resources (maximum number of users) or perhaps the
location of the applicant user—‘root’ login only on the console.
•
Session - Primarily, this module is associated with doing things
that need to be done for the user before or after they can be given
service. Such things include the logging of information concerning
the opening or closing of some data exchange with a user,
mounting directories, etc.
•
Password - This last module type is required for updating the
authentication token associated with the user. Typically, there is
one module for each ‘challenge/response’ based authentication
(auth) module-type.
Control-flag The control-flag is used to indicate how the PAM library will react to the
success or failure of the module it is associated with. Since modules can
be stacked (modules of the same type execute in series, one after
another), the control-flags determine the relative importance of each
module. The application is not made aware of the individual success or
failure of modules listed in the ‘
/etc/pam.d/ directory. Instead, it receives
a summary of success or fail responses from the Linux-PAM library.
The order of execution of these modules is that of the entries in the
/etc/pam.d/ directory: The control-flag can be defined with one of two
syntaxes. The simpler (and historical) syntax for the control-flag is a
single keyword defined to indicate the severity of concern associated
with the success or failure of a specific module. There are four such
keywords:
required , requisite , sufficient and optional .
Keyword Description
Required This indicates that the success of the module is required for the module-
type facility to succeed. Failure of this module will not be apparent to
the user until all of the remaining modules (of the same module-type)
have been executed.
Table 3.6: /etc/pam.d/ keywords description
Token Description
Table 3.5: /etc/pam.d/ tokens description