Cyclades AlterPath ACS, Справочник по командам

Страница: 101 / 420

AlterPath ACS Command Reference Guide
85
Authentication
Module Path
Module Path is the path-name of the dynamically loadable object file--the pluggable
module itself. If the first character of the module path is ‘/’, it is assumed to be a
complete path. If this is not the case, the given module path is appended to the default
module path:
/lib/security .
Currently, the ACS has the following modules available:
Requisite This is similar to required. However, in the case that such a module
returns a failure, control is directly returned to the application. The
return value is that associated with the first required or requisite module
to fail. Note that this flag can be used to protect against the possibility of
a user getting the opportunity to enter a password over an unsafe
medium. It is conceivable that such behavior might inform an attacker
of valid accounts on a system. This possibility should be weighed
against the significant concerns of exposing a sensitive password in a
hostile environment.
Sufficient The success of this module is deemed ‘sufficient’ to satisfy the Linux-
PAM library that this moduletype has succeeded in its purpose. In the
event that no previous required module has failed, no more ‘stacked’
modules of this type are invoked. (Note: in this case subsequent
required modules are not invoked.) A failure of this module is not
deemed as fatal to satisfying the application.
Optional As its name suggests, this control-flag marks the module as not being
critical to the success or failure of the user’s application for service. In
general, Linux-PAM ignores such a module when determining if the
module stack will succeed or fail. However, in the absence of any
definite successes or failures of previous or subsequent stacked modules
this module will determine the nature of the response to the application.
One example of this latter case is when the other modules return
something like PAM_IGNORE.
Keyword Description
Table 3.6: /etc/pam.d/ keywords description
Module Name Description
pam_access Provides logdaemon style login access control.
pam_deny Deny access to all users.
Table 3.7: Available PAM modules in the ACS