Guide to Configuring PAM in Linux: Best Practices for Security

Pluggable Authentication Modules (PAM) is a powerful framework in Linux that provides a centralized and flexible mechanism for authentication, session management, and password policies. Proper configuration of PAM is essential for securing your system while maintaining flexibility to support various authentication methods.

This article will walk you through the essentials of PAM, how it works, how to configure it securely, and best practices for maintaining it in production environments.

What is PAM?

luggable Authentication Modules (PAM) is a flexible and modular system in Linux designed to handle authentication and related processes. It serves as a bridge between applications and authentication mechanisms, allowing system administrators to implement and manage authentication policies without modifying application code.

PAM is an integral part of modern Linux systems, enabling diverse authentication methods such as local passwords, network-based mechanisms (LDAP, Kerberos), and even two-factor authentication (2FA).

Core Components of PAM

Applications: These are programs that require authentication, such as SSH, sudo, or graphical login managers. Applications interact with PAM to verify user identities.
PAM Library: The PAM library (libpam) acts as an intermediary between applications and authentication modules. It interprets the configuration and manages communication between the application and modules.
PAM Modules: These are dynamically loadable libraries that implement specific authentication tasks. For instance:
- pam_unix.so: Handles traditional Unix-style password authentication.
- pam_sss.so: Supports network authentication using SSSD.
- pam_faillock.so: Tracks login failures and enforces lockout policies. Each module focuses on a specific aspect of authentication or session management.
Configuration Files: Located in /etc/pam.d/ or /etc/pam.conf, these files define how PAM modules are applied to each application. The configuration is modular, with one file per application, making it easier to customize authentication policies.

How PAM Works

PAM operates as a middleware that decouples applications (like sshd, sudo, or login) from the underlying authentication mechanisms.

This separation offers several benefits:

Flexibility: Administrators can configure authentication policies for individual applications without altering their code.
Modularity: PAM supports a wide range of authentication modules, which can be easily added, removed, or reconfigured.
Consistency: Applications rely on the same authentication framework, ensuring uniform behavior across services.

PAM supports four module types:

auth: Verifies user identity (e.g., password or two-factor authentication).
account: Checks if the user is allowed to access the service (e.g., time-based restrictions).
password: Handles password updates and quality enforcement.
session: Manages actions during session start and end (e.g., resource limits).

Each module can:

Approve or deny the request.
Influence the final result based on its control flags.

The PAM Workflow

When a user attempts to authenticate, PAM processes the request as follows:

Service Request: The application (e.g., sshd) initiates a PAM request when it needs to authenticate a user.
Configuration Lookup: PAM reads the configuration file corresponding to the application from /etc/pam.d/ (e.g., /etc/pam.d/sshd).
Module Execution: PAM processes the stack of modules defined in the configuration file. Each module performs a specific task, such as verifying the password, checking account restrictions, or managing session resources.
Control Flow: The results from each module are combined based on their control flags (required, sufficient, etc.), which determine whether the authentication succeeds or fails.
Result Delivery: PAM returns the final result to the application, granting or denying access based on the combined outcomes of the modules.

Installation PAM and Setup configurations

PAM is pre-installed in most Linux distributions. However, if missing, you can install it using:

Debian-based systems:

sudo apt install libpam-runtime libpam-modules

RHEL-based systems:

sudo dnf install pam pam-devel

Adding Required Modules for additional functionalities:

Install SSSD for centralized authentication (LDAP, Kerberos):

sudo yum install sssd

Install oddjob-mkhomedir to auto-create home directories:

sudo yum install oddjob-mkhomedir

Understanding PAM Configuration

Structure

PAM configuration files are located in /etc/pam.d/. Each file corresponds to a specific service, such as sshd or sudo. For global changes, files like /etc/pam.d/common-auth (or its equivalent) are used.

Each line in the configuration specifies:

<module_type> <control_flag> <module_path> [options]

Control Flags

Control flags determine the behavior of modules:

required: Must pass for the stack to succeed; failure logged but processing continues.
requisite: Similar to required, but failure terminates the process immediately.
sufficient: If successful, skips remaining modules of the same type.
optional: Its result is ignored unless it’s the only module of its type.

Configuring PAM

Step 1: Authentication (auth)

Enable Password Authentication: Use pam_unix.so to authenticate users against /etc/passwd or /etc/shadow:

auth required pam_unix.so

Add Two-Factor Authentication: Integrate 2FA using pam_google_authenticator.so:

auth required pam_google_authenticator.so

Restrict Login Attempts: Use pam_faillock.so to block accounts after a certain number of failed attempts:

auth required pam_faillock.so preauth silent deny=3 unlock_time=600
auth required pam_faillock.so authfail

Step 2: Account Management (account)

Enforce Access Policies: Ensure only valid local users can authenticate:

account required pam_unix.so

Restrict by Time or Location: Use pam_time.so or pam_access.so to limit access:

account required pam_time.so

Step 3: Password Management (password)

Enforce Strong Passwords: Use pam_pwquality.so to enforce password policies:

password requisite pam_pwquality.so retry=3 minlen=12 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1

Remember Password History: Prevent reuse of recent passwords:

password required pam_unix.so remember=5

Step 4: Session Management (session)

Set Resource Limits: Control resource allocation using pam_limits.so:

session required pam_limits.so

Create Home Directories: Automatically create home directories for new users:

session optional pam_oddjob_mkhomedir.so skel=/etc/skel umask=0022

Testing PAM Configuration

Using pamtester

Validate PAM configurations without risking production systems:

pamtester sshd username authenticate

Checking Logs

Review logs for errors in /var/log/auth.log or /var/log/secure:

sudo tail -f /var/log/auth.log

Best Practices

Modularity:
Reuse common configurations using files like /etc/pam.d/common-*.
Keep Configurations Minimal:
Only load necessary modules to reduce attack surface.
Backup Before Changes:
Always create backups of PAM files before modifications:

sudo cp /etc/pam.d/sshd /etc/pam.d/sshd.bak

Restrict Access to Configuration Files:

sudo chmod 600 /etc/pam.d/*

Monitor and Audit:
Use tools like auditd to track authentication events.
Regular Updates:
Keep PAM modules and related software updated to patch vulnerabilities:

sudo dnf update pam*

Example: Secure sshd Configuration

auth required pam_faillock.so preauth silent deny=3 unlock_time=600
auth [success=1 default=bad] pam_unix.so
auth required pam_google_authenticator.so
auth required pam_faillock.so authfail
account required pam_unix.so
password required pam_pwquality.so retry=3
session required pam_limits.so
session optional pam_oddjob_mkhomedir.so

Benefits of Using PAM

Centralized Authentication Management: PAM allows you to configure and enforce authentication policies for all services from a single location.
Support for Multiple Authentication Methods: It supports traditional password-based authentication, network authentication (LDAP, Kerberos), biometrics, and even custom methods.
Scalability: With PAM, new authentication modules can be added without affecting existing applications.
Customizability: Administrators can define complex authentication workflows tailored to specific security requirements, such as requiring both a password and 2FA.
Consistent Security Policies: PAM ensures that all applications adhere to the same authentication policies, reducing the risk of misconfiguration.

Concluding

Configuring PAM is a critical task that ensures the security and reliability of your Linux environment. By following these best practices, you can build a robust authentication system tailored to your needs. Regular auditing and updates will help maintain a secure setup in the long term.

By mastering PAM, you’ll have the tools to implement enterprise-grade authentication and access control on your Linux systems.

Hackelarre

Guide to Configuring PAM in Linux: Best Practices for Security