Programs which give users access to privileges of any sort need to be able to authenticate the users. When you log into a system, you provide your name and password, and the login process uses those to authenticate the login---to verify that you are who you say you are. Other forms of authentication than passwords are possible, and it is possible for the passwords to be stored in different ways.

PAM, which stands for ``Pluggable Authentication Modules'', is a way of allowing the system administrator to set authentication policy without having to recompile programs which do authentication. With PAM, you control how the modules are plugged into the programs by editing a configuration file.

Most Red Hat Linux users will never need to touch this configuration file. When you use RPM to install programs that need to do authentication, they automatically make the changes that are needed to do normal password authentication. However, you may want to customize your configuration, in which case you need to understand the configuration file.

There are four types of modules defined by the PAM standard. auth modules provide the actual authentication, perhaps asking for and checking a password, and set ``credentials'' such as group membership or kerberos ``tickets''. account modules check to make sure that the authentication is allowed (the account has not expired, the user is allowed to log in at this time of day, etc.). password modules are used to set passwords. session modules are used once a user has been authenticated to make it possible for them to use their account, perhaps mounting the user's home directory or making their mailbox available.

These modules may be stacked, so that multiple modules are used. For instance, rlogin normally makes use of at least two authentication methods: if ``rhosts'' authentication succeeds, it is sufficient to allow the connection; if it fails, then standard ``unix'' password authentication is done.

New modules can be added at any time, and PAM-aware applications can then be made to use them. For instance, if you have a one-time-password calculator system, and you can write a module to support it (documentation on writing modules is included with the system), PAM-aware programs can use the new module and work with the new one-time-password calculators without being recompiled or otherwise modified in any way.

There is one module included with Red Hat Linux which we include for the sake of completeness, but which we do not yet recommend using except on an experimental basis: pam_pwdb.so. The pwdb package and pam_pwdb.so module are currently alpha-quality software, but have interesting capabilities that you may wish to experiment with. They are unsupported by Red Hat Software at this time.

Each program which uses PAM defines its own ``service'' name. The login program defines the service type login, ftpd defines the service type ftp, etc. In general, the service type is the name of the program used to access the service, not (if there is a difference) the program used to provide the service.

The file /etc/pam.conf is used to configure all PAM applications. Each application (really, each service) has its own ``stanza''. A stanza looks like this:

# login authorization
login  auth     required  /lib/security/pam_securetty.so
login  auth     required  /lib/security/pam_unix_auth.so
login  auth     required  /lib/security/pam_nologin.so
login  account  required  /lib/security/pam_unix_acct.so
login  password required  /lib/security/pam_unix_passwd.so
login  session  required  /lib/security/pam_unix_session.so

The default pam_unix_*.so modules can support shadow passwords. In order to convert your system to shadow passwords, use these commands:

cd /etc
pwconv5
chmod 600 passwd- shadow-