在Linux中使用PAM进行身份验证为什么它可能无法从某些用户运行？

I have written a simple application to authenticate user using PAM the common way: pam_start(), pam_authenticate() + my own conversation function + pam_end().

我编写了一个简单的应用程序来使用PAM以常见的方式验证用户:pam_start(),pam_authenticate()+我自己的会话函数+ pam_end()。

If application is run under the user who's credentials are being checked, authentication is succeeded. Otherwise, if application is run from user A to check credentials of user B, the authentication is failed. (

如果应用程序在正在检查凭据的用户下运行,则验证成功。否则,如果从用户A运行应用程序以检查用户B的凭据,则身份验证失败。 (

My question: why? As a service name passed to pam_start() I have tried also login as well as passwd. Nothing has changed. Which direction to go to debug the problem? Or possibly I should use another pam service to perform the task?

我的问题:为什么?作为传递给pam_start()的服务名称,我尝试过登录以及passwd。什么也没有变。调试问题的方向是哪个?或者我可能应该使用另一个pam服务来执行任务?

p.s. user 'A' in the second case is a user with no password and /bin/false shell.

附:第二种情况下的用户'A'是没有密码的用户和/ bin / false shell。

2 个解决方案

#1

How are you checking the "credentials"? Is it some file being read? Can user A read that file?

你是如何检查“凭证”的?是否正在读取某个文件?用户A可以读取该文件吗?

Service name passed to pam_start does not affect what the process can do. Note that programs that need to do similar things, like su or passwd are actually setuid programs.

传递给pam_start的服务名称不会影响进程可以执行的操作。请注意,需要执行类似操作的程序(如su或passwd)实际上是setuid程序。

Also, watch out not to create security holes in your application/module by allowing user A to impersonate user B.

另外,通过允许用户A模仿用户B,注意不要在应用程序/模块中创建安全漏洞。

2 个解决方案

#1

更多相关文章

随机推荐