Pam_admin is a PAM module that permits users to access root with their own password using login suffixes.
Pam_admin is a PAM module that enables the use of login suffixes for users to become root with their own password. The module initially checks the user name to confirm it matches the format: +, where is supplied as an argument. If the check is successful, the + section is stripped, and control is passed to the next module. In this stage, the module works similarly to the pam_realm module it is based on.
In a second stage, if necessary, the module provides the user with root access after a proper authentication has occurred through an appropriate module, such as pam_unix. The module grants root access to users who have used the configured suffix and are listed in, or are members of groups listed in, the /etc/security/pam_admin.conf file. It is important to note that this module only responds to PAM "auth" queries. Additionally, due to the user identity verification, OpenSSH will not work with this module, and the user is simply not authorized.
Installation is easy. Begin by uncompressing the sources with the command: tar xvfz pam-admin-VERSION-tgz. Place yourself in the source directory and type 'make'. Then, as root, type 'make install'. To uninstall the module, use the command: 'make uninstall'.
There are several options available with the pam_admin module. Use the debug option to print debugging information. The suffix parameter specifies the to check against. The allowbare option also permits user names to be of the format just , without any +. The nostrip option may be useful in certain cases to only check if the user name is of the proper format. Finally, the becomeroot option lets the user become root if the previous module detected a suffix, and the user or one of their groups is listed in /etc/security/pam_admin.conf.
Note that when different suffixes are used in the two modules, the second stage will always fail if the first stage succeeds using the first suffix. Future versions will support configuring the suffix for the first stage for use in the second stage.
In a second stage, if necessary, the module provides the user with root access after a proper authentication has occurred through an appropriate module, such as pam_unix. The module grants root access to users who have used the configured suffix and are listed in, or are members of groups listed in, the /etc/security/pam_admin.conf file. It is important to note that this module only responds to PAM "auth" queries. Additionally, due to the user identity verification, OpenSSH will not work with this module, and the user is simply not authorized.
Installation is easy. Begin by uncompressing the sources with the command: tar xvfz pam-admin-VERSION-tgz. Place yourself in the source directory and type 'make'. Then, as root, type 'make install'. To uninstall the module, use the command: 'make uninstall'.
There are several options available with the pam_admin module. Use the debug option to print debugging information. The suffix parameter specifies the
Note that when different suffixes are used in the two modules, the second stage will always fail if the first stage succeeds using the first suffix. Future versions will support configuring the suffix for the first stage for use in the second stage.
What's New
Version 0.1b: N/A