Otu esi ahazi ma jiri PAM na Linux

Ejikọtara modul na otu ụdị njikwa ndị a:

• akaụntụ: nye ọrụ maka nkwenye akaụntụ: okwuntughe onye ọrụ emebiela?; a na-ahapụ onye ọrụ a ohere ịnweta ọrụ a rịọrọ?.
• authentication: nyochaa onye ọrụ wee guzobe nzere onye ọrụ.
• paswọọdụ: na-ahụ maka imelite okwuntughe onye ọrụ wee rụọ ọrụ ọnụ na modul nyocha.
• nnọkọ: jikwaa omume emere na mbido nnọkọ na ngwụcha nke otu.

A ga-edobe faịlụ ihe PAM nwere ike ibugharị (modul) na ndekọ na-esonụ: /lib/security/ or /lib64/security dabere na ụkpụrụ ụlọ.

Ọkọlọtọ njikwa akwadoro bụ:

• chọrọ: ọdịda na-eweghachi njikwa ngwa ngwa na ngwa na-egosi ọdịdị ọdịda modul nke mbụ.
• chọrọ: a chọrọ modul ndị a niile ka ọ gaa nke ọma maka libpam iji weghachi ihe ịga nke ọma na ngwa a.
• zuru oke: ebe ọ bụ na modul niile bu ụzọ aga nke ọma, ịga nke ọma nke modul a na-eduga na nlọghachi ngwa ngwa na ịga nke ọma na ngwa (a na-eleghara ọdịda nke modul a anya).
• nhọrọ: agaghị edekọ ihe ịga nke ọma ma ọ bụ ọdịda nke modul a.

Na mgbakwunye na nke dị n'elu bụ mkpụrụokwu, enwere ọkọlọtọ njikwa njikwa abụọ ọzọ:

• gụnye na obere ngwugwu: tinye ahịrị niile nke ụdị enyere site na faịlụ nhazi akọwapụtara dị ka arụmụka maka njikwa a.

Otu esi egbochi mgbọrọgwụ ịnweta ọrụ SSH site na PAM

Dịka ọmụmaatụ, anyị ga-ahazi otu esi eji PAM iji gbanyụọ onye ọrụ mgbọrọgwụ ịnweta usoro site na SSH na mmemme nbanye. N'ebe a, anyị chọrọ gbanyụọ onye ọrụ mgbọrọgwụ ịnweta usoro, site na igbochi ohere ịbanye na ọrụ sshd.

Anyị nwere ike iji modul /lib/security/pam_listfile.so nke na-enye nnukwu mgbanwe na ịmachi ikike nke akaụntụ akọwapụtara. Mepee ma dezie faịlụ maka ọrụ ebumnuche na /etc/pam.d/ directory dị ka egosiri.

$ sudo vim /etc/pam.d/sshd
OR
$ sudo vim /etc/pam.d/login

Tinye iwu a na faịlụ abụọ ahụ.

auth    required       pam_listfile.so \
        onerr=succeed  item=user  sense=deny  file=/etc/ssh/deniedusers

Na-akọwa akara ngosi na iwu dị n'elu:

• auth: bụ ụdị modul (ma ọ bụ okirikiri).
• chọrọ: bụ akara ọkọlọtọ nke pụtara na ọ bụrụ na ejiri modul, ọ ga-agaferịrị ma ọ bụ nsonaazụ ya ga-ada ada, n'agbanyeghị ọkwa nke modulu ndị ọzọ.
• pam_listfile.so: bụ modul nke na-enye ụzọ ịgọnarị ma ọ bụ kwe ka ọrụ dabere na faịlụ aka ike.
• oner=emeri: arụmụka modul.
• item=onye ọrụ: arụmụka modul nke na-akọwapụta ihe edepụtara na faịlụ a kwesịrị ịlele ya.
• sense= deny: arụmụka modul nke na-akọwapụta ihe ị ga-eme ma ọ bụrụ na achọtaghị ya na faịlụ, ọ bụrụ na ahụghị ihe ahụ na faịlụ ahụ, a ga-arịọ ihe na-emegide ya.
• file=/etc/ssh/deniedusers: arụmụka modul nke na-akọwapụta faịlụ nwere otu ihe n'otu ahịrị.

Ọzọ, anyị kwesịrị ịmepụta faịlụ /etc/ssh/deniedusers ma tinye mgbọrọgwụ aha na ya:

$ sudo vim /etc/ssh/deniedusers

Chekwaa mgbanwe ndị ahụ wee mechie faịlụ ahụ, wee tọọ ikike achọrọ na ya:

$ sudo chmod 600 /etc/ssh/deniedusers

Site ugbu a gaa n'ihu, iwu a dị n'elu ga-agwa PAM ka ọ gakwuru faịlụ /etc/ssh/deniedusers wee jụ ịnweta SSH na ọrụ nbanye maka onye ọrụ ọ bụla edepụtara.

Otu esi ahazi PAM dị elu na Linux

Iji dee iwu PAM dị mgbagwoju anya karị, ị nwere ike iji ọkọlọtọ njikwa ziri ezi n'ụdị a:

type [value1=action1 value2=action2 …] module module-arguments

Ebe valueN dakọtara na koodu nloghachi site na ọrụ akpọrọ na modul nke akọwara ahịrị. Ị nwere ike ịchọta ụkpụrụ akwadoro site na ntuziaka onye nchịkwa PAM dị n'ịntanetị. Uru pụrụ iche bụ ndabara, nke na-egosi na valueN niile ekwughị hoo haa.

ActionN nwere ike were otu n'ime ụdị ndị a:

• na-eleghara: ọ bụrụ na a na-eji omume a na nchịkọta modul, ọnọdụ nloghachi nke modul agaghị etinye aka na koodu nloghachi nke ngwa ahụ nwetara.
• ọjọọ: na-egosi na ekwesịrị icheta koodu nloghachi dị ka ihe na-egosi ọdịda modul. Ọ bụrụ na modul a bụ nke mbụ n'ime ngwugwu dara, a ga-eji uru ọkwa ya mee ihe maka nke mkpokọta.
• nwu: nhata na ihe ọjọọ mana ọ nwere ike kwụsịchaa ngwugwu modul na PAM na-alaghachi na ngwa ngwa ozugbo.
• ọ dị mma: nke a na-akuziri PAM ka onye na-ahụ maka sistemụ chere na koodu nloghachi a kwesịrị itinye aka ozugbo na koodu nloghachi nke ngwugwu modul zuru ezu.
• emela: nke dabara na ok mana enwere ike kwusi ngwugwu modul na PAM na-alaghachi na ngwa ngwa ozugbo.
• N (integer na-edebanyeghị aha): dabara na mma mana ọ nwere ike mapụ n'elu modul N na-esote na ngwugwu.
• Tọgharia: omume a na-ewepụ ebe nchekwa niile nke steeti tojupụtara modul wee malite iji modul na-esote stacked.

Nke ọ bụla n'ime mkpụrụokwu anọ: achọrọ; ihe achọrọ; zuru oke; na nhọrọ, nwee okwu nhata n'usoro nke [...] syntax, nke na-enye gị ohere ide iwu ndị gbagwojuru anya na ha bụ:

• chọrọ: [success=ok new_authtok_reqd=ok ileghara=eleghara ndabara =ọjọọ]
• requisite: [success=ok new_authtok_reqd=oke ileghara=ịhapụ ndabara = die]
• zuru oke: [ihe ịga nke ọma=emere new_authtok_reqd=emere ndabara=eleghara anya]
• nhọrọ: [success=ok new_authtok_reqd=ok ndabara=eleghara anya]

Ndị a bụ ọmụmaatụ sitere na sistemụ CentOS 7 ọgbara ọhụrụ. Ka anyị tụlee iwu ndị a site na faịlụ /etc/pam.d/postlogin PAM:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session     [default=1]   pam_lastlog.so nowtmp showfailed
session     optional      pam_lastlog.so silent noupdate showfailed

Nke a bụ nhazi ihe atụ ọzọ sitere na faịlụ /etc/pam.d/smartcard-auth PAM:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        [success=done ignore=ignore default=die] pam_pkcs11.so nodebug wait_for_card
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     required      pam_permit.so

password    required      pam_pkcs11.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

Maka ozi ndị ọzọ, lee pam.d man ibe:

$ man pam.d 

N'ikpeazụ, enwere ike ịhụ nkọwa zuru oke nke syntax faịlụ nhazi yana modul PAM niile na akwụkwọ maka Linux-PAM.

PAM bụ API ọkwa dị elu dị ike nke na-enye ohere mmemme na-adabere na nyocha nye ndị ezigbo ndị ọrụ na ngwa na sistemụ Linux. Ọ dị ike mana ọ siri ike nghọta na iji ya.

N'isiokwu a, anyị akọwala otu esi ahazi atụmatụ PAM dị elu na Ubuntu na CentOS. Ọ bụrụ na ị nwere ajụjụ ọ bụla ma ọ bụ nkọwa ị ga-ekekọrịta, jiri ụdị nzaghachi dị n'okpuru.