Problem - Kevin Tafuro

Most modern Unix systems provide support for PAM and even use it for system-wide
authentication (for example, for interactive user login for shell access). Many popular
and widely deployed services that use authentication are also capable of using
PAM.
Every application that makes use of PAM uses a service name, such as “login” or
“ftpd”. PAM uses the service name along with a configuration file (often /etc/pam.conf)
or files (one for each service, named after the service, and usually located in /etc/pam.d).
PAM uses configuration information gleaned from the appropriate configuration file to
determine which modules to use, how to treat successes and failures, and other miscellaneous
information.
Modules are implemented as shared libraries that are dynamically loaded into your
application as required. Each module is expected to export several standard functions
in order to interact with the PAM infrastructure. Implementation of PAM modules
is outside the scope of this book, but our web site contains more information on
this topic.
PAM and its modules handle the drudgery of obtaining passwords from users if
required, exchanging keys, or doing whatever must be done to authenticate. All that
you need to do in your code is make the proper sequence of calls with the necessary
information to PAM, and the details of authentication are handled for you, allowing
you to concentrate on the rest of your application.
Unfortunately, the PAM API is somewhat clumsy, and the steps necessary for performing
basic authentication with PAM are not necessarily as straightforward as they
could be. The functions presented in this recipe, spc_pam_login( ) and spc_pam_
logout( ), work together to perform the necessary steps properly.
To use PAM in your own code, you will need to include the header files security/
pam_appl.h and security/pam_misc.h in your program, and link against the PAM
library, usually by specifying -lpam on the linker command line.
To authenticate a user, call spc_pam_login( ), which has the following signature:
pam_handle_t *spc_pam_login(const char *service, const char *user, int **rc);
This function has the following arguments:
service
Name of the service to use. PAM uses the service name to find the appropriate
module configuration information in its configuration file or files. You will typically
want to use a service name that does not conflict with anything else, though
if you are writing an FTP server, for example, you will want to use “ftpd” as the
service.
user
Name of the user to authenticate.
412 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.