ADMIN

PAM and Hardware
Nuts and Bolts
Figure 1: PAM provides a centralized user management framework for the
application.
Figure 2: A classic PAM configuration file contains modules and libraries that the
administrator can use to customize PAM.
know whether or not the user logged
in successfully. In other words, it is
PAM’s job to find a suitable method
for authenticating the user. The PAM
framework defines what this method
looks like, and the application remains
blissfully unaware of it.
PAM can use various authentication
methods. Besides popular networkbased
methods like LDAP, NIS, or
Winbind, PAM can use more recent
libraries to access a variety of hardware
devices, thus supporting logins
based on smartcards or the user’s
digital fingerprint. One-time password
systems, such as S/​Key or SecurID,
are also supported by PAM, and some
methods even require a specific Bluetooth
device to log in the user.
The way PAM works is fairly simple.
Each PAM-aware application (the application
must be linked against the
libpam library) has a separate configuration
file in the /etc/pam.d/ folder.
The file will typically be named after
the application itself – login, for
example. Within the file, modules distribute
PAM tasks among themselves.
Numerous libraries are available in
each group, and they handle a variety
of tasks within the group (Figure 2).
Control flags let you manage PAM’s
behavior in case of error – for example,
if a user fails to provide the
correct password or if the system is
unable to verify a fingerprint.
Fingerprints
More recent PAM libraries allow administrators
to authenticate users by
means of smartcards, USB tokens, or
biometric features. State-of-the-art
notebooks often include a fingerprint
reader that allows the owner to use a
digital fingerprint when logging into
the system. The PAM ThinkFinger library
[2] provides the necessary support.
According to the documentation,
the module will support the UPEK/​
SGS Thomson Microelectronics fingerprint
reader used by most recent
Lenovo notebooks and many external
devices.
Most major Linux distributions offer
prebuilt packages for the PAM libraries.
You can use your distribution’s
package manager to install the software
from the repositories. To install
the required packages on your hard
disk, you would give the
yum install thinkfinger
command on a Fedora system and
apt‐get install thinkfinger‐tools U
libpam‐thinkfinger
on Ubuntu Hardy. Gentoo admins can
issue a compact command:
emerge sys‐auth/thinkfinger
If you’re using openSUSE, you’ll need
the libthinkfinger and pam_thinkfinger
packages, the repository versions
of which are not up to date.
You might prefer a manual install
with the typical ./configure, make,
make install steps and files from the
current source code archive. Debian
users on Lenny will need to access
the Experimental repository and then
type
aptitude install libthinkfinger0 U
libpam‐thinkfinger thinkfinger‐tools
for the install.
Before you modify the existing PAM
configuration, you might want to test
the device itself. To do so, scan a fingerprint
by giving the
tf‐tool ‐‐acquire
command (Figure 3). Then you can
use
tf‐tool ‐‐verify
to verify the results. You might see
a Fingerprint does *not* match message
at this point; initial attempts can
be fairly inaccurate because you will
need to familiarize yourself with the
device.
If you drag your finger too quickly
or too slowly across the scanner, the
device could fail to identify the fingerprint
correctly. In this case, it will
output an error message and quit.
When you achieve reliable results
from fingerprint scans, you can delete
the temporary file with the test scan
in /tmp and create an individual file
for each user on the system that will
contain the user’s fingerprint. The
command is
tf‐tool ‐‐add‐user username
(Figure 4). Users must scan their fingerprints
three times for this to work.
If the fingerprint is identified correctly
each time, the tool will store it in a
separate file below /etc/pam_thinkfinger/.
Once everything is working, you can
begin the PAM configuration. Figure
2 shows a PAM configuration for
the login program that lists just one
authentication module: pam_unix. If
you want to authenticate against the
fingerprint scanner first, you need to
www.admin-magazine.com
Admin 01
79