ADMIN+Magazine+Sample+PDF

Nuts and Bolts
PAM and Hardware
Figure 3: tf-tool gives you an option for testing your fingerprint scanner …
Figure 4: … and then creating a fingerprint for each user.
call the pam_thinkfinger PAM module
before pam_unix.
To prevent PAM from prompting users
to enter their password despite
passing the fingerprint test, you need
add a sufficient control flag. This
tells PAM not to call any more libraries
once an authentication test has
succeeded and to return PAM_SUCESS
to the calling program – login in this
example. If the fingerprint-based login
fails, pam_unix is called as a last
resort and will prompt for the user’s
regular password.
Manually entering the PAM libraries
for all of your PAM-aware applications
in every single PAM configuration
file would be fairly tedious. A
centralized PAM configuration file
gives you an alternative. On Fedora
or Red Hat, this file is named /etc/
pam.d/system‐auth, although other
Linux distributions call it /etc/pam/
common‐auth. You can enter all the
libraries against which you want to
authenticate your users in the file
(Figure 5).
The include control flag then includes
the file in all your other PAM configuration
files. From now on, this makes
all the programs in the PAM libraries
listed by the centralized configuration
file available in the individual PAM
files, including the pam_thinkfinger
module.
USB Tokens
The pam_usb library supports another
hardware-based approach, in
which PAM checks to see whether a
specific USB device is plugged into
the machine. If so, the user is logged
in; if not, access to the system is denied.
The plugged in device is identified
by its unique serial number and
model and vendor names. Additionally,
a random number is stored on
the USB device and on the computer;
the number changes after each successful
login attempt.
When a user logs in, PAM checks
both the specified USB device properties
and the random number. If the
number stored on the USB does not
match the number on the disk, the
login fails. This prevents attackers
from stealing the random number,
placing it on their own USB device,
and then modifying the properties of
their own device to access the system.
Because the random number on
the system changes after each login,
Figure 5: On Fedora, system‐config‐authentication provides a basic
PAM configuration tool.
Figure 6: The USB device is identified by its properties. If the user tries to log in without the
device, it will not work.
80 Admin 01 www.admin-magazine.com