Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
Objectives
After completing this section, students should be able to change the existing PAM configuration and explain recommended practices for modifying and managing PAM configuration files.
Preparing for Configuration Update
Because PAM controls access to the system, an error in its configuration can have severe consequences.
An administrator might accidentally provide too much system access, allowing access to users that should be denied.
An incorrect configuration can also lock you out of the system; even the root user may be denied access.
To mitigate these issues, Red Hat recommends the following precautions:
Use the authconfig --savebackup=
backupdircommand to back up the PAM configuration.[root@demo ~]#authconfig --savebackup=/root/pambackupTo restore the configuration, use the
--restorebackup=option.backupdirOpen a
rootshell on an additional terminal and leave it open. If you lock yourself out of the system, you still have this open shell to fix the problem. Before closing this rescue terminal, confirm that the new PAM configuration works as expected. If you encounter any issues, do no reboot your system before fixing them.Use the provided tools to configure PAM rather than manually modifying the files. The authconfig command has options to perform the most common configurations. Use its
--helpoption to review the capabilities of this tool.
Using authconfig to Configure PAM
Administrators should use the authconfig tool to configure PAM whenever possible. authconfig provides a command-line tool as well as a graphical interface through the authconfig-gtk command. The authconfig-tui command provides a text-based interface but is now deprecated.
Administrators can also use authconfig to manage the Name Service Switch (NSS) to configure access to the user information databases.
The authconfig command works in two modes:
- Update mode
Use authconfig with
--updateto update the configuration according to the configuration options you provide.- Test mode
Use authconfig with
--testto print the configuration without applying it.
In update mode, authconfig modifies the /etc/pam.d/system-auth-ac and /etc/pam.d/password-auth-ac files.
Recall that most of the PAM service configuration files include the system-auth and password-auth files.
These two files are symbolic links to the system-auth-ac and password-auth-ac files.
[root@demo ~]#cd /etc/pam.d[root@demo pam.d]#ls -l system-authlrwxrwxrwx. 1 root root 14Mar 22 15:11system-auth -> system-auth-ac[root@demo pam.d]#ls -l password-authlrwxrwxrwx. 1 root root 16Mar 22 15:11password-auth -> password-auth-ac
This way, when authconfig updates its *-ac files, the configuration takes effect immediately.
Manually Configuring PAM
In most situations, administrators can rely on authconfig to configure PAM. For some specific configurations, however, you may need to edit the PAM configuration files manually.
Important
When editing a PAM configuration file, make sure that you make all the changes you need before saving the file. Because PAM immediately applies the modifications, a partial configuration may render your system inaccessible.
Deciding to configure PAM manually requires some precautions.
For example, if you edit the system-auth file, which is a symbolic link to system-auth-ac, a subsequent call to authconfig overwrites your changes.
There are two ways you can avoid this:
Configure the system to prevent authconfig from overwriting your configuration. Using authconfig has no effect anymore and you can only configure PAM manually.
Configure the system so that you can use both methods, authconfig and manual editing.
Only Allowing Manual Configuration
To prevent authconfig from overwriting your modifications, create a system-auth-local file and a password-auth-local file to use for manual configuration.
You can copy the existing system-auth-ac and password-auth-ac files as a starting point.
You can then recreate the system-auth and password-auth symbolic links and make them point to your local files.
[root@demo ~]#cd /etc/pam.d[root@demo pam.d]#cp system-auth-ac system-auth-local[root@demo pam.d]#cp password-auth-ac password-auth-local[root@demo pam.d]#rm system-auth password-auth[root@demo pam.d]#ln -s system-auth-local system-auth[root@demo pam.d]#ln -s password-auth-local password-auth[root@demo pam.d]#ls -l system-auth password-authlrwxrwxrwx. 1 root root 19Jul 17 07:24password-auth -> password-auth-local lrwxrwxrwx. 1 root root 17Jul 17 07:24system-auth -> system-auth-local
|
Make a copy of the existing |
| Remove the symbolic links. |
|
Recreate the links to point to your custom |
Now you can edit the custom system-auth-local and password-auth-local files without risking an overwrite by authconfig.
If you mistakenly uses authconfig, the command updates the system-auth-ac and password-auth-ac files, but this does not affect the current PAM configuration.
Allowing both Manual and authconfig Configuration
You might prefer to continue using authconfig but also allow manual configuration.
This requires an extra step; create your own set of custom files for manual configuration, and include the *-ac files in those files.
[root@demo ~]#cd /etc/pam.d[root@demo pam.d]#cp system-auth-ac system-auth-local[root@demo pam.d]#cp password-auth-ac password-auth-local[root@demo pam.d]#rm system-auth password-auth[root@demo pam.d]#ln -s system-auth-local system-auth[root@demo pam.d]#ln -s password-auth-local password-auth[root@demo pam.d]#ls -l system-auth password-authlrwxrwxrwx. 1 root root 19Jul 17 07:24password-auth -> password-auth-local lrwxrwxrwx. 1 root root 17Jul 17 07:24system-auth -> system-auth-local[root@demo pam.d]#vim system-auth-localauth include system-auth-ac account include system-auth-ac password include system-auth-ac session include system-auth-ac[root@demo pam.d]#vim password-auth-localauth include password-auth-ac account include password-auth-ac password include password-auth-ac session include password-auth-ac
|
Make a copy of the of the existing |
| Remove the symbolic links. |
|
Recreate the links to point to your custom |
|
In you custom files, include the |
You can now use the custom *-local files for manual configuration, but include the *-ac files for the configuration you do through authconfig.
References
For more information, refer to the Using authconfig chapter in the Red Hat Enterprise Linux 7 System-Level Authentication Guide at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/system-level_authentication_guide/#authconfig-install
For more information, refer to the Account Locking section in the Red Hat Enterprise Linux 7 Security Guide at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/security_guide/#sect-Security_Guide-Workstation_Security-Account_Locking
