Determining whether a client is permitted to access a resource is a two-step process. First, the application must authenticate the client. That is, the application must prove that the client is who they claim to be. Then, the application must determine whether that client is authorized to access the resource.

For example, a client that types the correct username and password at a login prompt has authenticated that they are that user. However, access control restrictions might not authorize that user to log in at the current time, so the client might be returned to the login prompt.

PAM manages both authentication and authorization.

Red Hat Enterprise Linux 8 and later versions provide several security profiles. You can list the available security profiles by using the authselect list command.

The security profile that you choose depends on your organization's environment and security requirements.

Each security profile can implement additional features, which enable specific additional PAM modules or which adjust existing PAM configurations. To see the available additional features for a security profile, use the authselect list-features command. The following example lists the additional feature options for the minimal profile:

[root@host ~]# authselect list-features minimal
with-altfiles
with-custom-aliases
with-custom-automount
with-custom-ethers
with-custom-group
with-custom-hosts
with-custom-initgroups
with-custom-netgroup
with-custom-networks
with-custom-passwd
with-custom-protocols
with-custom-publickey
with-custom-rpc
with-custom-services
with-custom-shadow
with-ecryptfs
with-faillock
with-mkhomedir
with-pamaccess
with-pwhistory
with-silent-lastlog
without-nullok

To select a security profile, use the authselect select command. The following example selects the minimal security profile:

[root@host ~]# authselect select minimal
Profile "minimal" was selected.
...output omitted...

You can select additional features by appending them to the authselect select command. The following example selects the minimal security profile with the with-pwhistory and with-mkhomedir additional features:

[root@host ~]# authselect select minimal with-pwhistory with-mkhomedir
Profile "minimal" was selected.
...output omitted...

You can view the current authselect security profile and additional features by using the authselect current command.

[root@host ~]# authselect current
Profile ID: sssd
Enabled features:
- with-mkhomedir
- with-silent-lastlog
- with-mdns4

Security features with additional options have configuration files in the /etc/security/ directory. You can edit these configuration files to further customize the security options on a system. Because each configuration file contains different options that are specific to the application or PAM module, Red Hat recommends reviewing the man page for a configuration file before editing it.

You can view the PAM configuration files that the authselect tool generates in the /etc/pam.d/ directory to see the exact configuration effects. Application configuration files in the /etc/pam.d/ directory follow a standard format for their rules:

type  control module [module arguments]

The following output shows the /etc/pam.d/system-auth file as an example.

[root@host ~]# cat /etc/pam.d/system-auth
# Generated by authselect
# Do not modify this file manually, use authselect instead. Any user changes will be overwritten.
# See authselect(8) for more details.

auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so ...
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        [default=1 ignore=ignore success=ok]         pam_localuser.so
auth        sufficient                                   pam_unix.so nullok
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        sufficient                                   pam_sss.so forward_pass
auth        required                                     pam_deny.so

account     required                                     pam_unix.so
account     sufficient                                   pam_localuser.so
account     sufficient                                   pam_usertype.so issystem
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required                                     pam_permit.so

password    requisite                                    pam_pwquality.so ...
password    sufficient                                   pam_unix.so ...
password    [success=1 default=ignore]                   pam_localuser.so
password    sufficient                                   pam_sss.so use_authtok
password    required                                     pam_deny.so

session     optional                                     pam_keyinit.so revoke
session     required                                     pam_limits.so
-session    optional                                     pam_systemd.so
session     optional                                     pam_oddjob_mkhomedir.so
session     [success=1 default=ignore]                   pam_succeed_if.so ...
session     required                                     pam_unix.so
session     optional                                     pam_sss.so

The first field is the type, and organizes the tests into four management groups: auth, account, password, and session. The application invokes each group at a different time during a user authentication and authorization process.

The order of the rules in a management group is essential, because PAM rules are parsed and executed from top to bottom.

For a dash (-) character in front of a type, such as -session near the end of the /etc/pam.d/system-auth file, PAM silently skips the rule if the module file is missing.

Some modules, such as the pam_unix module, can be called in multiple management groups. When PAM calls these modules, they know in which group they are running and adapt their behavior accordingly.

The next field, the control field, determines how the associated test affects the group's overall result. Of the many possible values for this field, the most common ones are included in the following table:

The next field is the PAM module itself. Although you can give the full path to the module, usually you give only the relative path. PAM looks for the modules in the /usr/lib64/security/ directory.

Modules return a code that PAM interprets as either success or error. PAM modules can also take options or arguments to alter their behavior. Not every module takes arguments, and options or arguments are usually unique to a specific module.

The sssd security profile allows user authentication against remote identity management services, such as LDAP and Kerberos. When a remote user authenticates on the local system, SSSD stores their credentials and authentication parameters to a local cache. This way, even if the remote authentication server is not reachable, the remote user can still log in to the local system. This feature is particularly useful for laptops that are disconnected from the company network, and it also helps to reduce the load on the remote authentication services.

You can view documentation for authselect security profiles by using the authselect show command.

This documentation includes a description of the security profile, information about additional configuration, and information about each optional feature of the profile.

Documentation for configuration files for security features in the /etc/security/ directory can be found in the man pages. Each configuration file has an associated man page with descriptions, options, defaults, and syntax information.

For example, the /etc/security/faillock.conf configuration file is documented by the faillock.conf (5) man page.

Additionally, PAM modules have documentation through the man pages. Most of the modules have a dedicated man page with the following information:

For example, the pam_unix module is documented by the pam_unix (8) man page. The man page names do not include the .so module extension.

The pam.conf(5) man page describes the full syntax of the PAM configuration files.

The PAM man pages typically start with the pam_ prefix. The man -k pam_ command returns a long list of related man pages.