Linux User Authentication

Last update: 12 January 2020

In This article, I'm going to explain how the authentication mechanism in GNU/Linux systems works, and how you can use PAM to enhance security in your Linux machines. Let's get started !

NSS (Name Service Switch)

NSS is part of glibc and it's used to indicates the sources from which a variety of information can be obtained. The configuration file /etc/nsswitch.conf lists the different supported databases example:

passwd:         compat systemd
group:          compat systemd
shadow:         compat
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

The first column is the database name. The other columns are service specifications.

Let's explain the following line for example:

hosts:          files dns

the hosts database is responsible for name resolution. Whenever a program perform a name resolution query, the system will first look at /etc/hosts (that's what files mean) and if it can not find the answer then it will query a DNS server specified in /etc/resolv.conf (that's what dns means).

passwd database is where users information can be retrieved. In the example above the first source to look at is /etc/passwd.

Query the databases

getent command is used to query different databases. The syntax is as follows:

$ getent database_name entity


# Name resolution
$ getent hosts

# User information
$ getent passwd root

For more information, check the man page

$ man nsswitch.conf

PAM (Pluggable Authentication Modules )

PAM is a framework for user authentication. It provides to the admin the freedom to choose the authentication mechanism of his choice and put a variety of constraints on authentication process. Linux PAM deals with 4 separate types of modules:

  • auth: which verifies user identity.
  • account: which checks user account against configured constraints.
  • session: which runs actions at the beginning and the end of each session.
  • password: which updates passwords.

Whenever a program wants to perform authentication actions, it delegates that to to PAM, which checks the contents of the PAM configuration files and loads the necessary modules. These modules fall into one of four types listed above and are stacked in the order they appear in the configuration file. These modules, when called by PAM, perform various authentication tasks for the program. To check if a program is PAM aware, you use the ldd command to see if it's dynamically linked to libpam.

$ ldd /bin/su (0x00007fff575b2000) => /lib/x86_64-linux-gnu/ (0x00007efe8e3c4000) => /lib/x86_64-linux-gnu/ (0x00007efe8e1c0000) => /lib/x86_64-linux-gnu/ (0x00007efe8df97000) => /lib/x86_64-linux-gnu/ (0x00007efe8dba6000) => /lib/x86_64-linux-gnu/ (0x00007efe8d9a2000) => /lib/x86_64-linux-gnu/ (0x00007efe8d79d000)
    /lib64/ (0x00007efe8e7e1000)

Config files

The config files are located in /etc/pam.conf and /etc/pam.d/* The syntax is as follows

module_type control_flags module_path module_args

module_type: Module type: auth, account, session, password

control_flags :

  • required: the module must run successfully for the authentication to continue. If the module fails, the authentication process continue and the user is notified at the end when the other modules finished.
  • requisite: the module must run successfully to continue. If the module fails, the authentication process stops the user is notified immediately.
  • sufficient: The module result is ignored if it fails. If the modules runs successfully AND no prior required modules have failed then the authentication is granted without calling any further modules.
  • optional: The module result is ignored unless it's the only one on the stack.
  • include: Include configuration from another file.

module_path: Module name to use and where to find it.

module_args: Module arguments.


A typical PAM configuration for su command would look like this:

# Allow root without password
auth       sufficient

# Set the environment variables from /etc/security/pam_env.conf
session    required readenv=1

# Set the environment variables from /etc/default/locale
session    required readenv=1 envfile=/etc/default/locale

# Notify when new mail is available, nopen means "do not print mail information on login"
session    optional nopen

# Set limits on the system resources.
session    required

# Include common configurations
@include common-auth
@include common-account
@include common-session

Some useful PAM modules:

pam_cracklib: Used for strength checking for passwords. Example:

# retry=3        The user have 3 attempt to enter the right password
# minclass=3     The password has to include at least 3 different classes of characters
# minlen=12      The password size has to be at least 12 characters
# maxrepeat=3    The password shouldn't have more than 3 consecutive characters
password required retry=3 minclass=3 minlen=12 maxrepeat=3

pam_tally2: Used to count the access attempts. Example:

# deny=3             Lock the account after 3 failed attempts
# lock_time=3600     Unlock the account after 1h
auth required deny=3 unlock_time=3600

pam_pwhistory:Used to save the last passwords for each user to prevent users alternating between the same set of passwords. Example:

# remember=5         Save the last 5 password for each user in /etc/security/opasswd
# enforce_for_root   Include the root too
password required  remember=5 enforce_for_root

To learn more about PAM, check the official documentation here

SSSD (System Security Services Daemon)

SSSD provides access to local or remote identity and authentication resources through a common framework that can provide caching and offline support to the system. SSSD supports many providers like Kerberos for authentication and LDAP for identity service.

To learn more about SSSD check the official documentation here

Read more ...

Kubernetes Security Considerations

Create your own image for jetson nano board

Linux full disk encryption