Chapter 10. Restricting domains for PAM services using SSSD

Pluggable Authentication Modules (PAMs) provide a centralized authentication mechanism, which a system application can use to relay authentication to a centrally configured framework.

PAM is pluggable because a PAM module exists for different types of authentication sources, such as Kerberos, SSSD, NIS, or the local file system. You can prioritize different authentication sources.

This modular architecture offers administrators a great deal of flexibility in setting authentication policies for the system. PAM is a useful system for developers and administrators for several reasons:

To restrict access to selected domains, you can use the following options:

The default settings pam_trusted_users = all and pam_public_domains = none specify that all PAM service users are trusted and can access any domain. Use the domains option in PAM configuration files to restrict domain access.

Specifying a domain using domains in the PAM configuration file while sssd.conf contains pam_public_domains also requires to specify the domain in pam_public_domains. The pam_public_domains option without including the required domain leads the PAM service to unsuccessful authentication against the domain in case this service is running under an untrusted user.

You can restrict a PAM service authentication to specified domains.

PAM configuration files specify the authentication methods and policies for services in Red Hat Enterprise Linux. Each PAM aware application or service has a corresponding file in the /etc/pam.d/ directory. The file is named after the service it controls access to. For example, the login program has a corresponding PAM configuration file named /etc/pam.d/login.

PAM configuration file format

Each PAM configuration file consists of directives that define settings for a specific module. PAM uses arguments to pass information to a pluggable module during authentication for some modules.

module_type	control_flag	<module_name> <module_arguments>

For example:

auth	required	pam_unix.so

PAM module types

A PAM module type specifies the type of authentication task that a module performs. The module can perform the following tasks:

An individual module can provide any or all module types. For example, pam_unix.so provides all four module types.

The module name, such as pam_unix.so, provides PAM with the name of the library containing the specified module type. The directory name is omitted because the application is linked to the appropriate version of libpam, which can locate the correct version of the module.

Module type directives can be stacked, or placed upon one another, so that multiple modules are used together for one purpose. The order of the modules is important, along with the control flags, it determines how significant the success or failure of a particular module is to the overall goal of authenticating the user to the service.

You can stack PAM modules to enforce specific conditions that must be met before a user is allowed to authenticate.

PAM control flags

When a PAM module performs its function, it returns a success or failure result. Control flags instruct PAM on how to handle this result.

Simple flags use a keyword, more complex syntax follows [<value1>=<action1> <value2>=<action2> …​] format.

For a detailed description of PAM control flags, including a list of options, see the pam.conf(5) man page.

See an example of PAM configuration file with the detailed description.

#%PAM-1.0
auth		required	pam_securetty.so 1
auth		required	pam_unix.so nullok 2
auth		required	pam_nologin.so 3
account		required	pam_unix.so 4
password	required	pam_pwquality.so retry=3 5
password	required	pam_unix.so shadow nullok use_authtok 6
session		required	pam_unix.so 7