\section{Configuring PAM}

\begin{frame}
   {PAM Rules}

   \begin{itemize}
      \item \texttt{module-type control-flag pam-module}
      \item \texttt{module-type} is one of:
      \begin{itemize}
         \item \texttt{auth}
         \item \texttt{account}
         \item \texttt{password}
         \item \texttt{session}
      \end{itemize}
      \item \texttt{control-flag} is one of:
      \begin{itemize}
         \item \texttt{required}
         \item \texttt{requisite}
         \item \texttt{optional}
         \item \texttt{sufficient}
      \end{itemize}
      \item \texttt{pam-module}: any module name with parameters
   \end{itemize}

\end{frame}

\cprotect\note{

The module type controls the step of the
authentication process.

\texttt{auth}: Instructs the application to prompt
the user for identification (username, password, etc).
May set credentials and grant privileges.

\texttt{account}: Checks on aspects of the user's
account such as password aging, access control.

\texttt{password}: Responsible for updating the user
authentication token, usually a password.

\texttt{session}: Used to provide functions before
and after the session is established (such as setting
up environment, logging, etc.).

The \texttt{control} flag controls how the success or failure
of a module affects the overall authentication
process.

\texttt{required}: Must return success for the
service to be granted.  If part of a stack, all other
modules are still executed.  Application is not told
which module or modules failed.

\texttt{requisite}: Same as required, except a
failure in any module terminates the stack and a
return status is sent to the application.

\texttt{optional}: Module is not required.  If it is
the only module then its return status to application
may cause failure.

\texttt{sufficient}: If this module succeeds then no
subsequent modules in the stack are executed. If it
fails then it does not necessarily cause the stack to
fail unless it is the only one in the stack.

\texttt{Pam-module} is a module in
\filelink{/lib[64]/security}

There are other \texttt{control} flags such as
\texttt{include}  and \texttt{substack}.

}




