3

I have an application that prompts for the password of the logged in user using PAM as an authentication source. The current PAM configuration for that application reads:

@include common-auth
@include common-account

I would like this application to use a custom password that I would define and hard code instead of the one of the logged in user. How can I achieve that?

2 Answers 2

3

Instead of importing the system's authentication mechanisms, configure pam_userdb or write a simple custom PAM module yourself. Load it as the only module in the stack:

auth requisite pam_userdb.so db=/etc/security/myapp.passwd.db

@include common-account
1
  • Thank you! This works great. I created the pam_userdb database file with db_load -T -t hash myapp.passwd.db. Note that the db argument to pam_userdb.so must not have the .db suffix because it is implicitly added by PAM.
    – bbc
    Oct 3, 2016 at 12:33
3

One (probably slightly simpler) alternative is to use pam_pwdfile. It essentially allows authentication against a user-specified file, formatted like the default /etc/passwd file.

pam_pwdfile does not seem to be developed, but it probably just works and needs no new features. It is also available in the Debian archive, which gives it security support (if ever needed).

To use it, install it (e.g. libpam-pwdfile on Debian) and put a line like this in your pam config:

auth        required    pam_pwdfile.so pwdfile=/path/to/passwd_file

See the README for details.

The /path/to/passwd file should contain a list of usernames and hashed passwords, separated by colons, one user on each line. The hashed password can be taken from your /etc/shadow file, or generated with mkpasswd or openssl. E.g., to get a SHA-512-hashed password use either of these commands:

$ mkpasswd -m SHA-512
$ openssl passwd -6

An example passwd file could look like below. This shows a SHA-512 and descrypt hashed password:

  user1:$6$usgsi1RNu7wI$4rly97OA5ot5nsVSusW1jmwdjpHY7qbzGOX.E/TPfJqDuFnmMoCGVd1p1U/ew7e599QQLPnfkW0yLyuyaoAPl0
user2:NxR.0DdgI2Jnc

A similar alternative pam-module is pam_fshadow, but this module does not seem packaged by Debian, so I have not investigated it further.

2
  • This is a more straight forward solution. Although I don't have the mkpasswd on my machine. Instead openssl passwd -6 can be used. (-6 is for SHA512: manual)
    – eternal
    Feb 17, 2023 at 21:11
  • Thanks, I've added that command to the answer! Feb 18, 2023 at 12:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .