2

I have an application that prompts for the password of the logged in user using PAM as an authentication source. The current PAM configuration for that application reads:

@include common-auth
@include common-account

I would like this application to use a custom password that I would define and hard code instead of the one of the logged in user. How can I achieve that?

3

Instead of importing the system's authentication mechanisms, configure pam_userdb or write a simple custom PAM module yourself. Load it as the only module in the stack:

auth requisite pam_userdb.so db=/etc/security/myapp.passwd.db

@include common-account
1
  • Thank you! This works great. I created the pam_userdb database file with db_load -T -t hash myapp.passwd.db. Note that the db argument to pam_userdb.so must not have the .db suffix because it is implicitly added by PAM. – bbc Oct 3 '16 at 12:33
1

One (probably slightly simpler) alternative is to use pam_pwdfile. It essentially allows authentication against a user-specified file, formatted like the default /etc/passwd file.

pam_pwdfile does not seem to be developed, but it probably just works and needs no new features. It is also available in the Debian archive, which gives it security support (if ever needed).

To use it, install it (e.g. libpam-pwdfile on Debian) and put a line like this in your pam config:

auth        required    pam_pwdfile.so pwdfile=/path/to/passwd_file

See the README for details.

The /path/to/passwd file should contain a list of usernames and hashed passwords, separated by colons, one user on each line. The hashed password can be taken from your /etc/shadow file, or generated with mkpasswd. E.g., to get a SHA-512-hashed password:

$ mkpasswd -m SHA-512

An example passwd file could look like below. This shows a SHA-512 and descrypt hashed password:

user1:$6$usgsi1RNu7wI$4rly97OA5ot5nsVSusW1jmwdjpHY7qbzGOX.E/TPfJqDuFnmMoCGVd1p1U/ew7e599QQLPnfkW0yLyuyaoAPl0
user2:NxR.0DdgI2Jnc

A similar alternative pam-module is pam_fshadow, but this module does not seem packaged by Debian, so I have not investigated it further.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.