In this section, we give some examples of entries that can be present in the Linux-PAM configuration file. As a first attempt at configuring your system you could do worse than to implement these.
If a system is to be considered secure, it had better have a reasonably secure 'other entry. The following is a paranoid setting (which is not a bad place to start!):
#
# default; deny access
#
other auth required pam_deny.so
other account required pam_deny.so
other password required pam_deny.so
other session required pam_deny.so
Whilst fundamentally a secure default, this is not very sympathetic to a misconfigured system. For example, such a system is vulnerable to locking everyone out should the rest of the file become badly written.
The module pam_deny (documented in a later section) is not very sophisticated. For example, it logs no information when it is invoked so unless the users of a system contact the administrator when failing to execute a service application, the administrator may go for a long while in ignorance of the fact that his system is misconfigured.
The addition of the following line before those in the above example would provide a suitable warning to the administrator.
#
# default; wake up! This application is not configured
#
other auth required pam_warn.so
other password required pam_warn.so
Having two 'other auth' lines is an example of stacking.
On a system that uses the /etc/pam.d/
configuration, the corresponding default setup would be
achieved with the following file:
#
# default configuration: /etc/pam.d/other
#
auth required pam_warn.so
auth required pam_deny.so
account required pam_deny.so
password required pam_warn.so
password required pam_deny.so
session required pam_deny.so
This is the only explicit example we give for an
/etc/pam.d/ file. In general, it
should be clear how to transpose the remaining examples
to this configuration scheme.
On a less sensitive computer, one on which the system
administrator wishes to remain ignorant of much of the
power of Linux-PAM, the
following selection of lines (in
/etc/pam.d/other) is likely to
mimic the historically familiar Linux setup.
#
# default; standard UN*X access
#
auth required pam_unix.so
account required pam_unix.so
password required pam_unix.so
session required pam_unix.so
In general this will provide a starting place for most applications.