Linux-PAM demystified
summary
Explains that PAM is a dynamic library framework with per-service files in /etc/pam.d that splits work into authentication, account, session, password stages; details control flags like required/requisite/sufficient/optional and the extended return→action syntax that implements conditional branching; warns about the frozen stack behavior where the module sequence is fixed on first call and can unexpectedly skip lines; covers debugging with strace, notes pam_test is unmaintained, and flags pam_unix’s setuid-helper issue.
AI-written summary · about
chapters (7)
- 0:00Introduction to Linux-PAM
- 1:41Management groups
- 5:28Detailed module roles
- 7:27Configuration and syntax
- 22:52Frozen stack concept
- 27:11Troubleshooting practices
- 28:44Debugging and Q&A
related talks
22mThe Sheer Terror of PAM
51mManaging Access in a Distributed Linux Infrastructure
26mWho Authenticates Linux? Rethinking PAM & NSS in the Age of Cloud Identity
47mPasswordless in PAM: Myth or Reality?
14mThe Problem Isn’t Access, It’s Actions
46mCurrent State of Kernel Audit and Linux Namespaces, Looking Ahead to Containers
22mApplication Whitelisting in Linux environment
12mIAM and Privileged Access Foundations for Secure ML Platforms