CIS 193A - Lesson2
description
Transcript of CIS 193A - Lesson2
CIS 193A – Lesson2CIS 193A - Lesson2
Authorization & Authentication
Sudo and PAM
CIS 193A – Lesson2
Quote of the Day
In ubiquitous computing environments, the computer technology will recede into the background of our lives for its ultimate goal, invisibility.
Taekyoung KwonDept. of Computer Engineering Sejong University, Seoul
CIS 193A – Lesson2
Focus Question
What is the difference between authentication and authorization, and how do PAM and sudo relate to these two concepts?
CIS 193A – Lesson2
The Sudo Facility
The sudo facility consists of:• the sudo command: /usr/bin/sudo
• a configuration file: /etc/sudoers
The sudoers file specifies who is able to run what commands as what user on which hosts.
CIS 193A – Lesson2
Sudoers Syntaxwho hosts = [ (as who) ] [ tags ] commands• who::= username | %groupname• hosts::= localhost | hostname | IP address• as who::= username• tags::= NOPASSWD | NOEXEC | NOSETENV• Commands::= command [options] [args]
Keyword: ALL represents any possible value:%wheel ALL = (ALL) ALL
Aliases may be used to represent any of the above as a list of values
CIS 193A – Lesson2
Sudo Examples
• Allow user john to run all commands as root on the local machine.
john localhost = (root) ALL
• Allow the group admins to run the kill command as any member of the users group on any host.
%admins ALL = (%users) /bin/kill
CIS 193A – Lesson2
Use of the sudo command• Run a command as another user:
sudo –u user commandPassword:_ # must supply your password, # not the targeted user.
• Run a command as root:
sudo commandPassword: # your password, not root’s
Note: when running successive sudo commands, you will be prompted for a password only on the first invocation.
CIS 193A – Lesson2
PAMPluggable
Authentication
Modules
CIS 193A – Lesson2
The PAM Facility
The PAM facility consists of:• the PAM libraries: /lib/security/pam_*.so
• a configuration file: /etc/pam.conf or
a configuration directory: /etc/pam.dwith configuration files for each service
Other configuration files associated with the libraries occur in the /etc and /etc/security.
CIS 193A – Lesson2
PAM File Syntax
Type Control PAM Library Parameters
Example configuration file: system-auth
auth required pam_env.soauth sufficient pam_unix.so nullok auth requisite pam_succeed_if.so uid >= 500 quiet
account required pam_unix.so broken_shadowaccount sufficient pam_succeed_if.so uid < 500 quiet
password requisite pam_cracklib.so try_first_pass retry=3password sufficient pam_unix.so sha512 shadow nullok use_authtok
session optional pam_keyinit.so revokesession required pam_limits.so
CIS 193A – Lesson2
PAM Module Types
Auth authenticates a user and set up user credentials
Password used to define passwords
Account checks for account privileges, such as expiration or time-of-day restrictions.
Session once a user is authenticated,this controls the setup and break down of the session.
CIS 193A – Lesson2
PAM Control Flags
Required The module check must be successful, but continue on with other modules regardless.
Requisite The module check must be successful, if it isn’t, the authentication fails immediately and no other modules are checked.
Sufficient If this module check is successful, and there are no Required flag failures, then authentication is granted immediately.
Optional Not used unless no other module has determined a success or failure.
CIS 193A – Lesson2
Common PAM Libraries pam_access.so pam_keyinit.so pam_permit.so
pam_ccreds.so pam_krb5.so pam_chroot.so pam_postgresok.so pam_time.so pam_pwhistory.so pam_timestamp.so pam_cracklib.so pam_lastlog.so pam_tty_audit.so pam_debug.so pam_ldap.so pam_rhosts.so pam_umask.so pam_deny.so pam_limits.so pam_rootok.so pam_unix_acct.so pam_echo.so pam_listfile.so pam_rps.so pam_unix_auth.so pam_env.so pam_localuser.so pam_securetty.so pam_exec.so pam_loginuid.so pam_selinux.so pam_mail.so pam_shells.so pam_unix.so pam_mkhomedir.so pam_smb_auth.so pam_userdb.so pam_filter.so pam_motd.so pam_smbpass.so pam_warn.so pam_ftp.so pam_namespace.so pam_stack.so pam_wheel.so pam_group.so pam_nologin.so pam_issue.so pam_passwdqc.so pam_succeed_if.so pam_xauth.so
CIS 193A – Lesson2
Review
CIS 193A – Lesson2
Focus Question
What is the difference between authentication and authorization, and how do PAM and sudo relate to these two concepts?
Authentication verifies that you are who you say you are. Once authentication is accomplished, authorization answers what you are allowed to do. PAM performs authentication, sudo handles authorization.
CIS 193A – Lesson2
Multi-Factor Authentication
• Single factor:– Based upon something you have
• Two factor:– Based on something you have and– Something you know
• Three factor:– Based on something you have,– Something you know, and– Something you are