Modules/Applications available or in progress...

$Date: 2007/10/23 04:05:02 $

Here is a list of the modules that people are using/developing for use with PAM:

The point of having modules is that you can just plug them in(!) In other words, they do not need to be compiled at the same time as the PAM library to work. Here are some alternative sources for modules that are being provided independently of the main library:

Other places to find out about modules

• Freshmeat
• Openwall has PAM web pages

Specific modules linked from this page

News about new stuff (or revisions to old stuff) get bubbled up to the top of the page...

• One-time password authentication
  • Frank Cusack recommends his company's OTP authentication module pam_otp_auth that works with a daemon (otpd) to support various hardware and software tokens.
  • Pedro Diaz is working on a one-time password module: pam_sotp.
  • Andy Berkheimer has written NRL PAM-OPIE module.
  • (Backgroud information, NRL OPIE is a one-time password authentication scheme based on S/Key and works on most unix systems. Available from http://www.inner.net/pub/opie.
• USB dongle authentication
  • Erik Sonn announced a USB dongle authentication module.
• Kerberos
  • Russ Allbery maintains a Kerberos 5 module that has combined various features of the modules listed below.
  • Simon Josefsson is developing GNU Shishi a free Kerberos 5 implementation. He is including a pam_shishi module.
  • Frank Cusack has written a Kerberos 5 PAM module. It is currently maintained at sourceforge. Details for checking out the sourcecode are here and a tar ball of a recent version can be found here.
  • Steve Langasek has written a stackable authentication module (pam_krb5_migrate) that takes a username and password from an earlier module in the stack, and attempts to transparently add them to a Kerberos realm using the Kerberos 5 kadmin service.
  • Kerberos authentication scheme
  • also Kerberos 5 authentication by Naomaru Itoi
  • Kerberos v5 pluggable authentication module for Solaris and Linux by Wyman Miles
  • An implementation has been written for Kerberos 4 authentication by Derrick J Brashear
• pam_rsa
  • Hyperllama is interested in receiving feedback on an experimental poor-man's smartcard module pam_rsa details here.
• pam_tdeny
  • this module denies password changing for all users who are NOT in /etc/passwd
• OpenPGP
  • Moritz Schulte has written a PAM module ("Poldi") that implements authentication through OpenPGP smartcards. Announcements on changes to this module are made to the GNUPG development mailing list.
• pampka
  • Andrey Warkentin writes ... basically it's the poor man's version of "secure token authentication", except this is not very secure, with the private key actually being read from the "token", instead of the signature being generated on the token itself. :-)
• pam_abl
  • Andy Armstrong recommends a module to automatically blacklist hosts from which large numbers of failed login attempts originate.
• pam_storepw
  A password caching module can be used to temporarily cache a user password so you can gain other services automatically. The link given here describes a way to use autofs to mount a CIFS file system.
• Bluetooth
  • Paul Pfeifer has developed a module for authentication between bluetooth devices.
• POP3
  • Schlomo Schapiro has created a POP3 PAM module.
• SQL database based authentication
  • Helmut Tessarek has started a sourceforge project to develop a pam_ibmdb2 module
  • Jason Robertson is working on a postgres module of his own. His latest version can be found here: pam_pgsl_day....
  • Mike Glover has written pam_sql which seems to support a Postgres SQL database.
  • Postgres SQL - Alessandro Gardich is writing a Postgres PAM module
  • MySQL - James O'Kane et al. are working on MySQL PAM module. MySQL is a "true multi-user, multi-threaded SQL database server. SQL is the most popular database language..." (more) (Also of interest is the NSS module for MySQL.)
  • Informix SQL - Carsten Koester has written a module for authenticating against username/password pairs contained on an Informix SQL database server.
• Tim Baverstock's modules (and more): http://www.baverstock.org.uk/tim/pam/
• pam_epass
  • a module to protect Linux login with a (hardware) cryptographic token capable of symmetric operations. There is a magazine article describing all this available in both English and Dutch.
• Misc - a bunch of toolkit modules
  • Enrique Ocańa González has written a module to force script execution at authentication time.
  • Wyman Miles has implemented a basic logging module.
  • pam_make
    • Mihai Ibanescu has written a password module that runs 'make' in a specified directory. The need for this stemed from wanting to keep db in synch with the /etc/passwd file.
• Lock-out module
  • Brian Weaver has written a lock-out module.
• Already logged in?
  • Ilya Evseev has ported the already logged in PAM module to linux.
• NewsCache
  • NewsCache containing the PAM Patch from Tuomo Pyhala.
• SecurID
  • (Costin Enache had written a SecurID PAM + "server", but rumor has it he was threatened by RSA's lawyers.. Costin's sourceforge site and the associated source code have dropped off the net. Apparently, for the cost of your contact information, RSA now offer something similar - search for 'PAM' at the RSA site for more info.)
  • A derivative of Wyman Miles' module that authenticates using RSA securid cards.
  • Here is a SecurID module hosted at projects.jdimedia.nl Igmar Palsenberg indicates that it was originally designed for CryptoCard RB1 tokens, but it also works with SecureID.
  • There are some hints at SecurID support associated with OpenSSH. The author mentions PAM, but from the README its not clear how this is implemented.
  • Wyman Miles claims to have implemented a module for this flavor of authentication that is the same module as his S/Key module.
• pam_require
  • simple Pluggable Authentication Module (PAM) for Linux (and maybe other systems which use PAM). It is an account module that allows you to require a special user or group to access a service.
• pam_dotfile
  • Lennart Poettering has written pam_dotfile, which provides an alternative authentication mechanism for services based on the existence and contents of a .pam-service file.
• voiceauth
  • Lucas Correia Villa Real has created a Voice authentication module.
• crypt2g
  • Denis Bodor has written a crypt2g PAM module to authenticate using a "european phone card reader".
• pam_idsa
  • Marc Welz has written a module that interfaces with his Application level IDS system.
• CODA
  • Ivan Popov is supporting the Kerberos-Coda module.
  • Robin Gareus has writen a PAM-CODA module that can do all the initialization stuff that Coda needs at login time.
• pam_user_auth
  • Mark D Roth has written a number of modules for PAM, including a "PAM Module for Per-User Authentication".
• pam_mount
  • W. Michael Petullo is supporting an improved branch of pam_mount. There is a copy cached here.
  • Elvis Pfützenreuter created the original pam_mount module for leveraging a user password to mount password protected filesystems. Elvis' site appears to have dropped off the net.
• SafeWord
  • SafeWord is a product of Secure Computing. Here is how Secure Computing (Courtesy of Christopher McSorley) describe the current support they have for PAM. I've recently heard from Will Melick who was evaluating their Linux offering, that they also support Linux's PAM now:

    "SafeWord Agent for PAM; Pluggable Authentication Modules (PAM) for Solaris v2.6/v2.7 and HP-UX v11.0. The SafeWord Agent for PAM v1.0.1 is an authentication plug-in that can augment or replace the native operating system authentication mechanism. SafeWord Agent for PAM allows users to make use of SafeWord strong authentication in PAM-compliant applications supplied by Sun and others, such as login, rlogin, rsh, uucp, telnet, and ftp. To download the PAM agent, or our Software Developer's Kit (SDK), go to www.securecomputing.com"

• Password strength checking modules
  • Solar Designer's elaborate password strength checker
  • Scott Nelson's simple password length checking module
  • pam_cracklib: module distributed in the main Linux-PAM sources.
• pam_iptables
  • Michael pointed out the following link to the Authentication Gateway HOWTO which includes information about pam_iptables.
• u/wtmp handling
  • Pawel Boguslawski has written a module for logging service sessions in the UTMP and WTMP databases (it uses different approach to the problem that the "pam_utmp" written by Jan Rekorajski).
  • Jan Rękorajski has written a module for handling u/wtmp entries. Find it here.
• SAMBA
  • Samba now includes something called pam_winbind.so, which is apparently a module to help you unify the logins between your Windows NT and UNIX systems. John M. Trostel wrote up a Howto for using it, but on the web all I can find is here: some documentation on stuff including Winbind. There is also a paper on Winbind here.
  • Steve Langasek, has provided modules that will keep UNIX and SMB password changes in sync by amending the UNIX database when you change a SMB password.
  • David Airlie has produced a module that validates a username / password / domain combination using any SMB (CIFS) Server, which includes an NT Server. David has also provided a FAQ for this module.
  • Early alpha attempt from John Lane to make a module to change passwords: http://www.cse.msu.edu/~lanejohn/en/hacks/pam_smb_passwd-0.1.tar.gz using PAM.
  • Luke Leighton used David's module as the basis for a more secure form of validation that could only be performed against a Primary Domain Controller (either an NT or a Samba PDC). However, this link now leads to a README file which explains that this code (which was deemed insecure) is no longer being developed and is no longer supported code.
• chroot
  • Ed Schmollinger has writtne a pam_chroot module.
  • Matthew Kirkwood has written a chroot module.
• pam_ssh
  • Andrew J. Korty has created a module that will launch an ssh-agent at login time using your login password to decrypt your encrypted SSH private keys. The project page for this (including access to the CVS repository is here).
  • SUSE Linux has a fork of pam_ssh.
• Radius - One of the glorious things about PAM is that you can pick and choose the way you implement something. For example, we have a multiple module flavors and a server implementations to get PAM support into your RADIUS system:
  • Two RADIUS modules that work with linux and solaris derived from a GPL'd development initially funded by Cryptocard:
    • One with a home at 'The FreeRADIUS Server Project' (the module is here).
    • and the other which is still available from Cryptocard themselves.
  • For a PAM supporting Radius server take a look at: http://www.radius.cistron.nl.
  • SafeAccess(tm) technology has releaseed a GPL'd pam_lradius.so which authenticates users using RADIUS. The module supports RADIUS Access-Challenge request and thus can be used to provide SafeAccess(tm) authentication against an appropriate RADIUS server (like TraqNet8000 for Windows NT and patched Merit, Livingston & Ascend UNIX RADIUS servers). pam at engr.leemah.com (Vladimir Gurevich) of SafeAccess(tm) technology has released two modules in addition to some documentation. The other module is pam_infocard.so which authenticates users using LeeMah Datacom SafeAccess(tm) Challenge/Response (or Response-only) technology against a local user database.
  • The standard Linux-PAM distribution contains a non-authentication (only session logging) pam_radius implementation by Cristian Gafton.
• iButtons
  • Dierk Bolten has written a PAM module to authenticate with an iButton.
• IMAP
  • Here is a module to authenticate against an IMAP server.
  • There are PAM patches for Cyrus imap-server here: ftp://coyote.is.necomm.ro/pub/devel/cyrus.
• pam_netgroups
  • Tom Payerle has written a module to restrict access based on NIS or HESIOD netgroup membership.
• LDAP
  • HP-UX machines can get nss/pam support for LDAP from HP.
  • Piet Ruyssinck has written some LDAP stuff. Mostly with Solaris in mind, but it might just work under Linux too.
  • Luke Howard has written a pair of NSS and PAM modules. There are also a bunch of migration tools. (Follow these links for more info on LDAP and University of Michigan LDAP page).
  • Chris Albone had previously written an LDAP PAM module, but this link seems to be broken [Sorry].
• Cryptocard module
  • Igmar Palsenberg has made available a pam_cryptocard module. (This looks like its been renamed to pam_smxs.)
• Netscape web server ns-api
  • This is some sort of pam pluggin for a netscape server.
• pam_tcpd
  • Max Liccardo has written PAM TCPD module which implements TCP level access control with PAM.
  • An older address for this is here a module allows to use the tcpd wrapper during the authentication stage.
• TACACS+
  • WiKID Systems have a page explaining how to use PAM to do two factor authentication with TACACS+.
  • Max Liccardo has written a PAM patch for Cisco tac_plus.F4.0.3.alpha.
  • Pawel Krawczyk has written a PAM module allowing basic authentication, authorization and accounting over TACACS+ protocol.
• Netware
  • Andreas Moroder points you to some ncpfs stuff, which includes a PAM module.
  • David Airlie has written a Netware module that is available from here.
  • John Taylor and Brian Hammond have written a pam_nw_auth module for authenticating users against a Netware server. This module is available from the Linux-PAM pre-release directory [According to Alexander List, when combined with libncp, it will allow authentication via NDS (Netware 4) servers].
• PHP
  • Steve Langasek has added full PAM support to PHP
• misc solaris stuff
  • search this page for 'solaris' for other links of interest.
  • Piet Ruyssinck has done some work trying to PAMify various applications - with Solaris in mind. You can find info on POP, xdm, sshd, and imapd here.
• pam_console
  • From Michael K. Johnson: pam_console is a module that can change permissions on devices and files based on the PAM_TTY item at login and logout time. It was roughly inspired by the Solaris /etc/logindevperms file, but the syntax was expanded for maintainability, and no guarantees of backwards compatibility are given.
• mod_auth_pam
  • Ingo Lütkebohle has implemented a PAM mode for Apache
• PAM_su
  • Wyman Miles has implemented a 'wheel'-like authorization module that prevents users from su-ing to one another.
• Rhosts
  • Wyman Miles has implemented auth_hosts which is a module that offers a subset of the rhosts scheme
  • pam_rhosts rhost verification as per rlogin etc. (in the main tar ball)
• S/KEY
  • Olaf Kirch has implemented an S/KEY PAM module (look for linux-skey-...)
  • Wyman Miles has implemented this S/Key thing too.
• Enterprise Suitespot
  • Max has written a pam module for basic authentication for Netscape Enterprise Suitespot server 3.5.1.
• pam_pwdfile
  • Charl Botha has written an auth service PAM module that can be pointed at any username:crypted_password file so that separate sets of passwords can be had for different services on the same machine.
• pam_pwgen
  • Jan Rękorajski has written pam_pwgen which is a password generator module that gives user a choice between pronouncable passwords, strings of characters or his own. "If you ever saw /bin/passwd on OSF1 you know what it is :)"
• Python
  • Rob Riggs of (tummy.com) has done the necessary work to make some PAM bindings for Python.
• NewsCache
  • Tuomo Pyhälä has written a patch to add PAM support to NewsCache.
• pam_unix (alternatives)
  • Thorsten Kukuk has a pam_unix2 available here. This one is VERY glibc specific.
  • Jan Rękorajski has rewritten the pam_unix module to do all that pam_pwdb can do: pam_unix-new
• sudo
  • Apparently, 'sudo' has PAM support.
• Squid
  • Henrik Nordström has added PAM support to squid.
• Perl
  • Nikolay Pelov has written a Perl module for accessing the PAM library.
• AFS (Andrew Filesystem):
  • Tobias Schäfer has written a module for doing authentication and password changing based on the AFS commands "klog", "unlog" and "kas".
  • Tobias has also written a logging module which you can find in the same place.
• pam_if
  • Pavel Kankovsky has an interesting module that can nest other modules conditionally. He's also offering an ftpd patch.
• pam_xauth
  • pam_xauth will be called by su (and other programs that do the same thing, presumably...) and will forward xauth keys between users in a configurable way, manageable (including disabling...) by the user running su and the user whose identity is being assumed. It will even remove keys on a closed session when appropriate (but not when inappropriate).
• ProFTPD
  This FTP server has PAM support built in ProFTPD.
• Pamrelay
  • Tom Rothamel has started work on Pamrelay which is a networked authentication-server model. For the source to his server and the complementary PAM module look here.
• People at Stanford including Tom Wu have created something called Secure Remote Password (SRP) and it has support for PAM -- both Linux and Solaris.
• Thorsten Kukuk has produced a pam_keylogin module for NIS+ support.
• Luigi Catuogno is working on a Transparent Cryptographic Filesystem PAM module.
• Tom Ryan's modules: http://camlaw.rutgers.edu/pam/
• Ingo Lütkebohle's page about getting Apache to use PAM.