如何创建一个pam模块？

Question

任何人都可以告诉我这个...我想创建一个类似于/etc/pam.d中的登录模块的pam模块

Answer 1

如果您在登录期间寻找基于pam的面部身份验证,则需要编写一个为您执行该操作的模块,并将其插入到/etc/pam.d/login的登录配置文件中.

在直接进入之前,我建议你编写一些简单的模块来理解流程,使用PAM和配置文件,比如开始使用sshd pam配置文件,并尝试插入一些示例pam模块.我发现这些文章非常有帮助:

http://aplawrence.com/Basics/understandingpam.html

https://www.packtpub.com/article/development-with-pluggable-authentication-modules-pam

仅供参考:Rohan Anil在开放使用的GSOC08期间开发了pam-face认证,该认证位于code.google.com/p/pam-face-authentication/

Answer 2

由于答案实在是太长了，无法写在这里，我可以链接您我的 PAM 教程： 编写 Linux PAM 模块和 Linux PAM 配置教程

在开始编写模块之前，我建议您先阅读配置教程，您可以在其中了解该模块的功能。

总而言之，模块是应用程序想要进行身份验证时由 PAM 加载的共享对象。每次应用程序触发一个“阶段”（身份验证、帐户、会话、密码）时，都会在模块中调用相应的函数。因此，您的模块应该提供以下功能：

PAM_EXTERN int pam_sm_authenticate(pam_handle_t *handle, int flags, int argc, const char **argv){
    /* In this function we will ask the username and the password with pam_get_user()
     * and pam_get_authtok(). We will then decide if the user is authenticated */
}

PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    /* In this function we check that the user is allowed in the system. We already know
     * that he's authenticated, but we could apply restrictions based on time of the day,
     * resources in the system etc. */
}

PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    /* We could have many more information of the user other then password and username.
     * These are the credentials. For example, a kerberos ticket. Here we establish those
     * and make them visible to the application */
}

PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    /* When the application wants to open a session, this function is called. Here we should
     * build the user environment (setting environment variables, mounting directories etc) */
}

PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    /* Here we destroy the environment we have created above */
}

PAM_EXTERN int pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv){
    /* This function is called to change the authentication token. Here we should,
     * for example, change the user password with the new password */
}

在此函数中，您将使用 PAM 函数从应用程序检索用户名和密码。这是通过必须在应用程序中定义的对话函数来实现的（请参阅本教程）。在每个函数的末尾，您必须返回一个确定结果的 PAM 返回代码（有关 PAM 错误代码，请参阅此内容和一般模块编写器文档）。