PAM and NSS: the login chain
You learn which modules a user passes through at login and where account information comes from, and safely configure password policy, account lockout and two-step verification.
Level 301 · 15 lessons · 15 practice labs
Lessons
NSS
- nsswitch.conf: where user and group info comes from
- Querying with getent
- /etc/shadow and password hash formats
- Short task: solve a user who shows up in id but can't log in
PAM
- PAM architecture: auth, account, password and session
- Control flags: required, requisite and sufficient
- Reading a PAM stack: common-auth and system-auth
- Editing PAM without locking yourself out
- Short task: find which module rejects a login
Policies
- Password quality with pam_pwquality
- Account lockout with pam_faillock
- Who, from where and when with pam_access and pam_time
- A second factor with time-based one-time codes
- pam_limits and pam_mkhomedir
- Capstone: add a second factor and a lockout policy for admin logins without locking anyone out
Practice labs
- Find where user info comes from: Use getent and nsswitch.conf to find whether an account comes from local files or another source and submit it.
- Solve a user who shows in id but cannot log in: Find the problem in the shadow entry of an account that shows in id but is refused at login, and restore its login.
- Find accounts using weak password hashes: Decode the hash formats in /etc/shadow, list accounts on an old algorithm and force them to change password.
- Find the PAM module refusing a login: Find from the auth log which PAM module refuses the login and submit its name.
- Fix a wrong control flag: Fix a PAM stack that locks out the local admin because required was used instead of sufficient, and verify the login.
- Change PAM without locking yourself out: Keep a second root session open, add a new module to the SSH PAM stack, test logins and write the rollback plan to a file.
- Apply a password quality rule: Apply a minimum length and character class rule with pam_pwquality and confirm a weak password is rejected.
- Unlock an account and tune the lockout policy: Unlock an account locked after too many failed attempts with faillock and set the lockout time to policy.
- Restrict access by source and time: Use pam_access and pam_time so accounting accounts can only log in from the office network and during working hours.
- Set a per-user process limit: Define process and open-file limits with pam_limits for the service account behind a process storm and verify them.
- Set umask and environment at login with PAM: On a shared server make every session start with umask 027 and the corporate proxy variable through PAM session modules, and verify on a new login.
- Find the PAM module behind a slow login: Use debug logging to find the PAM line that makes SSH logins take thirty seconds, fix it and measure the login time.
- Create home directories at first login: Configure pam_mkhomedir so users without a home directory get one automatically at first login.
- Add a second factor to admin logins: Require a time-based one-time code for SSH logins of the admin group only, leaving other users unaffected.
- Rescue a server locked out by a second factor: On a server nobody can enter because of a misconfigured TOTP module, log in from the console, fix the stack and keep the emergency account working.
About this course
You learn which modules a user passes through at login and where account information comes from, and safely configure password policy, account lockout and two-step verification.
What you will learn
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.