常用PAM模块
文章目录
- 1 常用PAM模块
-
- 1.1 pam_shells模块
- 1.2 pam_securetty.so模块
- 1.3 pam_nologin.so 模块
- 1.4 pam_limits.so 模块
- 1.5 pam_succeed_if 模块
- 1.6 pam_google_authenticator模块
1 常用PAM模块
1.1 pam_shells模块
功能：检查有效shells
帮助：man pam_shells
案例：不允许使用/bin/csh的用户本地登录
[root@centos8 ~]#yum -y install csh
[root@centos8 ~]#vim /etc/pam.d/login
auth required pam_shells.so
[root@centos8 ~]#vim /etc/shells
去掉 /bin/csh
[root@centos8 ~]#useradd -s /bin/csh testuser
#testuser将不可登录
[root@centos8 ~]#tail /var/log/secure
1.2 pam_securetty.so模块
功能：只允许root用户在/etc/securetty列出的安全终端上登陆
案例：CentOS 7 允许root在telnet登陆
vi /etc/pam.d/remote
#将下面一行加上注释
#auth required pam_securetty.so
#或者/etc/securetty文件中加入
pts/0,pts/1…pts/n
#测试用root telnet登录
案例：在CentOS8上实现 pam_securetty.so模块禁止root远程登录telnet服务
#默认CentOS8 虽然有这模块,但没有使用此模块,所以允许root远程telnet登录
[root@centos7 ~]#telnet 10.0.0.8
Trying 10.0.0.8...
Connected to 10.0.0.8.
Escape character is '^]'.
Kernel 4.18.0-147.el8.x86_64 on an x86_64
centos8 login: root
Password:
Last login: Mon May 25 11:51:08 from 10.0.0.1
[root@centos8 ~]#
#修改配置不允许root远程telnet登录
[root@centos8 ~]#vim /etc/pam.d/remote
#%PAM-1.0
#添加此行
auth required pam_securetty.so
#创建空文件,CentOS8上默认不存在此文件
[root@centos8 ~]touch /etc/securetty
#测试
[root@centos7 ~]#telnet 10.0.0.8
Trying 10.0.0.8...
Connected to 10.0.0.8.
Escape character is '^]'.
Kernel 4.18.0-147.el8.x86_64 on an x86_64
centos8 login: wang
Password:
Last login: Mon May 25 12:06:21 from ::ffff:10.0.0.6
[wang@centos8 ~]$exit
logout
Connection closed by foreign host.
[root@centos7 ~]#telnet 10.0.0.8
Trying 10.0.0.8...
Connected to 10.0.0.8.
Escape character is '^]'.
Kernel 4.18.0-147.el8.x86_64 on an x86_64
centos8 login: root
Password:
Login incorrect
centos8 login:
1.3 pam_nologin.so 模块
功能：如果/etc/nologin文件存在,将导致非root用户不能登陆,当该用户登陆时，会显示/etc/nologin文件内容，并拒绝登陆
1.4 pam_limits.so 模块
功能：在用户级别实现对其可使用的资源的限制，例如：可打开的文件数量，可运行的进程数量，可用内存空间
修改限制的实现方式：
(1) ulimit命令，立即生效，但无法保存
-n 每个进程最多的打开的文件描述符个数
-u 最大用户进程数
-S 使用 soft（软）资源限制
-H 使用 hard（硬）资源限制
(2) 配置文件：
/etc/security/limits.conf
/etc/security/limits.d/*.conf
配置文件格式：
#每行一个定义
-
格式说明：
应用于哪些对象
Username 单个用户
@group 组内所有用户
* 所有用户
% 仅用于限制 maxlogins limit , 可以使用 %group 语法. 只用 % 相当于 * 对所有用户
maxsyslogins limit限制. %group 表示限制此组中的所有用户总的最大登录数
限制的类型
Soft 软限制,普通用户自己可以修改
Hard 硬限制,由root用户设定，且通过kernel强制生效
- 二者同时限定
限制的资源
nofile 所能够同时打开的最大文件数量,默认为1024
nproc 所能够同时运行的进程的最大数量,默认为1024
指定具体值
案例：系统的各种资源的默认值
[root@centos8 ~]#ulimit -a
core file size (blocks, -c) unlimited
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 3070
max locked memory (kbytes, -l) 16384
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 3070
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited
案例：ulimit 命令修改用户打开的文件个数
[root@centos8 ~]#ulimit -n
1024
[root@centos8 ~]#ulimit -n 1048577
-bash: ulimit: open files: cannot modify limit: Operation not permitted
[root@centos8 ~]#ulimit -n 1048576
[root@centos8 ~]#ulimit -a
core file size (blocks, -c) unlimited
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 3070
max locked memory (kbytes, -l) 16384
max memory size (kbytes, -m) unlimited
open files (-n) 1048576
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 3070
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited
案例：限制用户最多打开的文件数和运行进程数，并持久保存
cat /etc/pam.d/system-auth
session required pam_limits.so
vim /etc/security/limits.conf
#用户apache可打开10240个文件
apache - nofile 10240
#用户student不能运行超过20个进程
student hard nproc 10
#用student登录多次运行bash，观察结果
[root@centos8 ~]#vim /etc/security/limits.conf
wang - nofile 66666
wang - nproc 5
mage - nofile 88888
[root@centos8 ~]#su - wang
Last login: Mon May 25 14:40:38 CST 2020 on pts/0
[wang@centos8 ~]$ulimit -n
66666
案例：限制mage用户最大的同时登录次数
[root@centos8 ~]#tail -n1 /etc/security/limits.conf
mage - maxlogins 2
[root@centos8 ~]#who
mage tty1 2020-05-25 14:35
root pts/0 2020-05-25 14:35 (10.0.0.1)
root pts/3 2020-05-25 14:06 (10.0.0.1)
mage tty3 2020-05-25 14:35
生产案例
vim /etc/security/limits.conf
* - core unlimited
* - nproc 1000000
* - nofile 1000000
* - memlock 32000
* - msgqueue 8192000
1.5 pam_succeed_if 模块
功能：根据参数中的所有条件都满足才返回成功
案例：ubuntu默认不允许root登录桌面图形
用root登录桌面失败，查看日志，可看到Pam原因
vim /etc/pam.d/gdm-passwd
#将下面行注释
#auth requried pam_succeed_if.so user !=root quiet_success
1.6 pam_google_authenticator模块
功能：实现SSH登录的两次身份验证，先验证APP的数字码，再验证root用户的密码，都通过才可以登录。目前只支持口令验证，不支持基于key验证
官方网站：https://github.com/google/google-authenticator-android
范例：
- 在手机应用市场搜索：身份验证器或authenticator，并安装APP
- 运行脚本(需要联网EPEL源),本质是修改了/etc/pam.d/sshd文件，将google的PAM模块加入进去实现
[root@centos8 ~]#dnf info google-authenticator
Available Packages
Name : google-authenticator
Version : 1.07
Release : 1.el8
Arch : x86_64
Size : 57 k
Source : google-authenticator-1.07-1.el8.src.rpm
Repo : epel
Summary : One-time pass-code support using open standards
URL : https://github.com/google/google-authenticator-libpam/
License : ASL 2.0
Description : The Google Authenticator package contains a plug-able
: authentication module (PAM) which allows login using one-time
: pass-codes conforming to the open standards developed by the
: Initiative for Open Authentication (OATH) (which is unrelated to
: OAuth).
:
: Pass-code generators are available (separately) for several
: mobile platforms.
:
: These implementations support the HMAC-Based One-time Password
: (HOTP) algorithm specified in RFC 4226 and the Time-based
: One-time Password (TOTP) algorithm currently in draft.
[root@centos8 ~]#
[root@centos8 ~]#vim google-authenticator.sh
#!/bin/bash
#安装epel
yum install -y epel-release.noarch
yum makecache
#安装google authenticator
yum install -y google-authenticator.x86_64
echo -e "\033[31mDo you want me to update your "/root/.google_authenticator"
file? (y/n) y"
echo -e "\033[31m你希望我更新你的“/root/.google_authenticator”文件吗(y/n)？\033[0m"
echo -e "\033[31mDo you want to disallow multiple uses of the same
authentication"
echo -e "\033[31mtoken? This restricts you to one login about every 30s, but it
increases"
echo -e "\033[31myour chances to notice or even prevent man-in-the-middle
attacks (y/n) y"
echo -e "\033[31m你希望禁止多次使用同一个验证令牌吗?这限制你每次登录的时间大约是30秒， 但是
这加大了发现或甚至防止中间人攻击的可能性(y/n)?\033[0m"
echo -e "\033[31mBy default, a new token is generated every 30 seconds by the
mobile app."
echo -e "\033[31mIn order to compensate for possible time-skew between the
client and the server,"
echo -e "\033[31mwe allow an extra token before and after the current time. This
allows for a"
echo -e "\033[31mtime skew of up to 30 seconds between authentication server and
client. If you"
echo -e "\033[31mexperience problems with poor time synchronization, you can
increase the window"
echo -e "\033[31mfrom its default size of 3 permitted codes (one previous code,
the current"
echo -e "\033[31mcode, the next code) to 17 permitted codes (the 8 previous
codes, the current"
echo -e "\033[31mcode, and the 8 next codes). This will permit for a time skew
of up to 4 minutes"
echo -e "\033[31mbetween client and server."
echo -e "\033[31mDo you want to do so? (y/n) y"
echo -e "\033[31m默认情况下，令牌保持30秒有效;为了补偿客户机与服务器之间可能存在的时滞，
\033[0m"
echo -e "\033[31m我们允许在当前时间前后有一个额外令牌。如果你在时间同步方面遇到了问题， 可以
增加窗口从默认的3个可通过验证码增加到17个可通过验证码，\033[0m"
echo -e "\033[31m这将允许客户机与服务器之间的时差增加到4分钟。你希望这么做吗(y/n)?\033[0m"
echo -e "\033[31mIf the computer that you are logging into isn't hardened
against brute-force"
echo -e "\033[31mlogin attempts, you can enable rate-limiting for the
authentication module."
echo -e "\033[31mBy default, this limits attackers to no more than 3 login
attempts every 30s."
echo -e "\033[31mDo you want to enable rate-limiting? (y/n) y"
echo -e "\033[31m如果你登录的那台计算机没有经过固化，以防范运用蛮力的登录企图，可以对验证模块
\033[0m"
echo -e "\033[31m启用尝试次数限制。默认情况下，这限制攻击者每30秒试图登录的次数只有3次。 你
希望启用尝试次数限制吗(y/n)?\033[0m"
echo -e "\033[32m 在App Store 搜索Google Authenticator 进行App安装 \033[0m"
google-authenticator
#/etc/pam.d/sshd文件，修改或添加下行保存
#auth required pam_google_authenticator.so
sed -i '1a\auth required pam_google_authenticator.so' /etc/pam.d/sshd
#编辑/etc/ssh/sshd_config找到下行
#ChallengeResponseAuthentication no
#更改为
#ChallengeResponseAuthentication yes
sed -i 's/.*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication
yes/' /etc/ssh/sshd_config
#重启SSH服务
service sshd restart
[root@centos8 ~]#bash google-authenticator.sh
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/[email protected]%3Fsecret%3D4RYMJNECIKYHOIPIDAYEUIIVRA%26issuer%3Dcentos8.kobe.com
Failed to use libqrencode to show QR code visually for scanning.
Consider typing the OTP secret into your app manually.
Your new secret key is: 4RYMJNECIKYHOIPIDAYEUIIVRA
Enter code from app (-1 to skip):
- 访问生成的url(需要科学上网):
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/[email protected]%3Fsecret%3D4RYMJNECIKYHOIPIDAYEUIIVRA%26issuer%3Dcentos8.kobe.com
4. 打开用身份验证器APP，扫网页上的二维码，进行绑定手机
5. 继续上面的安装配置向导，输入手机APP上的数字，后续都回答 y 即可
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/[email protected]%3Fsecret%3DXO3PGTCSI5KDNEJWA25BY3EC2E%26issuer%3Dcentos8.kobe.com
Failed to use libqrencode to show QR code visually for scanning.
Consider typing the OTP secret into your app manually.
Your new secret key is: XO3PGTCSI5KDNEJWA25BY3EC2E
Enter code from app (-1 to skip): 997367
Code confirmed
Your emergency scratch codes are:
88380863
30550915
24435382
58554644
32633216
Do you want me to update your "/root/.google_authenticator" file? (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y
Redirecting to /bin/systemctl restart sshd.service
[root@centos8 ~]#
- ssh 当前主机，可看到提示，输入手机APP上显示的数字码和root密码，可以登录，否则失败
[root@centos7 ~]#ssh 10.0.0.8
Verification code:
Password:
Last failed login: Fri Feb 7 12:11:12 CST 2020 from 10.0.0.7 on ssh:notty
There were 6 failed login attempts since the last successful login.
Last login: Fri Feb 7 12:09:47 2020 from 10.0.0.7
[root@centos8 ~]#
- 临时口令存放在/root/.google_authenticator中，用一次删除一个，可手动加入使用
[root@centos8 ~]#cat .google_authenticator
AQQCI45VQIHLUG4DUVGW226ZE4
" RATE_LIMIT 3 30 1599569304 1599569315 1599569315
" WINDOW_SIZE 17
" DISALLOW_REUSE 53318973 53318976
" TOTP_AUTH
11270993
98379027
30953264
35616330
87012041