DESCRIPTION

This program is part of the DACS suite.

The pamd server is required by the local_pam_authenticate authentication module. It acts as a proxy for local_pam_authenticate, calling PAM functions on its behalf. The pamd server may be started from inetd(8) or from the command line, but it must be running for DACS to perform PAM-based authentication.

Each pamd process is involved in an arbitrarily long "conversation" or "transaction" with one or more executions of local_pam_authenticate. For instance, pamd's initial response to local_pam_authenticate might be that it requires an account name; upon receiving the account name from local_pam_authenticate, pamd's response might be that it requires the password for the account; and upon receiving the password, pamd would indicate success or failure, depending on whether an acceptable username/password pair was received. The eventual outcome of a transaction is that authentication succeeds, fails, or could not be completed because an error occurs.

pamd must be run on the host where pam(3) processing is being performed, which is not necessarily the same host where local_pam_authenticate is executed.

The operating system's PAM policy file is consulted - see pam.conf(5). The default PAM service name is "dacs" (see pam_start(3)), which may be used by PAM to locate the appropriate policy file. A different policy name can be specified using the -policy flag.

The prompts that passed from PAM to pamd to local_pam_authenticate to dacs_authenticate (or dacsauth) are simply displayed to the user. The user must understand what the prompts mean (e.g., that "Login:" means to provide a Unix account name).

pamd can be used by non-DACS applications. The protocol, though simple, is not yet documented other than within the source code. A program called pamd-client is available for testing and debugging pamd; it is built when PAM support is required, but is neither installed nor documented (see the source code for basic instructions).

OPTIONS

In addition to the standard dacsoptions, pamd recognizes these command line flags:

EXAMPLE

For testing purposes, or to better understand how pamd works, you can run it manually and interact with it using telnet(1), for example, which takes the place of local_pam_authenticate. You must have PAM authentication configured on the host where you run pamd and you will probably need to run it as root. This is best done using two windows; start pamd in the first window and then telnet to it from the second window.

An interaction to perform username/password authentication will look something like the following (substitute your jurisdiction's name for myjur, your jurisdiction's domain name or IP address for myjur.example.com, and use a username and password pair that is recognized on your system). The first telnet connection receives a prompt for a username (labeled "Login:" and assigned the variable name AUTH_PROMPT_VAR1) from pamd, a transaction identifier (TRANSID) "10.0.0.124:56372:66664:53983facb39881b2" for this session, and port number to use for subsequent operations belonging to this transaction (62475). The second telnet connection provides the TRANSID and username (AUTH_PROMPT_VAR1="auggie"), and receives a prompt for a password ("Password:", assigned the variable name AUTH_PROMPT_VAR2). The third telnet connection provides the TRANSID and the password (AUTH_PROMPT_VAR2="doggy"), and receives the result of authentication ("Success").

# ./pamd -uj myjur -ll debug -daemon -unsecure -nofork
pamd[info]: Site config file is "/usr/local/dacs/federations/site.conf"
pamd[info]: Config file is "/usr/local/dacs/federations/dacs.conf"
pamd[info]: This is jurisdiction DSS::myjur
pamd[info]: Secure mode is off
pamd[debug]: Waiting for initial input block...
pamd[debug]: No username
pamd[debug]: Calling pam_authenticate
pamd[debug]: pamd_conv: reply to port 62475
pamd[debug]: TRANSID is "10.0.0.124:56372:66664:53983facb39881b2"
pamd[debug]:   type="text"
pamd[debug]:   label="Login:"
pamd[debug]:   varname="AUTH_PROMPT_VAR1"
pamd[debug]: pamd_conv: waiting 60 seconds for reply
pamd[debug]: pamd_conv: received connection
pamd[debug]: Reading reply...
pamd[debug]: pamd_conv: reply to port 62475
pamd[debug]: TRANSID is "10.0.0.124:62475:66695:fc855a7d68e8b1eb"
pamd[debug]:   type="password"
pamd[debug]:   label="Password:"
pamd[debug]:   varname="AUTH_PROMPT_VAR2"
pamd[debug]: pamd_conv: waiting 60 seconds for reply
pamd[debug]: pamd_conv: received connection
pamd[debug]: Reading reply...
pamd[debug]: Success
pamd[debug]: result="ok"
pamd[debug]: username="auggie"

% telnet myjur.example.com 17000
Trying 10.0.0.124...
Connected to bsd6.dss.bc.ca.
Escape character is '^]'.

Connection closed by foreign host.
% telnet myjur.example.com 62475
Trying 10.0.0.124...
Connected to bsd6.dss.bc.ca.
Escape character is '^]'.
TRANSID="10.0.0.124:62475:66695:fc855a7d68e8b1eb"
AUTH_PROMPT_VAR1="auggie"

Connection closed by foreign host.
% telnet myjur.example.com 62475
Trying 10.0.0.124...
Connected to bsd6.dss.bc.ca.
Escape character is '^]'.
TRANSID="10.0.0.124:62475:66695:fc855a7d68e8b1eb"
AUTH_PROMPT_VAR2="doggy"

result="ok"
username="auggie"
Connection closed by foreign host.

DIAGNOSTICS

The program exits 0 if everything was fine, 1 if an error occurred.

BUGS

The -daemon flag should cause the process to detach and put itself in the background unless overridden by another flag; at present it must be started in the background "manually".

The -http flag, which would allow a pamd session to be started with a web service request, is not implemented.

SEE ALSO

dacs_authenticate(8), dacsauth(1), pam(3), X/Open Single Sign-On Service (XSSO) preliminary specification

AUTHOR

Distributed Systems Software (www.dss.ca)

COPYING

Copyright © 2003-2024 Distributed Systems Software. See the LICENSE file that accompanies the distribution for licensing information.