control-flag

    控制符用来指示当某一模块返回成功或失败时PAM如何动作. 既然模块可以被堆叠 (同种类型的模块按先后顺序执行,一个接一个), 控制符决定每个模块的重要程度.应用程序不会直接接收'/etc/pam.conf' 里列出的每一个模块的成功或失败的结果. 相应的是,它只从Linux-PAM接收一个 成功 或 失败 的结论. 这些模块的执行顺序就是它们在 /etc/pam.conf里的记录的顺序;排在前面的记录在排在后的记录之前被执行. 在Linux-PAM 0.60版本里, 这个control-flag 可以有两种语法来定义.

    简单一些(也是过去的)语法是用一个限定词指示相关模块的重要程度. 有四个关键字: required, requisite, sufficient 和 optional.

    Linux-PAM 将这四个关键字解释为:

        * required; 需要的,这表明此模块返回成功值对于整个module-type的成功是必要的. 此模块的返回失败并不会传回给用户直到剩下的模块(同样module-type)都执行过.
        * requisite; 必要的,类似 required, 只不过, 当这类模块返回失败时,整个控制会立刻回到应用程序. 返回值同第一个 需要的 或 必要的模块返回的失败. 注意,这标志可以用来防止 required or requisite module to fail. Note, this flag can be used to protect against the possibility of a user getting the opportunity to enter a password over an unsafe medium. It is conceivable that such behavior might inform an attacker of valid accounts on a system. This possibility should be weighed against the not insignificant concerns of exposing a sensitive password in a hostile environment.
        * sufficient; 充分的,这模块返回的成功会被认为已经 充分满足Linux-PAM 库确认这类模块(module-type)是成功的条件. 如果没有先前的requisite 模块返回了失败,那么不再会有其它'堆叠' 的模块被呼叫. (注意, 这种情况下,随后的requisite 模块就不会 被呼叫.). 这模块返回的失败不会看作是致命的错误而至影响应用程序从这module-type 得到成功的结果.
        * optional; 可选的,正如这名字一样,此
 
 

 

Linux-PAM(Linux下的密碼認證和安全机制)系統管理員指南(中文版)



我们是否打算支持模块的use_mapped_pass 呢? 有人认识佣金低廉(免费)的好律师吗?! argument? Anyone know a cheap (free) good lawyer?!

    * This issue may go away, as Sun have investigated adding a new management group for mappings. In this way, libpam would have mapping modules that could securely store passwords using strong cryptography and in such a way that they need not be distributed with Linux-PAM.

10. Author/acknowledgments

This document was written by Andrew G. Morgan (morgan@linux.kernel.org) with many contributions from Chris Adams, Peter Allgeyer, Tim Baverstock, Tim Berger, Craig S. Bell, Derrick J. Brashear, Ben Buxton, Seth Chaiklin, Oliver Crow, Chris Dent, Marc Ewing, Cristian Gafton, Emmanuel Galanos, Brad M. Garcia, Eric Hester, Roger Hu, Eric Jacksch, Michael K. Johnson, David Kinchlea, Olaf Kirch, Marcin Korzonek, Stephen Langasek, Nicolai Langfeldt, Elliot Lee, Luke Kenneth Casson Leighton, Al Longyear, Ingo Luetkebohle, Marek Michalkiewicz, Robert Milkowski, Aleph One, Martin Pool, Sean Reifschneider, Jan Rekorajski, Erik Troan, Theodore Ts'o, Jeff Uphoff, Myles Uyema, Savochkin Andrey Vladimirovich, Ronald Wahl, David Wood, John Wilmes, Joseph S. D. Yao and Alex O. Yuriev.

Thanks are also due to Sun Microsystems, especially to Vipin Samar and Charlie Lai for their advice. At an early stage in the development of Linux-PAM, Sun graciously made the documentation for their implementation of PAM available. This act greatly accelerated the development of Linux-PAM.
11. 翻译/联系方法这份档案由孙国清(thomassun@yeah.net)翻译,历时N个月,这是我首次翻译英文资料, 欢迎指正.本译文以GNU GPL版权发布. 请在引用时附属译者以及版权说明.
12. Bugs/omissions

More PAM modules are being developed all the time. It is unlikely that this document will ever be truely up to date!

This manual is unfinished. Only a partial list of people is credited for all the good work they have done.
13. Copyright information for this document

Copyright (c) Andrew G. Morgan 1996-9. All rights reserved.
Email: <morgan@linux.kernel.org>;

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

    * 1. Redistributions of source code must retain the above copyright notice, and the entire permission notice in its entirety, including the disclaimer of warranties.
    * 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
    * 3. The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission.

Alternatively, this product may be distributed under the terms of the GNU General Public License (GPL), in which case the provisions of the GNU GPL are required instead of the above restrictions. (This clause is necessary due to a potential bad interaction between the GNU GPL and the restrictions contained in a BSD-style copyright.)

THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

$Id: pam_source.sgml,v 1.9 1999/11/08 05:09:17 morgan Exp $

相关文章:

  • 2022-12-23
  • 2021-07-14
  • 2022-12-23
  • 2021-11-18
  • 2022-12-23
  • 2021-05-21
  • 2022-02-06
猜你喜欢
  • 2021-11-12
  • 2021-06-19
  • 2021-06-06
  • 2022-12-23
  • 2022-02-02
  • 2021-04-16
  • 2021-05-20
相关资源
相似解决方案