Informatoin Related to Unix Password

PAM: Pluggable Authentication Modules.
- A Pluggable Authentication Module (PAM) is a well-defined framework for supporting different authentication modules originally developed by Sun Microsystems.
- PAM is supported on Solaris and Linux, in both 32- and 64-bit modes.
- The Name of the PAM Service
  The PAM service name identifies the PAM module. This PAM module typically resides in /usr/lib/security and its parameters are listed in the file /etc/pam.conf.
  
  In Linux, /etc/pam.conf can be replaced with a directory called /etc/pam.d, where there is a file for each PAM service. If /etc/pam.d exists, /etc/pam.conf will be ignored by Linux. See the system documentation for the details of this configuration file.
- http://publib.boulder.ibm.com/infocenter/idshelp/v10/index.jsp?topic=/com.ibm.admin.doc/admin218.htm
- The /var/log/secure on viva shows
  Jan 21 08:25:47 viva sshd[1452]: Invalid user staff from 202.67.216.120
  Jan 21 08:25:47 viva sshd[1453]: input_userauth_request: invalid user staff
  Jan 21 08:25:47 viva sshd[1452]: pam_unix(sshd:auth): check pass; user unknown
  Jan 21 08:25:47 viva sshd[1452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.67.216.120
  Jan 21 08:25:47 viva sshd[1452]: pam_succeed_if(sshd:auth): error retrieving information about user staff
  Jan 21 08:25:50 viva sshd[1452]: Failed password for invalid user staff from 202.67.216.120 port 43177 ssh2
  Jan 21 08:25:50 viva sshd[1453]: Received disconnect from 202.67.216.120: 11: Bye Bye
  Jan 21 08:25:55 viva sshd[1454]: Invalid user sales from 202.67.216.120
  Jan 21 08:25:55 viva sshd[1455]: input_userauth_request: invalid user sales
  Jan 21 08:25:55 viva sshd[1454]: pam_unix(sshd:auth): check pass; user unknown
  Jan 21 08:25:55 viva sshd[1454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.67.216.120
  Jan 21 08:25:55 viva sshd[1454]: pam_succeed_if(sshd:auth): error retrieving information about user sales
  Jan 21 08:25:57 viva sshd[1454]: Failed password for invalid user sales from 202.67.216.120 port 44509 ssh2
- It seems that 202.67.216.120 continues to guess what users are available on viva.uccs.edu
- /etc/pam.d/sshd
  #%PAM-1.0
  auth include system-auth
  account required pam_nologin.so
  account include system-auth
  password include system-auth
  session include system-auth
  session required pam_loginuid.so
- /etc/pam.d/system-auth
  # User changes will be destroyed the next time authconfig is run.
  auth required pam_env.so
  auth sufficient pam_unix.so nullok try_first_pass
  auth requisite pam_succeed_if.so uid >= 500 quiet
  auth required pam_deny.so
- account required pam_unix.so
  account sufficient pam_succeed_if.so uid < 500 quiet
  account required pam_permit.so
- password requisite pam_cracklib.so try_first_pass retry=3
  password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
  password required pam_deny.so
- session required pam_limits.so
  session required pam_unix.so
- pam_unix.c in
Linux-PAM
- http://www.kernel.org/pub/linux/libs/pam/
- Document: http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/
- Here is the related signature for the recent tar.bz2.
```
http://www.kernel.org/pub/linux/libs/pam/pre/library/Linux-PAM-0.99.7.0.tar.bz2.sign 
```
- -----BEGIN PGP SIGNATURE-----
  Version: GnuPG v1.4.6 (GNU/Linux)
  Comment: See http://www.kernel.org/signature.html for info
- iD8DBQBFrqNOyGugalF9Dw4RAu8XAJ4va0VeqHoD4bvB3mG8h+0Rpzk1aACfY0eR
  6+CQiju/QXqny24knVRj1cI=
  =miOa
  -----END PGP SIGNATURE-----
- pam_unix_passwd.c
  http://viva.uccs.edu/~cs591/password/Linux-PAM-0.99.7.0/modules/pam_unix/pam_unix_passwd.c
- md5_crypt.c shows how md5 based unix password are generated.
  http://viva.uccs.edu/~cs591/password/Linux-PAM-0.99.7.0/modules/pam_unix/md5_crypt.c
- The following entry shows in /etc/shadow
  ctf05:$1$GSoJmPZd$cfiZ05OzZ2Hr0zLbDKnVv1:13535:0:99999:7:::
- They are : delimited. The first field is the login. The 2nd field is the encrypted MD5 based password. It start with magic string "$1$" which indicates this is md5 base Unix password.
- GSoJmPZd (between $1$ and next $) is the salt. The rest is the result of generated by MD5 encryption on password.