pam

package module
v0.0.0-...-5d43b02 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 12, 2024 License: BSD-2-Clause Imports: 13 Imported by: 0

README

GoDoc codecov Go Report Card

Go PAM

This is a Go wrapper for the PAM application API.

Package path changed for ease of use, and to avoid conflicts with the original

Originally created by Mike Steinert Updated and modified by Marco Trevisan

Module support

Go PAM can also used to create PAM modules in a simple way, using the go.

The code can be generated using pam-moduler and an example how to use it using go generate create them is available as an example module.

Modules and PAM applications

The modules generated with go can be used by any PAM application, however there are some caveats, in fact a Go shared library could misbehave when loaded improperly. In particular if a Go shared library is loaded and then the program forks, the library will have an undefined behavior.

This is the case of SSHd that loads a pam library before forking, making any go PAM library to make it hang.

To solve this case, we can use a little workaround: to ensure that the go library is loaded only after the program has forked, we can just dload it once a PAM library is called, in this way go code will be loaded only after that the PAM application has fork'ed.

To do this, we can use a very simple wrapper written in C:

#include <dlfcn.h>
#include <limits.h>
#include <security/pam_modules.h>
#include <security/pam_ext.h>

typedef int (*PamHandler)(pam_handle_t *,
                          int          flags,
                          int          argc,
                          const char **argv);

static void
on_go_module_removed (pam_handle_t *pamh,
                      void         *go_module,
                      int           error_status)
{
  dlclose (go_module);
}

static void *
load_module (pam_handle_t *pamh,
             const char   *module_path)
{
  void *go_module;

  if (pam_get_data (pamh, "go-module", (const void **) &go_module) == PAM_SUCCESS)
    return go_module;

  go_module = dlopen (module_path, RTLD_LAZY);
  if (!go_module)
    return NULL;

  pam_set_data (pamh, "go-module", go_module, on_go_module_removed);

  return go_module;
}

static inline int
call_pam_function (pam_handle_t *pamh,
                   const char   *function,
                   int           flags,
                   int           argc,
                   const char  **argv)
{
  char module_path[PATH_MAX] = {0};
  const char *sub_module;
  PamHandler func;
  void *go_module;

  if (argc < 1)
    {
      pam_error (pamh, "%s: no module provided", function);
      return PAM_MODULE_UNKNOWN;
    }

  sub_module = argv[0];
  argc -= 1;
  argv = (argc == 0) ? NULL : &argv[1];

  strncpy (module_path, sub_module, PATH_MAX - 1);

  go_module = load_module (pamh, module_path);
  if (!go_module)
    {
      pam_error (pamh, "Impossible to load module %s", module_path);
      return PAM_OPEN_ERR;
    }

  *(void **) (&func) = dlsym (go_module, function);
  if (!func)
    {
      pam_error (pamh, "Symbol %s not found in %s", function, module_path);
      return PAM_OPEN_ERR;
    }

  return func (pamh, flags, argc, argv);
}

#define DEFINE_PAM_WRAPPER(name) \
  PAM_EXTERN int \
    (pam_sm_ ## name) (pam_handle_t * pamh, int flags, int argc, const char **argv) \
  { \
    return call_pam_function (pamh, "pam_sm_" #name, flags, argc, argv); \
  }

DEFINE_PAM_WRAPPER (authenticate)
DEFINE_PAM_WRAPPER (chauthtok)
DEFINE_PAM_WRAPPER (close_session)
DEFINE_PAM_WRAPPER (open_session)
DEFINE_PAM_WRAPPER (setcred)

Testing

To run the full suite, the tests must be run as the root user. To setup your system for testing, create a user named "test" with the password "secret". For example:

$ sudo useradd test \
    -d /tmp/test \
    -p '$1$Qd8H95T5$RYSZQeoFbEB.gS19zS99A0' \
    -s /bin/false

Then execute the tests:

$ sudo GOPATH=$GOPATH $(which go) test -v

Other tests can instead run as user without any setup with normal go test ./...

Documentation

Overview

Package pam provides a wrapper for the PAM application API.

Package pam provides a wrapper for the PAM application API.

Package pam provides a wrapper for the PAM application API.

Example

This example uses the default PAM service to authenticate any users. This should cause PAM to ask its conversation handler for a username and password in sequence. 

t, err := pam.StartFunc("passwd", "", func(s pam.Style, msg string) (string, error) {
	switch s {
	case pam.PromptEchoOff:
		fmt.Print(msg)
		pw, err := term.ReadPassword(int(os.Stdin.Fd()))
		if err != nil {
			return "", err
		}
		fmt.Println()
		return string(pw), nil
	case pam.PromptEchoOn:
		fmt.Print(msg)
		s := bufio.NewScanner(os.Stdin)
		s.Scan()
		return s.Text(), nil
	case pam.ErrorMsg:
		fmt.Fprintf(os.Stderr, "%s\n", msg)
		return "", nil
	case pam.TextInfo:
		fmt.Println(msg)
		return "", nil
	default:
		return "", errors.New("unrecognized message style")
	}
})
if err != nil {
	fmt.Fprintf(os.Stderr, "start: %v\n", err)
	os.Exit(1)
}
defer func() {
	err := t.End()
	if err != nil {
		fmt.Fprintf(os.Stderr, "end: %v\n", err)
		os.Exit(1)
	}
}()
err = t.Authenticate(0)
if err != nil {
	fmt.Fprintf(os.Stderr, "authenticate: %v\n", err)
	os.Exit(1)
}
fmt.Println("authentication succeeded!")

Output:

Index

Examples

Constants

This section is empty.

Variables

This section is empty.

Functions

func CheckPamHasBinaryProtocol 

func CheckPamHasBinaryProtocol() bool

CheckPamHasBinaryProtocol return if pam on system supports PAM_BINARY_PROMPT

func CheckPamHasStartConfdir 

func CheckPamHasStartConfdir() bool

CheckPamHasStartConfdir return if pam on system supports pam_system_confdir

Types

type BinaryConvRequest 

type BinaryConvRequest struct {
	// contains filtered or unexported fields
}

BinaryConvRequest is a ConvRequest for performing binary conversations.

func NewBinaryConvRequest 

func NewBinaryConvRequest(ptr BinaryPointer, finalizer BinaryFinalizer) *BinaryConvRequest

NewBinaryConvRequest creates a new BinaryConvRequest

func NewBinaryConvRequestFromBytes 

func NewBinaryConvRequestFromBytes(bytes []byte) *BinaryConvRequest

NewBinaryConvRequestFromBytes creates a new BinaryConvRequest from an array of bytes.

func NewBinaryConvRequestFull 

func NewBinaryConvRequestFull(ptr BinaryPointer, finalizer BinaryFinalizer,
	responseFinalizer BinaryFinalizer) *BinaryConvRequest

NewBinaryConvRequestFull creates a new BinaryConvRequest with finalizer for response BinaryResponse.

func (*BinaryConvRequest) CreateResponse 

func (b *BinaryConvRequest) CreateResponse(ptr BinaryPointer) BinaryConvResponse

CreateResponse creates a new BinaryConvResponse from the request

func (*BinaryConvRequest) Pointer 

func (b *BinaryConvRequest) Pointer() BinaryPointer

Pointer returns the conversation style of the StringConvRequest.

func (*BinaryConvRequest) Release 

func (b *BinaryConvRequest) Release()

Release releases the resources allocated by the request

func (*BinaryConvRequest) Style 

func (b *BinaryConvRequest) Style() Style

Style returns the response style for the request, so always BinaryPrompt.

type BinaryConvRequester 

type BinaryConvRequester interface {
	ConvRequest
	Pointer() BinaryPointer
	CreateResponse(BinaryPointer) BinaryConvResponse
	Release()
}

BinaryConvRequester is the interface that binary ConvRequests should implement

type BinaryConvResponse 

type BinaryConvResponse interface {
	ConvResponse
	Data() BinaryPointer
	Decode(BinaryDecoder) ([]byte, error)
	Release()
}

BinaryConvResponse is a subtype of ConvResponse used for binary conversation responses.

type BinaryConversationFunc 

type BinaryConversationFunc func(BinaryPointer) ([]byte, error)

BinaryConversationFunc is an adapter to allow the use of ordinary functions as binary (only) conversation callbacks.

func (BinaryConversationFunc) RespondPAM 

func (f BinaryConversationFunc) RespondPAM(Style, string) (string, error)

RespondPAM is a dummy conversation callback adapter.

func (BinaryConversationFunc) RespondPAMBinary 

func (f BinaryConversationFunc) RespondPAMBinary(ptr BinaryPointer) ([]byte, error)

RespondPAMBinary is a conversation callback adapter.

type BinaryConversationHandler 

type BinaryConversationHandler interface {
	ConversationHandler
	// RespondPAMBinary receives a pointer to the binary message. It's up to
	// the receiver to parse it according to the protocol specifications.
	// The function can return a byte array that will passed as pointer back
	// to the module.
	RespondPAMBinary(BinaryPointer) ([]byte, error)
}

BinaryConversationHandler is an interface for objects that can be used as conversation callbacks during PAM authentication if binary protocol is going to be supported.

type BinaryDecoder 

type BinaryDecoder func(BinaryPointer) ([]byte, error)

BinaryDecoder is a function type for decode the a binary pointer data into bytes

type BinaryFinalizer 

type BinaryFinalizer func(BinaryPointer)

BinaryFinalizer is a type of function that can be used to release the binary when it's not required anymore

type BinaryPointer 

type BinaryPointer unsafe.Pointer

BinaryPointer exposes the type used for the data in a binary conversation it represents a pointer to data that is produced by the module and that must be parsed depending on the protocol in use

type BinaryPointerConversationFunc 

type BinaryPointerConversationFunc func(BinaryPointer) (BinaryPointer, error)

BinaryPointerConversationFunc is an adapter to allow the use of ordinary functions as binary pointer (only) conversation callbacks.

func (BinaryPointerConversationFunc) RespondPAM 

func (f BinaryPointerConversationFunc) RespondPAM(Style, string) (string, error)

RespondPAM is a dummy conversation callback adapter.

func (BinaryPointerConversationFunc) RespondPAMBinary 

func (f BinaryPointerConversationFunc) RespondPAMBinary(ptr BinaryPointer) (BinaryPointer, error)

RespondPAMBinary is a conversation callback adapter.

type BinaryPointerConversationHandler 

type BinaryPointerConversationHandler interface {
	ConversationHandler
	// RespondPAMBinary receives a pointer to the binary message. It's up to
	// the receiver to parse it according to the protocol specifications.
	// The function must return a pointer that is allocated via malloc or
	// similar, as it's expected to be free'd by the conversation handler.
	RespondPAMBinary(BinaryPointer) (BinaryPointer, error)
}

BinaryPointerConversationHandler is an interface for objects that can be used as conversation callbacks during PAM authentication if binary protocol is going to be supported.

type ConvRequest 

type ConvRequest interface {
	Style() Style
}

ConvRequest is an interface that all the Conversation requests should implement.

type ConvResponse 

type ConvResponse interface {
	Style() Style
}

ConvResponse is an interface that all the Conversation responses should implement.

type ConversationFunc 

type ConversationFunc func(Style, string) (string, error)

ConversationFunc is an adapter to allow the use of ordinary functions as conversation callbacks.

func (ConversationFunc) RespondPAM 

func (f ConversationFunc) RespondPAM(s Style, msg string) (string, error)

RespondPAM is a conversation callback adapter.

type ConversationHandler 

type ConversationHandler interface {
	// RespondPAM receives a message style and a message string. If the
	// message Style is PromptEchoOff or PromptEchoOn then the function
	// should return a response string.
	RespondPAM(Style, string) (string, error)
}

ConversationHandler is an interface for objects that can be used as conversation callbacks during PAM authentication.

type Error 

type Error int

Error is the Type for PAM Return types 

const (
	// OpenErr indicates a dlopen() failure when dynamically loading a
	// service module.
	ErrOpen Error = C.PAM_OPEN_ERR
	// ErrSymbol indicates a symbol not found.
	ErrSymbol Error = C.PAM_SYMBOL_ERR
	// ErrService indicates a error in service module.
	ErrService Error = C.PAM_SERVICE_ERR
	// ErrSystem indicates a system error.
	ErrSystem Error = C.PAM_SYSTEM_ERR
	// ErrBuf indicates a memory buffer error.
	ErrBuf Error = C.PAM_BUF_ERR
	// ErrPermDenied indicates a permission denied.
	ErrPermDenied Error = C.PAM_PERM_DENIED
	// ErrAuth indicates a authentication failure.
	ErrAuth Error = C.PAM_AUTH_ERR
	// ErrCredInsufficient indicates a can not access authentication data due to
	// insufficient credentials.
	ErrCredInsufficient Error = C.PAM_CRED_INSUFFICIENT
	// ErrAuthinfoUnavail indicates that the underlying authentication service
	// can not retrieve authentication information.
	ErrAuthinfoUnavail Error = C.PAM_AUTHINFO_UNAVAIL
	// ErrUserUnknown indicates a user not known to the underlying authentication
	// module.
	ErrUserUnknown Error = C.PAM_USER_UNKNOWN
	// ErrMaxtries indicates that an authentication service has maintained a retry
	// count which has been reached. No further retries should be attempted.
	ErrMaxtries Error = C.PAM_MAXTRIES
	// ErrNewAuthtokReqd indicates a new authentication token required. This is
	// normally returned if the machine security policies require that the
	// password should be changed because the password is nil or it has aged.
	ErrNewAuthtokReqd Error = C.PAM_NEW_AUTHTOK_REQD
	// ErrAcctExpired indicates that an user account has expired.
	ErrAcctExpired Error = C.PAM_ACCT_EXPIRED
	// ErrSession indicates a can not make/remove an entry for the
	// specified session.
	ErrSession Error = C.PAM_SESSION_ERR
	// ErrCredUnavail indicates that an underlying authentication service can not
	// retrieve user credentials.
	ErrCredUnavail Error = C.PAM_CRED_UNAVAIL
	// ErrCredExpired indicates that an user credentials expired.
	ErrCredExpired Error = C.PAM_CRED_EXPIRED
	// ErrCred indicates a failure setting user credentials.
	ErrCred Error = C.PAM_CRED_ERR
	// ErrNoModuleData indicates a no module specific data is present.
	ErrNoModuleData Error = C.PAM_NO_MODULE_DATA
	// ErrConv indicates a conversation error.
	ErrConv Error = C.PAM_CONV_ERR
	// ErrAuthtokErr indicates an authentication token manipulation error.
	ErrAuthtok Error = C.PAM_AUTHTOK_ERR
	// ErrAuthtokRecoveryErr indicates an authentication information cannot
	// be recovered.
	ErrAuthtokRecovery Error = C.PAM_AUTHTOK_RECOVERY_ERR
	// ErrAuthtokLockBusy indicates am authentication token lock busy.
	ErrAuthtokLockBusy Error = C.PAM_AUTHTOK_LOCK_BUSY
	// ErrAuthtokDisableAging indicates an authentication token aging disabled.
	ErrAuthtokDisableAging Error = C.PAM_AUTHTOK_DISABLE_AGING
	// ErrTryAgain indicates a preliminary check by password service.
	ErrTryAgain Error = C.PAM_TRY_AGAIN
	// ErrIgnore indicates to ignore underlying account module regardless of
	// whether the control flag is required, optional, or sufficient.
	ErrIgnore Error = C.PAM_IGNORE
	// ErrAbort indicates a critical error (module fail now request).
	ErrAbort Error = C.PAM_ABORT
	// ErrAuthtokExpired indicates an user's authentication token has expired.
	ErrAuthtokExpired Error = C.PAM_AUTHTOK_EXPIRED
	// ErrModuleUnknown indicates a module is not known.
	ErrModuleUnknown Error = C.PAM_MODULE_UNKNOWN
	// ErrBadItem indicates a bad item passed to pam_*_item().
	ErrBadItem Error = C.PAM_BAD_ITEM
	// ErrConvAgain indicates a conversation function is event driven and data
	// is not available yet.
	ErrConvAgain Error = C.PAM_CONV_AGAIN
	// ErrIncomplete indicates to please call this function again to complete
	// authentication stack. Before calling again, verify that conversation
	// is completed.
	ErrIncomplete Error = C.PAM_INCOMPLETE
)

Pam Return types

func (Error) Error 

func (status Error) Error() string

Error returns the error message for the given status.

type Flags 

type Flags int

Flags are inputs to various PAM functions than be combined with a bitwise or. Refer to the official PAM documentation for which flags are accepted by which functions. 

const (
	// Silent indicates that no messages should be emitted.
	Silent Flags = C.PAM_SILENT
	// DisallowNullAuthtok indicates that authorization should fail
	// if the user does not have a registered authentication token.
	DisallowNullAuthtok Flags = C.PAM_DISALLOW_NULL_AUTHTOK
	// EstablishCred indicates that credentials should be established
	// for the user.
	EstablishCred Flags = C.PAM_ESTABLISH_CRED
	// DeleteCred indicates that credentials should be deleted.
	DeleteCred Flags = C.PAM_DELETE_CRED
	// ReinitializeCred indicates that credentials should be fully
	// reinitialized.
	ReinitializeCred Flags = C.PAM_REINITIALIZE_CRED
	// RefreshCred indicates that the lifetime of existing credentials
	// should be extended.
	RefreshCred Flags = C.PAM_REFRESH_CRED
	// ChangeExpiredAuthtok indicates that the authentication token
	// should be changed if it has expired.
	ChangeExpiredAuthtok Flags = C.PAM_CHANGE_EXPIRED_AUTHTOK
)

PAM Flag types.

type Item 

type Item int

Item is a an PAM information type. 

const (
	// Service is the name which identifies the PAM stack.
	Service Item = C.PAM_SERVICE
	// User identifies the username identity used by a service.
	User Item = C.PAM_USER
	// Tty is the terminal name.
	Tty Item = C.PAM_TTY
	// Rhost is the requesting host name.
	Rhost Item = C.PAM_RHOST
	// Authtok is the currently active authentication token.
	Authtok Item = C.PAM_AUTHTOK
	// Oldauthtok is the old authentication token.
	Oldauthtok Item = C.PAM_OLDAUTHTOK
	// Ruser is the requesting user name.
	Ruser Item = C.PAM_RUSER
	// UserPrompt is the string use to prompt for a username.
	UserPrompt Item = C.PAM_USER_PROMPT
	// FailDelay is the app supplied function to override failure delays.
	FailDelay Item = C.PAM_FAIL_DELAY
	// Xdisplay is the X display name
	Xdisplay Item = C.PAM_XDISPLAY
	// Xauthdata is the X server authentication data.
	Xauthdata Item = C.PAM_XAUTHDATA
	// AuthtokType is the type for pam_get_authtok
	AuthtokType Item = C.PAM_AUTHTOK_TYPE
)

PAM Item types.

type ModuleHandler 

type ModuleHandler interface {
	AcctMgmt(ModuleTransaction, Flags, []string) error
	Authenticate(ModuleTransaction, Flags, []string) error
	ChangeAuthTok(ModuleTransaction, Flags, []string) error
	CloseSession(ModuleTransaction, Flags, []string) error
	OpenSession(ModuleTransaction, Flags, []string) error
	SetCred(ModuleTransaction, Flags, []string) error
}

ModuleHandler is an interface for objects that can be used to create PAM modules from go.

type ModuleHandlerFunc 

type ModuleHandlerFunc func(ModuleTransaction, Flags, []string) error

ModuleHandlerFunc is a function type used by the ModuleHandler.

type ModuleTransaction 

type ModuleTransaction interface {
	SetItem(Item, string) error
	GetItem(Item) (string, error)
	PutEnv(nameVal string) error
	GetEnv(name string) string
	GetEnvList() (map[string]string, error)
	GetUser(prompt string) (string, error)
	SetData(key string, data any) error
	GetData(key string) (any, error)
	StartStringConv(style Style, prompt string) (StringConvResponse, error)
	StartStringConvf(style Style, format string, args ...interface{}) (
		StringConvResponse, error)
	StartBinaryConv([]byte) (BinaryConvResponse, error)
	StartConv(ConvRequest) (ConvResponse, error)
	StartConvMulti([]ConvRequest) ([]ConvResponse, error)
}

ModuleTransaction is an interface that a pam module transaction should implement.

func NewModuleTransactionParallelConv 

func NewModuleTransactionParallelConv(handle NativeHandle) ModuleTransaction

NewModuleTransactionParallelConv allows initializing a transaction from the module side. Conversations using this transaction can be multi-thread, but this requires the application loading the module to support this, otherwise we may just break their assumptions.

type ModuleTransactionInvoker 

type ModuleTransactionInvoker interface {
	ModuleTransaction
	InvokeHandler(handler ModuleHandlerFunc, flags Flags, args []string) error
}

ModuleTransactionInvoker is an interface that a pam module transaction should implement to redirect requests from C handlers to go,

func NewModuleTransactionInvoker 

func NewModuleTransactionInvoker(handle NativeHandle) ModuleTransactionInvoker

NewModuleTransactionInvoker allows initializing a transaction invoker from the module side.

func NewModuleTransactionInvokerParallelConv 

func NewModuleTransactionInvokerParallelConv(handle NativeHandle) ModuleTransactionInvoker

NewModuleTransactionInvokerParallelConv allows initializing a transaction invoker from the module side. Conversations using this transaction can be multi-thread, but this requires the application loading the module to support this, otherwise we may just break their assumptions.

type NativeHandle 

type NativeHandle = *C.pam_handle_t

NativeHandle is the type of the native PAM handle for a transaction so that it can be exported

type StringConvRequest 

type StringConvRequest struct {
	// contains filtered or unexported fields
}

StringConvRequest is a ConvRequest for performing text-based conversations.

func NewStringConvRequest 

func NewStringConvRequest(style Style, prompt string) StringConvRequest

NewStringConvRequest creates a new StringConvRequest.

func (StringConvRequest) Prompt 

func (s StringConvRequest) Prompt() string

Prompt returns the conversation style of the StringConvRequest.

func (StringConvRequest) Style 

func (s StringConvRequest) Style() Style

Style returns the conversation style of the StringConvRequest.

type StringConvResponse 

type StringConvResponse interface {
	ConvResponse
	Response() string
}

StringConvResponse is an interface that string Conversation responses implements.

type Style 

type Style int

Style is the type of message that the conversation handler should display. 

const (
	// PromptEchoOff indicates the conversation handler should obtain a
	// string without echoing any text.
	PromptEchoOff Style = C.PAM_PROMPT_ECHO_OFF
	// PromptEchoOn indicates the conversation handler should obtain a
	// string while echoing text.
	PromptEchoOn Style = C.PAM_PROMPT_ECHO_ON
	// ErrorMsg indicates the conversation handler should display an
	// error message.
	ErrorMsg Style = C.PAM_ERROR_MSG
	// TextInfo indicates the conversation handler should display some
	// text.
	TextInfo Style = C.PAM_TEXT_INFO
	// BinaryPrompt indicates the conversation handler that should implement
	// the private binary protocol
	BinaryPrompt Style = C.PAM_BINARY_PROMPT
)

Coversation handler style types.

type Transaction 

type Transaction struct {
	// contains filtered or unexported fields
}

Transaction is the application's handle for a PAM transaction.

func Start 

func Start(service, user string, handler ConversationHandler) (*Transaction, error)

Start initiates a new PAM transaction. Service is treated identically to how pam_start treats it internally.

All application calls to PAM begin with Start*. The returned transaction provides an interface to the remainder of the API.

It's responsibility of the Transaction owner to release all the resources allocated underneath by PAM by calling End() once done.

It's not advised to End the transaction using a runtime.SetFinalizer unless you're absolutely sure that your stack is multi-thread friendly (normally it is not!) and using a LockOSThread/UnlockOSThread pair.

func StartConfDir 

func StartConfDir(service, user string, handler ConversationHandler, confDir string) (*Transaction, error)

StartConfDir initiates a new PAM transaction. Service is treated identically to how pam_start treats it internally. confdir allows to define where all pam services are defined. This is used to provide custom paths for tests.

All application calls to PAM begin with Start*. The returned transaction provides an interface to the remainder of the API.

It's responsibility of the Transaction owner to release all the resources allocated underneath by PAM by calling End() once done.

It's not advised to End the transaction using a runtime.SetFinalizer unless you're absolutely sure that your stack is multi-thread friendly (normally it is not!) and using a LockOSThread/UnlockOSThread pair.

func StartFunc 

func StartFunc(service, user string, handler func(Style, string) (string, error)) (*Transaction, error)

StartFunc registers the handler func as a conversation handler and starts the transaction (see Start() documentation).

func (*Transaction) AcctMgmt 

func (t *Transaction) AcctMgmt(f Flags) error

AcctMgmt is used to determine if the user's account is valid.

Valid flags: Silent, DisallowNullAuthtok

func (*Transaction) Authenticate 

func (t *Transaction) Authenticate(f Flags) error

Authenticate is used to authenticate the user.

Valid flags: Silent, DisallowNullAuthtok

func (*Transaction) ChangeAuthTok 

func (t *Transaction) ChangeAuthTok(f Flags) error

ChangeAuthTok is used to change the authentication token.

Valid flags: Silent, ChangeExpiredAuthtok

func (*Transaction) CloseSession 

func (t *Transaction) CloseSession(f Flags) error

CloseSession closes a previously opened session.

Valid flags: Silent

func (*Transaction) End 

func (t *Transaction) End() error

End cleans up the PAM handle and deletes the callback function. It must be called when done with the transaction.

func (*Transaction) GetEnv 

func (t *Transaction) GetEnv(name string) string

GetEnv is used to retrieve a PAM environment variable.

func (*Transaction) GetEnvList 

func (t *Transaction) GetEnvList() (map[string]string, error)

GetEnvList returns a copy of the PAM environment as a map.

func (*Transaction) GetItem 

func (t *Transaction) GetItem(i Item) (string, error)

GetItem retrieves a PAM information item.

func (*Transaction) OpenSession 

func (t *Transaction) OpenSession(f Flags) error

OpenSession sets up a user session for an authenticated user.

Valid flags: Slient

func (*Transaction) PutEnv 

func (t *Transaction) PutEnv(nameval string) error

PutEnv adds or changes the value of PAM environment variables.

NAME=value will set a variable to a value. NAME= will set a variable to an empty value. NAME (without an "=") will delete a variable.

func (*Transaction) SetCred 

func (t *Transaction) SetCred(f Flags) error

SetCred is used to establish, maintain and delete the credentials of a user.

Valid flags: EstablishCred, DeleteCred, ReinitializeCred, RefreshCred

func (*Transaction) SetItem 

func (t *Transaction) SetItem(i Item, item string) error

SetItem sets a PAM information item.

Source Files

View all Source files

Directories

Path Synopsis
cmd
pam-moduler
Package main provides the module shared library.
 Package main provides the module shared library.
pam-moduler/tests/debug-module
Package main is the package for the debug PAM module library
 Package main is the package for the debug PAM module library
pam-moduler/tests/integration-tester-module
Package main is the package for the integration tester module PAM shared library.
 Package main is the package for the integration tester module PAM shared library.
pam-moduler/tests/internal/utils
Package utils contains the internal test utils
 Package utils contains the internal test utils
Package main provides the module shared library.
 Package main provides the module shared library.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.