Read a PAM stack and predict its behaviour

short · 30 min · Objective 3.1

Before you start — what this lab needs

A disposable virtual machine. PAM misconfiguration can lock every account out of a system including root, so this must be a machine you can destroy and it must not be one you reach only over SSH:

cp -a /etc/pam.d /root/pam.d.backup    # take this before you start

Task

Read the PAM configuration that governs login on your system, predict what happens for three specific cases, and then make each case happen. PAM is usually learned by breaking it accidentally; this is the version where you break it on purpose, on a machine you can rebuild.

Steps

Read /etc/pam.d/system-auth (RHEL) or /etc/pam.d/common-auth (Debian). Identify the four module types and the control keywords used.
For each of the following, predict which module type decides the outcome: a wrong password, an expired account, a password that is too short when being changed, and creating the user's session directory at login.
Test the expired-account case: chage -E 1970-01-02 testuser and attempt a login. Confirm which stage refused it, using /var/log/secure or /var/log/auth.log.
Test password quality: set a minimum length with pam_pwquality and attempt to set a short password. Note the message and which module produced it.
Enable lockout with pam_faillock and fail three logins in a row. Confirm the lockout with faillock --user testuser, then clear it with faillock --user testuser --reset.
Set unlock_time and explain why omitting it turns a defence into a denial-of-service anyone can trigger.
Restore your backup and confirm login works.

Verify

grep -E '^(auth|account|password|session)' /etc/pam.d/system-auth | head
faillock --user testuser
chage -l testuser | grep -i 'account expires'
grep -Ei 'authentication failure|account expired' /var/log/secure | tail -5
diff -r /etc/pam.d /root/pam.d.backup && echo "configuration restored"

The final diff must be empty. A PAM lab that does not end with a verified restore is how a test machine becomes one nobody can log into.

Notes

The four types divide the work cleanly and the exam tests exactly that split: auth verifies the credential, account decides whether that verified user may proceed, password governs changing the credential, session sets up and tears down the environment. A user with the correct password refused at login is almost always an account-stage decision.