| 1 |
On Wednesday 27 January 2010 02:34:56 walt wrote: |
| 2 |
> After thinking awhile I realized that pam can be used to |
| 3 |
> combine muliple forms of authentication to reduce the well |
| 4 |
> documented risk of single-factor authentication (like our |
| 5 |
> traditional password system). |
| 6 |
> |
| 7 |
> Example: if I have an ordinary password, plus an ssh key |
| 8 |
> stored on a USB stick, plus a biometric device like an |
| 9 |
> eye scanner or a fingerprint scanner, I can then use any |
| 10 |
> or all of those methods to identify myself to the system |
| 11 |
> by configuring pam in the appropriate way. |
| 12 |
> |
| 13 |
> Any sysadmins out there that can confirm my reasoning? |
| 14 |
> |
| 15 |
|
| 16 |
This is not merely a nice thing you can use pam to do. |
| 17 |
|
| 18 |
It is the entirely reason for pam's existence and it was |
| 19 |
written to do nothing else. |
| 20 |
|
| 21 |
If all you need auth to do is validate a username/password |
| 22 |
you might as well stick with login |
| 23 |
|
| 24 |
pam is Pluggable Authentication Modules, meaning you use |
| 25 |
the modules you want to create the scheme you want. |
| 26 |
|
| 27 |
-- |
| 28 |
alan dot mckinnon at gmail dot com |
Archives