Pluggable authentication module (PAM) is a mechanism used on many UNIX variants to provide a unified way to authenticate users, independently of
the underlying authentication scheme.
Why is this an issue?
When authenticating users, if the validity of the account is not checked (not locked, not expired …), it may lead to unauthorized access to
resources.
How to fix it
Code examples
Noncompliant code example
int valid(pam_handle_t *pamh) {
if (pam_authenticate(pamh, PAM_DISALLOW_NULL_AUTHTOK) != PAM_SUCCESS) { // Noncompliant
return -1;
}
return 0;
}
Compliant solution
int valid(pam_handle_t *pamh) {
if (pam_authenticate(pamh, PAM_DISALLOW_NULL_AUTHTOK) != PAM_SUCCESS) {
return -1;
}
if (pam_acct_mgmt(pamh, 0) != PAM_SUCCESS) {
return -1;
}
return 0;
}
How does this work?
The account validity is checked with pam_acct_mgmt when authenticating a user with pam_authenticate.
Resources
Documentation
Articles & blog posts
Standards
