Documentation ¶
Overview ¶
Package pam provides a wrapper for the PAM application API.
Example (Authenticate) ¶
This example uses whatever default PAM service configuration is available on the system, and tries to authenticate any user. This should cause PAM to ask its conversation handler for a username and password, in sequence.
This application will handle those requests by displaying the PAM-provided prompt and sending back the first line of stdin input it can read for each.
Keep in mind that unless run as root (or setuid root), the only user's authentication that can succeed is that of the process owner.
package main import ( "bufio" "errors" "fmt" "log" "os" "github.com/SpaceRouter/pam" "github.com/bgentry/speakeasy" ) func main() { t, err := pam.StartFunc("", "", func(s pam.Style, msg string) (string, error) { switch s { case pam.PromptEchoOff: return speakeasy.Ask(msg) case pam.PromptEchoOn: fmt.Print(msg + " ") input, err := bufio.NewReader(os.Stdin).ReadString('\n') if err != nil { return "", err } return input[:len(input)-1], nil case pam.ErrorMsg: log.Print(msg) return "", nil case pam.TextInfo: fmt.Println(msg) return "", nil } return "", errors.New("Unrecognized message style") }) if err != nil { log.Fatalf("Start: %s", err.Error()) } err = t.Authenticate(0) if err != nil { log.Fatalf("Authenticate: %s", err.Error()) } fmt.Println("Authentication succeeded!") }
Output:
Index ¶
- Constants
- type ConversationFunc
- type ConversationHandler
- type Flags
- type Item
- type Style
- type Transaction
- func (t *Transaction) AcctMgmt(f Flags) error
- func (t *Transaction) Authenticate(f Flags) error
- func (t *Transaction) ChangeAuthTok(f Flags) error
- func (t *Transaction) CloseSession(f Flags) error
- func (t *Transaction) Error() string
- func (t *Transaction) GetEnv(name string) string
- func (t *Transaction) GetEnvList() (map[string]string, error)
- func (t *Transaction) GetItem(i Item) (string, error)
- func (t *Transaction) OpenSession(f Flags) error
- func (t *Transaction) PutEnv(nameval string) error
- func (t *Transaction) SetCred(f Flags) error
- func (t *Transaction) SetItem(i Item, item string) error
Examples ¶
Constants ¶
const ( // PromptEchoOff indicates the conversation handler should obtain a // string without echoing any text. PromptEchoOff Style = C.PAM_PROMPT_ECHO_OFF // PromptEchoOn indicates the conversation handler should obtain a // string while echoing text. PromptEchoOn = C.PAM_PROMPT_ECHO_ON // ErrorMsg indicates the conversation handler should display an // error message. ErrorMsg = C.PAM_ERROR_MSG // TextInfo indicates the conversation handler should display some // text. TextInfo = C.PAM_TEXT_INFO )
Coversation handler style types.
const ( // Service is the name which identifies the PAM stack. Service Item = C.PAM_SERVICE // User identifies the username identity used by a service. User = C.PAM_USER // Tty is the terminal name. Tty = C.PAM_TTY // Rhost is the requesting host name. Rhost = C.PAM_RHOST // Authtok is the currently active authentication token. Authtok = C.PAM_AUTHTOK // Oldauthtok is the old authentication token. Oldauthtok = C.PAM_OLDAUTHTOK // Ruser is the requesting user name. Ruser = C.PAM_RUSER // UserPrompt is the string use to prompt for a username. UserPrompt = C.PAM_USER_PROMPT )
PAM Item types.
const ( // Silent indicates that no messages should be emitted. Silent Flags = C.PAM_SILENT // DisallowNullAuthtok indicates that authorization should fail // if the user does not have a registered authentication token. DisallowNullAuthtok = C.PAM_DISALLOW_NULL_AUTHTOK // EstablishCred indicates that credentials should be established // for the user. EstablishCred = C.PAM_ESTABLISH_CRED // DeleteCred inidicates that credentials should be deleted. DeleteCred = C.PAM_DELETE_CRED // ReinitializeCred indicates that credentials should be fully // reinitialized. ReinitializeCred = C.PAM_REINITIALIZE_CRED // RefreshCred indicates that the lifetime of existing credentials // should be extended. RefreshCred = C.PAM_REFRESH_CRED // ChangeExpiredAuthtok indicates that the authentication token // should be changed if it has expired. ChangeExpiredAuthtok = C.PAM_CHANGE_EXPIRED_AUTHTOK )
PAM Flag types.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ConversationFunc ¶
ConversationFunc is an adapter to allow the use of ordinary functions as conversation callbacks.
func (ConversationFunc) RespondPAM ¶
func (f ConversationFunc) RespondPAM(s Style, msg string) (string, error)
RespondPAM is a conversation callback adapter.
type ConversationHandler ¶
type ConversationHandler interface { // RespondPAM receives a message style and a message string. If the // message Style is PromptEchoOff or PromptEchoOn then the function // should return a response string. RespondPAM(Style, string) (string, error) }
ConversationHandler is an interface for objects that can be used as conversation callbacks during PAM authentication.
type Flags ¶
type Flags int
Flags are inputs to various PAM functions than be combined with a bitwise or. Refer to the official PAM documentation for which flags are accepted by which functions.
type Style ¶
type Style int
Style is the type of message that the conversation handler should display.
type Transaction ¶
type Transaction struct {
// contains filtered or unexported fields
}
Transaction is the application's handle for a PAM transaction.
func Start ¶
func Start(service, user string, handler ConversationHandler) (*Transaction, error)
Start initiates a new PAM transaction. Service is treated identically to how pam_start treats it internally.
All application calls to PAM begin with Start (or StartFunc). The returned transaction provides an interface to the remainder of the API.
func StartFunc ¶
func StartFunc(service, user string, handler func(Style, string) (string, error)) (*Transaction, error)
StartFunc registers the handler func as a conversation handler.
func (*Transaction) AcctMgmt ¶
func (t *Transaction) AcctMgmt(f Flags) error
AcctMgmt is used to determine if the user's account is valid.
Valid flags: Silent, DisallowNullAuthtok
func (*Transaction) Authenticate ¶
func (t *Transaction) Authenticate(f Flags) error
Authenticate is used to authenticate the user.
Valid flags: Silent, DisallowNullAuthtok
func (*Transaction) ChangeAuthTok ¶
func (t *Transaction) ChangeAuthTok(f Flags) error
ChangeAuthTok is used to change the authentication token.
Valid flags: Silent, ChangeExpiredAuthtok
func (*Transaction) CloseSession ¶
func (t *Transaction) CloseSession(f Flags) error
CloseSession closes a previously opened session.
Valid flags: Silent
func (*Transaction) Error ¶
func (t *Transaction) Error() string
func (*Transaction) GetEnv ¶
func (t *Transaction) GetEnv(name string) string
GetEnv is used to retrieve a PAM environment variable.
func (*Transaction) GetEnvList ¶
func (t *Transaction) GetEnvList() (map[string]string, error)
GetEnvList returns a copy of the PAM environment as a map.
func (*Transaction) GetItem ¶
func (t *Transaction) GetItem(i Item) (string, error)
GetItem retrieves a PAM information item.
func (*Transaction) OpenSession ¶
func (t *Transaction) OpenSession(f Flags) error
OpenSession sets up a user session for an authenticated user.
Valid flags: Slient
func (*Transaction) PutEnv ¶
func (t *Transaction) PutEnv(nameval string) error
PutEnv adds or changes the value of PAM environment variables.
NAME=value will set a variable to a value. NAME= will set a variable to an empty value. NAME (without an "=") will delete a variable.
func (*Transaction) SetCred ¶
func (t *Transaction) SetCred(f Flags) error
SetCred is used to establish, maintain and delete the credentials of a user.
Valid flags: EstablishCred, DeleteCred, ReinitializeCred, RefreshCred