d | l | b | c r w x | s
Γ
В
Perm
File
Directory
R
read
list
W
change
change content
X
execute
can ‘cd’
SUIDProgram runs with effective N/A
user ID of owner
SGIDProgram runs with effective Files created in dir inherit
Γ
В
#include <security/pam_appl.h> #include <security/pam_misc.h> int pam_start (..); int pam_end (..); const char *pam_strerror (..); pam_set_item();
Γ
В
第一部分是libpam,是实现PAM API的库， 第二部分是PAM配置文件，/etc/pam.conf, 第三部分有一套动态可装载两进位对象组成，常
常用来调用一些处理实际鉴别(authentication) 工作的服务模块。 最后模块是使用PAM API的系统命令组成，如 login,us,ftp,telnet etc
• 下载 mingetty_0.9.4.orig.tar.gz
GID of owner
the same GID as the dir
Stickybit N/A
Only the owner of the
file and the owner of the
dir may delete files in this dir
Γ
#ls -l #chmod
#chown #chgrp
As a stand-alone infrastructure, PAM first appeared from an open-source, Linux-PAM, development in Red Hat Linux 3.0.4 in August 1996.
PAM is currently supported in the AIX operating system, DragonFly BSD, FreeBSD, HP-UX, Linux, Mac OS X, NetBSD and Solaris.
为了解决这个问题，SUID/SGID便应运而生。UNIX允 许程序被授权，当程序被执行的时候，拥有超级用 户的权限，完成时又回到普通用户的权限。这个主 意很好，所以AT&T对它申请了专利。
SUID/SGID程序在执行时的Real Uid可以通过函数 setuid()of SUID programs:
linfb@ 2008, 10
用户与文件 从POST到sh
В
↓ ↓
Γ
В
认证、授权
PAM SUID Permission setuid etc
Authentication、Authorization
Pluggable Authentication Modules
Γ
В
• 开机口令 vs. CMOS口令
进入CMOS
• 典型按键：del, f1, f2, tab, esc,
BIOS/passwd/CMOS电池
Γ
В
single mode 在/?/lilo.conf中设定口令
… restricted password=a3xsf8d …
lilo口令的作用过程
init读取配置文└─件>ienxietctaveb(init_filename, argv_init, envp_init); /etc/inittab中的几行：
… # Run gettys in standard runlevels 1:2345:respawn:/sbin/mingetty tty1 2:2345:respawn:/sbin/mingetty tty2 3:2345:respawn:/sbin/mingetty tty3 …
password • sudo: Runs a particular command as another user • Various games (to track highscores)
All SUID programs should be known to the administrator and checked/updated for security problems
LXR可以自己安装也可以使用网上公用的LXR， 如http://lxr.linux.no/linux。
本地临时的LXR(2.6.21.5)
• http://211.87.235.73/lxr/ • outdate
Γ
В
Γ
В
Power Button Power On BIOS Self Test Passwd
Kernel做了重要的初始化，然后Kernel创建1 号内核线程init，其装载/sbin/init（配置文 件是/etc/inittab）。
Γ
В
Kernel然后启动用户进程init
start_kernel(); └─> rest_init();
└─> kernel_thread(init, NULL, CLONE_KERNEL); = init() └─> run_init_process("/sbin/init");
• passwd: Allows users to update the /etc/shadow file • mount: Allows users to mount a floppy or CD • su: Runs a shell as another user, after supplying the
PAM was later standardized as part of the X/Open UNIX standardization process, resulting in the X/Open Single Sign-on (XSSO) standard.
Γ
В
Every application required its own security and authentication mechanism.
无主文件 # find /dev -nouser -print # find /dev -nogroup -print
Γ
В
CMOS口令 LILO/GRUB口令 磁盘/分区加密
• 虚拟磁盘
文件权限访问控制 特权操作 事件审计
Γ
В
Γ
В
看源码的工具，首推LXR，其次也可以使用 source insight或则source-navigator。
Γ
В
user user id group group id #cat /etc/passwd | shadow #cat /etc/groups
Γ
В
[linden@localhost ~]$ ll total 0 -rw-rw-r-- 1 linden linden 0 2007-12-10 20:28 my.doc
认证/鉴别 Authentication
• 谁是谁
授权
Authorization
• 能干什么
鉴别手段
• 基于口令/令牌/卡/指纹/声音等信息
授权方法
• 访问控制矩阵 ACL/ACM
Γ
В
传统的AA
• 应用程序自己管理
PAM
• 标准库
PAM in Linux
Γ
В
PAM was first proposed by Sun Microsystems in an Open Software Foundation Request for Comments (RFC) 86.0 dated October 1995. It was adopted as the authentication framework of the Common Desktop Environment.
Once logged in, users cannot change their identity
• except through a SUID program, which allows them to run a command as someone else (most often root)
pam_get_item(); pam_authenticate(); pam_chauthtok(); …
Γ
В
Γ
В
Γ
В
Γ
В
Authorization in Linux based on file permissions
• Exception: root is allowed to do everything
umask
В
## Setting file permissions ## change file owner and group ## change group ownership
Γ
В
有时，没有被授权的用户需要完成某项任务。一个 例子是passwd程序，它允许用户改变口令，这就要 求改变/etc/passwd文件的口令域。然而系统管理员 决不允许普通用户拥有直接改变这个文件的权利， 因为这绝对不是一个好主意。
为了产生md5后的<PASSWD>
grub>md5crypt
Γ
В
Kernel image被lilo/grub（曾经linux有自己的 bootsect）读入到内存，解压缩，重定位， 跳转到
