4.2.3. Authentication Services: PAM, SSSD, LDAP, and Kerberos

💡 First Principle: PAM (Pluggable Authentication Modules) is Linux's authentication abstraction layer. Instead of each application implementing its own password checking, all applications call PAM. PAM then uses a stack of modules to perform authentication, authorization, session setup, and password management. Changing authentication policy means changing PAM config — the applications don't need to change.

PAM Architecture:

Application (sshd, login, sudo)
        ↓ calls
PAM Library (libpam)
        ↓ reads
/etc/pam.d/sshd (service-specific config)
        ↓ calls modules in stack
pam_unix.so     — local /etc/shadow authentication
pam_sss.so      — SSSD (LDAP/AD integration)
pam_faillock.so — account lockout after failed attempts
pam_limits.so   — enforce /etc/security/limits.conf

# PAM config directory
ls /etc/pam.d/                  # One file per service
cat /etc/pam.d/sshd             # SSH-specific PAM stack

# PAM module types (columns in PAM config)
# auth     — authenticate the user
# account  — check account validity (expiration, access)
# session  — set up/tear down session (mount home, limits)
# password — change passwords

# PAM control flags
# required  — must pass; failure noted but stack continues
# requisite — must pass; failure stops stack immediately
# sufficient — if passes, stop stack (if no earlier required failed)
# optional  — result ignored unless only module in type

SSSD — System Security Services Daemon:

SSSD provides a local cache for remote identity/authentication sources (LDAP, Active Directory, Kerberos). It reduces network dependency — if the LDAP server is unreachable, SSSD serves cached credentials.

systemctl status sssd
cat /etc/sssd/sssd.conf         # SSSD configuration

# Join a domain (RHEL/Fedora)
realm discover example.com      # Discover available domains
realm join -U Administrator example.com  # Join AD domain
realm list                      # Show joined domains
realm leave example.com         # Leave domain

# Winbind (alternative AD integration for Samba)
# Also integrates Linux with Active Directory

LDAP and Kerberos — identity vs. authentication:

• LDAP is a central directory of users and groups (UIDs, GIDs, memberships) that many hosts query instead of each keeping its own /etc/passwd.
• Kerberos is a ticket-based network authentication protocol: kinit user obtains a ticket-granting ticket (TGT) from the KDC, klist shows cached tickets, kdestroy discards them. Services trust the ticket, so the password never crosses the network.
• Kerberos answers who are you, not what may you access — access checks still need the user's UID and group memberships from a directory (LDAP/AD via SSSD) or local files. Active Directory bundles both: LDAP for identity, Kerberos for authentication.

Logging — journalctl, rsyslog, and auditd:

# journalctl — systemd journal
journalctl                       # All journal entries
journalctl -u nginx              # Entries for nginx service
journalctl -f                    # Follow (like tail -f)
journalctl --since "1 hour ago"  # Time-filtered
journalctl -p err                # Priority: emerg,alert,crit,err,warning,notice,info,debug
journalctl -k                    # Kernel messages only (like dmesg)
journalctl --disk-usage          # How much disk the journal uses
journalctl --vacuum-size=500M    # Trim journal to 500 MB

# rsyslog — traditional syslog daemon
cat /etc/rsyslog.conf            # Main config
ls /etc/rsyslog.d/               # Drop-in config files
# Key log files
/var/log/messages                # General system messages (RHEL)
/var/log/syslog                  # General system messages (Debian)
/var/log/auth.log                # Authentication events (Debian)
/var/log/secure                  # Authentication events (RHEL)
/var/log/audit/audit.log         # Audit framework events

# logrotate — log file rotation
cat /etc/logrotate.conf          # Global settings
ls /etc/logrotate.d/             # Per-service rotation configs
logrotate -f /etc/logrotate.conf # Force rotation now

# auditd — kernel audit framework
systemctl status auditd
cat /etc/audit/audit.rules       # Audit rules
auditctl -l                      # List active audit rules
auditctl -w /etc/passwd -p wa -k passwd_changes  # Watch file for write/attribute changes
ausearch -k passwd_changes       # Search audit log by key
ausearch -m LOGIN --start today  # Search for login events today

rsyslog rules take the form facility.priority action. * matches every facility, and a priority matches that level and everything more severe (mail.warning = warning, err, crit, alert, emerg). An action of @host:514 forwards over UDP; @@host:514 forwards over TCP.

journald storage is set by Storage= in /etc/systemd/journald.conf: volatile keeps the journal only in /run/log/journal (RAM — gone after reboot), persistent writes to /var/log/journal, and the default auto persists only if /var/log/journal exists. Size is capped in the same file with SystemMaxUse= (persistent journal) and RuntimeMaxUse= (volatile journal); journald rotates its own files and is not managed by logrotate.

logrotate handles classic text logs: it renames (rotates) a log on a schedule (daily/weekly/monthly) or at a size threshold, can compress old copies, and keeps rotate N of them — so retention ≈ N × the interval (weekly + rotate 4 ≈ one month). It only manages local files — shipping logs to a central server is rsyslog's job (above).

⚠️ Exam Trap: PAM and SSSD are separate systems that work together. SSSD provides the identity lookup (who is this user?); PAM uses SSSD as one of its authentication modules. Disabling SSSD doesn't disable PAM — local PAM authentication still works via pam_unix.so. The exam may test what happens when SSSD is stopped for domain-joined users.

Reflection Question: Users from Active Directory can log in when the LDAP server is available, but not when it's down — even for users who have logged in before. What SSSD feature is likely misconfigured, and what does it provide?