4.2.3. Authentication Services: PAM, SSSD, LDAP, and Kerberos
💡 First Principle: PAM (Pluggable Authentication Modules) is Linux's authentication abstraction layer. Instead of each application implementing its own password checking, all applications call PAM. PAM then uses a stack of modules to perform authentication, authorization, session setup, and password management. Changing authentication policy means changing PAM config — the applications don't need to change.
PAM Architecture:
Application (sshd, login, sudo)
↓ calls
PAM Library (libpam)
↓ reads
/etc/pam.d/sshd (service-specific config)
↓ calls modules in stack
pam_unix.so — local /etc/shadow authentication
pam_sss.so — SSSD (LDAP/AD integration)
pam_faillock.so — account lockout after failed attempts
pam_limits.so — enforce /etc/security/limits.conf
# PAM config directory
ls /etc/pam.d/ # One file per service
cat /etc/pam.d/sshd # SSH-specific PAM stack
# PAM module types (columns in PAM config)
# auth — authenticate the user
# account — check account validity (expiration, access)
# session — set up/tear down session (mount home, limits)
# password — change passwords
# PAM control flags
# required — must pass; failure noted but stack continues
# requisite — must pass; failure stops stack immediately
# sufficient — if passes, stop stack (if no earlier required failed)
# optional — result ignored unless only module in type
SSSD — System Security Services Daemon:
SSSD provides a local cache for remote identity/authentication sources (LDAP, Active Directory, Kerberos). It reduces network dependency — if the LDAP server is unreachable, SSSD serves cached credentials.
systemctl status sssd
cat /etc/sssd/sssd.conf # SSSD configuration
# Join a domain (RHEL/Fedora)
realm discover example.com # Discover available domains
realm join -U Administrator example.com # Join AD domain
realm list # Show joined domains
realm leave example.com # Leave domain
# Winbind (alternative AD integration for Samba)
# Also integrates Linux with Active Directory
Logging — journalctl, rsyslog, and auditd:
# journalctl — systemd journal
journalctl # All journal entries
journalctl -u nginx # Entries for nginx service
journalctl -f # Follow (like tail -f)
journalctl --since "1 hour ago" # Time-filtered
journalctl -p err # Priority: emerg,alert,crit,err,warning,notice,info,debug
journalctl -k # Kernel messages only (like dmesg)
journalctl --disk-usage # How much disk the journal uses
journalctl --vacuum-size=500M # Trim journal to 500 MB
# rsyslog — traditional syslog daemon
cat /etc/rsyslog.conf # Main config
ls /etc/rsyslog.d/ # Drop-in config files
# Key log files
/var/log/messages # General system messages (RHEL)
/var/log/syslog # General system messages (Debian)
/var/log/auth.log # Authentication events (Debian)
/var/log/secure # Authentication events (RHEL)
/var/log/audit/audit.log # Audit framework events
# logrotate — log file rotation
cat /etc/logrotate.conf # Global settings
ls /etc/logrotate.d/ # Per-service rotation configs
logrotate -f /etc/logrotate.conf # Force rotation now
# auditd — kernel audit framework
systemctl status auditd
cat /etc/audit/audit.rules # Audit rules
auditctl -l # List active audit rules
auditctl -w /etc/passwd -p wa -k passwd_changes # Watch file for write/attribute changes
ausearch -k passwd_changes # Search audit log by key
ausearch -m LOGIN --start today # Search for login events today
⚠️ Exam Trap: PAM and SSSD are separate systems that work together. SSSD provides the identity lookup (who is this user?); PAM uses SSSD as one of its authentication modules. Disabling SSSD doesn't disable PAM — local PAM authentication still works via pam_unix.so. The exam may test what happens when SSSD is stopped for domain-joined users.
Reflection Question: Users from Active Directory can log in when the LDAP server is available, but not when it's down — even for users who have logged in before. What SSSD feature is likely misconfigured, and what does it provide?
