Welcome to section six.
In this section you will learn about Lennox host-based security.
You explore how pluggable modules control the authentication flow on a Lennox
host. You will also learn how to create a simple host-based firewall.
We will discuss how you can audit a host for sessions and possible break-ins.
And finally, you'll learn how to harden your S SSH server.
In this video,
you'll learn about plugable authentication modules or what is better known as
pam.
Our plan is to explore PAM and how users are authenticated on Linux hosts.
We'll learn about PAM modules and the file formats they use. Finally,
you will modify Pam s s HD file and execute a command on login.
So Pam uses four different modules to control authentication.
The A module controls user authentication account module validates the user
account. The password module is used for managing passwords,
and the session module is used for managing user sessions.
Pam module is used to gate a success or failure.
The PAM control flags are used to govern what happens with those results.
From the module, there are five control flags. We'll go over here.
The required flag means the module must be successful to continue.
If there is an error,
it is saved all the way to the end till all the modules are run.
The requisite flag is just like required, but will halt the process.
If a failure occurs, the sufficient flag will ignore the result.
But if there are no other failures for a required,
then this is enough to authenticate the user.
The optional flag states that the result of the module is not important and can
be ignored. You should use this flag sparingly.
They include flag adds all the parameters that match a certain criterion and it
pens them as arguments to the module. Okay,
so this is kind of the format o of what a PAM configuration file looks
like. All the PAM files are stored under the Etsy PAM dot D directory.
So for every service that uses pam,
there is a file in this directory named after it.
Each file follow a specific format and is read from top down.
You can see here is on the far left we have the module interface.
This is what you had with off account session password.
You have control flag. This is the required,
the optional the module name,
and these are modules that are on disk that come with Lennox and come with Pam
for you to use. And then any arguments you need to pass to that module,
here's the example we're using here. We have off as the module interface,
the control flag is required and we're using the PAM underscore UNIX dot.
So module, don't worry right now, uh,
this will make way more sense once we look at the PAM file and the terminal.
All right, let's get started. Okay,
so we're gonna go review the S S H D PAM file,
and then we're gonna add a line to it that will basically execute a command
every time a session is set up and that we're logged in, uh, via s ssh. Okay?
So you're gonna need pseudo for this because we're changing a, uh,
file that needs elevated privileges.
So pseudo your editor of choice cam dot d ss
hd. Okay? And so as you can see here, um, just like we looked on,
on the slide that showed the file format, you have the left-hand side,
the module interface, the middle column is your control flag,
and then the far right column is the actual module name you're using.
And as you can tell, most of them the ones that come with, uh,
so those are shared objects that are on your Lennox host and the ones that
don't, they're usually followed because of an include,
which means they're grabbing another file, um,
inside the PAM d directory and pulling that stuff in as well. Um,
this is a way to like dry it up so you're not doing the same,
like you're not for password authentication,
you're not doing it in every single file.
You've already done it in the password off file.
So you could just include that and use that. So here,
if we start at the top, we go through, we can see on line two,
and let's go up to line two. You can see here we,
the first thing we do is the, we use the module interface and we are required,
and we can see that we use the, the PAM module right here.
You can see also, uh, there's a sub stack. We didn't cover that,
but if you wanted to learn more, you can use the man pages here.
And so if you wanted to, and I'll close this really quick,
if you wanted to look at the, uh,
what the PAM supplement dot o module is.
So I'll close out of my editor and then I'll use man PAM
supplement.
So let me clear the screen and we'll use the man do
supplement, and then we'll remove the do so and we'll use the MAN page.
And he tells you right here that this is the PAM module to allow deny login
depending on EE Lennox enforcement state. So I won't go into that now,
but I just want you to know if you see a PAM module that you don't know,
you can use the MAN page to Gobi. So, all right,
let's go back into the PAM dot DSS HD file
again. And as you can see, we go through all the module interfaces,
we go to oth, we go to account password here,
and then we go into all these session checks.
So what we're gonna do for our test here to show you how you can modify
your authentication flow,
we are going to open a new line rate after this online 18.
So this session include post login. Uh,
we're gonna go ahead and put our session command here,
and I'm just gonna paste that in to make it easier.
All right, the format's a little messed up. Let me fix that really quick.
All right, there we go.
Let me shift colon right to save the file.
So what we've done here in line 19 is in our session phase.
Remember this file's read top down.
So after we've passed all the other required, we've made it this far.
And so what we're gonna do here is, uh, we've, we've got the optional here.
And the reason why I put optional, even though I said use sparingly,
is because if anything happens with the script, it could fail.
If I put a required here or requisite,
it would fail your login and you be locked out of your e c two host.
So I just wanted to show you what's possible that you can do different things
with different PAM modules.
And so executing a script obviously is an easy way for us to test this.
So as you can see here, we're using the pam_exec.so module,
and basically it will execute a script or a command, if you will,
upon success. And so here, optional, remember,
it doesn't matter if this part is, uh, success or not,
it'll move on to line 21 once we're done.
So here we're gonna use the user local bin test dot underscore pandora h file.
I've included this in the section six inside the repo.
So let's go ahead and copy that over until, until you use a local bin.
So we can do that. All right, so I am gonna quit.
I've already written this file, so I'm just gonna quit out of it.
And then I'm gonna use pseudo here because we need to copy use a local business.
Uh, you need elevated privileges.
So what we'll do is we'll do the repo,
which is the hands-on lenux for DevOps cloud engineers.
We'll do section six and I'll do test pam.sh
and we'll copy that to user local bin.
Okay, so now what I'll do is I will,
I'll clear the screen here. Okay, so let's go look at this file now.
Okay, so as you can see here, um,
it's a basic bash script and you should remember this,
this should look somewhat familiar from our, our Bash series.
We're basically go ahead and we're just printing out.
So when Pam executes our PAM module,
it provides, um,
some unique and specific environment variables to our script that make
it, uh, that are available to us only upon, uh, execution.
And you can see here we have Pam underscore our host,
which is the real host that you're actually logging in from Pam, our user,
as if, if you're logging in, uh, you're assuming re identity,
this will give you the real user versus the current user.
This will be empty in our list because we're just using the e C two user.
PAM service is what service module Oh, where you're going to, um,
and we'll see what the output looks like.
Pam user here is the actual user that is authenticating with
Pam and then the PAM type. And as you can see, we are
pending to a file inside the temp slash temp directory.
And every time you log in or log out, you should have an entry in there. Okay,
so let me close the file, just do shift colon Q for Vim.
And what I'll do here is I'll pause the video, I'm gonna log out, log back in,
and then we'll go ahead and take a look at the log file.
So I've logged out and logged back in.
So we should have two entries in our log file, like I was stating.
So let's go ahead and open up the PAM underscore
test log. Now for some reason,
if you log back in and this direct file is not there,
make sure you check where that you put the line correctly in your S S H D file
and make sure that it's lined up and everything looks right and you didn't add
it's no typos because it's optional. It just will quietly fail,
but there is a debug on, so if you look in the logs, you should be able to find,
um, any errors. All right, so let's take a look at it. Okay,
so here you can see the echo line that we saw in the script.
As you see here on the R host. I've used the a fake one instead of, but if, uh,
one yours, it'll be your real IP address that you're SSHing in from the,
our user is,
is empty because we're not using any different type of user we're using.
And the only user we're using PAM service is the SS HD service,
which what we expect the TT Y is SSH because we're logging in B SS H.
Um, and you can see what's besides the PAM user,
which we know is our e C two user. You see the pan type, the close session.
So when I logged out, the close session was the PAM type.
And then when I logged back in, we have the open session, okay, let me, uh,
get out of this. And I used the command less to look in that.
You could have used the, the, the CAT command as well.
Less is like a paging app, uh, utility where it'll show, um,
up to one full screen's worth. Of course, there's only two lines,
so we didn't get that. Okay?
So you could see that using this type of approach for PAM and how you can handle
authentications, you could do some unique things. Like for example,
if you have users when they log in, they need to have a, uh,
drive mounted with sensitive information or something along those lines,
or you need them to set up your, their development environment,
like pulling in the latest and greatest of code or something like that. Um,
you could see how you could do simple things like that. Obviously,
I touched one, uh, PAM module. There's tons of them.
You should explore more by the man page as well.
And take a look what's inside the Etsy PAM dot D director. Okay,
let's go do a recap of what we did. Okay, so let's talk about what we did.
In this video, you learn about how Pam provides authentication on a Lennox host.
You also introduced a concepts like module types and control flags that create
an off flow in Pam. Finally,
you modified Pam S S H D to execute a test script.
Once a s SSH session was set up in the next video,
you will create a simple host-based firewall using IP table. See you soon.