83 lines
1.9 KiB
Markdown
83 lines
1.9 KiB
Markdown
# PAM C++ + Rust Backend Monorepo
|
|
|
|
This project provides a Linux PAM module written in C++ (GNU g++, C++17) that delegates authentication and logging to a Rust static library backend. The build is orchestrated by CMake, which triggers Cargo for the Rust backend.
|
|
|
|
## Structure
|
|
- `pam-module/`: C++ PAM module source
|
|
- `rust-backend/`: Rust static library backend
|
|
- `tests/`: Integration tests
|
|
|
|
## Build Requirements
|
|
- GNU g++ (C++17)
|
|
- CMake >= 3.15
|
|
- Rust (cargo)
|
|
- PAM development headers
|
|
|
|
## Build Instructions
|
|
```bash
|
|
mkdir build && cd build
|
|
cmake ..
|
|
cmake --build .
|
|
```
|
|
|
|
## Install
|
|
Copy the built PAM module to `/lib/security/` or `/lib64/security/` as needed.
|
|
|
|
## Logging
|
|
Rust backend logs to `/var/log/pam_rust_backend.log` by default.
|
|
|
|
## Safety
|
|
- Rust panics are contained and never cross FFI.
|
|
- C++ exceptions are caught before returning to PAM.
|
|
|
|
## Extending
|
|
Add new subprojects as needed for future business logic or integrations.
|
|
|
|
## Test Application (PAM Client)
|
|
|
|
This repository includes a test PAM client at `tests/pam_test_app.cpp`.
|
|
|
|
### Build the test
|
|
|
|
```bash
|
|
mkdir -p build && cd build
|
|
cmake ..
|
|
cmake --build .
|
|
```
|
|
|
|
The executable will be generated at `build/tests/pam_test_app`.
|
|
|
|
### Copy the PAM module
|
|
|
|
After building, copy the PAM module to the system PAM module path:
|
|
|
|
```bash
|
|
sudo cp build/pam-module/pam_module.so /lib/security/
|
|
```
|
|
|
|
On some distributions, use `/lib64/security/` instead.
|
|
|
|
### Configure `/etc/pam.d` service
|
|
|
|
Create `/etc/pam.d/pam_test_app` with:
|
|
|
|
```conf
|
|
auth required pam_module.so
|
|
account required pam_permit.so
|
|
```
|
|
|
|
You can also pass module arguments which are exposed as `argc` and `argv` to `pam_sm_authenticate`, for example:
|
|
|
|
```conf
|
|
auth required pam_module.so debug log_path=/var/log/pam_rust_backend.log
|
|
account required pam_permit.so
|
|
```
|
|
|
|
### Run the test client
|
|
|
|
```bash
|
|
./tests/pam_test_app pam_test_app <user> <password>
|
|
```
|
|
|
|
The first argument (`pam_test_app`) must match the service filename in `/etc/pam.d/pam_test_app`.
|