5

I would like to see how the login screen actually verifies that the password is correct. Does it have access to passwd file directly or does it refer to the judgment of some system function?

9

Authentication is implemented using PAM, the Pluggable Authentication Modules.

Linux-PAM is a system of libraries that handle the authentication tasks of applications (services) on the system. The library provides a stable general interface (Application Programming Interface - API) that privilege granting programs (such as login(1) and su(1)) defer to to perform standard authentication tasks.

The configuration for the login service is in /etc/pam.d/login. It's well-commented, and very informative.

It is PAM's modules that access to the password file, when needed. In systems with centralized authentication (for example LDAP), the login service may never need to access the password file.

See more info in man 7 pam.

1
  • This certainly is the correct answer about where to find the source code. However it does not answer the question about whether the login screen has access to the passwd file. A library only has the privileges of the process which uses the library so part of the code running the login screen does have to run with root privileges. – kasperd Dec 25 '16 at 23:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.