In this video, I will show you an example of how you can use PAM to make certain parts
happen.
For this example, I need to make sure that the user root has a password.
So I'm going to use passwd root and set the password.
Now I'm going to use chvt4, I'm going to virtual terminal number 4, and I'm logging in as the
root user.
There we go.
And as you can see, it works.
Right, chvt2, I'm going back to virtual terminal number 2.
And then I'm going to use the configuration file etcsecuretty.
What is that?
Well, this is listing TTYs on which it is secure for user root to log in.
So I am going to post TTY 3.
And the result should be that if I'm getting back to TTY 4, let's do that, and I'm using
exit and I'm trying to log in as a root user, the result should be of etcsecuretty that
I don't get access.
Too bad, I do have access.
And you know why?
That is because of the PAM secure TTY module.
So we need to figure out where these modules are.
So lib64 security, that is where you can find PAM modules.
And the module that I'm looking for is right here, pam-security-ty.so.
Let's check out the man page for man-security-ty.
And what I am looking for, I'm looking for this, module type provided, only the auth
module type is provided, aha.
So now I know enough, I need this in the auth module.
So I'm going to use etcpam.dlogin, because after all, we are talking about login.
And in there, I'm going to include auth required pam-secure-tty.so.
That's how simple it is.
From now on, pam-secure-tty.so will be included in the authentication procedure.
No need to read anything anymore.
It's just a matter of addressing the right login binary, which finds the PAM configuration
file and will dynamically load all of the required libraries.
So I'm getting back to TTY4.
And there, I'm going to try to log in as a root user again.
And as you can see, it works no longer.
Just to verify that I did not make a typo, no, I did not make a typo, user root can no
longer log in.
So I'm going in as user student.
That's still allowed.
And sudo minus I, that's still allowed as well.
Why is that?
Well, my modification was in the PAM for login, not in the PAM for sudo.
And now I can use chvt2 to get back to my virtual terminal.
It might be nice to use loginctl.
Loginctl is your login session manager.
And I want to see the different users, list users.
And there, I can see that's not very specific.
Well, let's go for list sessions.
And list sessions is showing my user on TTY4.
And you know what?
I don't want this user anymore.
So I'm going to use loginctl kill session 14.
And now my user is logged out without having to go back to the console.