求pam中auth 和account password的区别

sccdyuebo

:help      最近在看pam的相关资料，对里面模块字段auth 和account password之间的区别不是很明白，想请教下各位达人。谢谢。
    现在我的理解是auth其实就是account和password的综合，但此种认识连我自己也没有通过，很是烦恼呀！！！:help

konds

起始蛮简单的。auth就是在pam.con 中的一个声明 具体实施就在pam模块对于account和password的存取了 虽然有用pam做虚拟用户的.但过程都相差不多,不管你用db 还是sql

sccdyuebo

谢谢konds。
但我还是不太明白。
比如：
[root@dell pam.d]# cat login
#%PAM-1.0
auth       required    pam_securetty.so
auth       required     pam_stack.so service=system-auth
auth       required     pam_nologin.so
account    required     pam_stack.so service=system-auth
password   required     pam_stack.so service=system-auth
session    required     pam_stack.so service=system-auth
session    optional     pam_console.so

auth在这里我认为是起很大作用的关系着远程用户是否能正常登录。如果只是一个声明，就应该把认证的重点放在account和password上呀？！

晨想

*  auth; this module type provides two aspects of authenticating the user. Firstly, it establishes that the user is who they claim to be, by instructing the application to prompt the user for a password or other means of identification. Secondly, the module can grant group membership (independently of the /etc/groups file discussed above) or other privileges through its credential granting properties.
    * account; this module performs non-authentication based account management. It is typically used to restrict/permit access to a service based on the time of day, currently available system resources (maximum number of users) or perhaps the location of the applicant user---`root' login only on the console.
    * session; primarily, this module is associated with doing things that need to be done for the user before/after they can be given service. Such things include the logging of information concerning the opening/closing of some data exchange with a user, mounting directories, etc. .
    * password; this last module type is required for updating the authentication token associated with the user. Typically, there is one module for each `challenge/response' based authentication (auth) module-type.

各自的分工不一样的，auth 是认证，比如密码等，account是管理，比如登录时间，登录平台等限制。

gogo_tutu

account :这个模块检查用户账户的各个方面，如口令时效，对某些特定时段或来自特定地点的访问控制。还可以用来限制基于系统资源访问。

password:通常包含一个auth模块。它负责更新用户身份认证标记，通常是一个口令。

sccdyuebo

谢谢各位大虾了！！！
我对这3个模块基本上了解了。再以后的使用中再慢慢深入理解吧。