Pluggable Authentication Module for Windows NT
Naomaru ItoiPeter HoneymanCITIUniversity of MichiganAnn Arbor
Problems with NT authentication
- Lack of integrated configuration method in heterogeneous environment
Outline of this presentation
PPT Slide
- States managed by WINLOGON
- Transitions invoke GINA for authorization
PPT Slide
- Graphical Identification and Authentication
- Responsible for user authentication
- Sample GINA source code provided by Microsoft
- Communicates with authentication systems
The Single Signon Problem
PPT Slide
Changes in authentication systems
- New network authentication protocols
PPT Slide
Single Sign-On with GINA
- Replace MS-GINA with customized GINA
- Kerberized GINA, Netware GINA, etc.
Problems with GINA
- Hard to configure
- Must rewrite and replace GINA to change security policy
- Misconfiguration or bug in GINA makes NT unbootable
- Only one GINA in a workstation
- Hard to develop
- Testing requires reboot
- Inconvenient to debug
PPT Slide
Pluggable Authentication Module
- UNIX authentication middleware
- Flexible, integrated configuration
- Implemented in Linux and Solaris-2
- de facto standard authentication middleware (OSF-DCE RFC 86.0)
PPT Slide
PPT Slide
PAM - Configurable by Service
PAM advantages
- System/security administrator
- Flexible configuration
- One configuration table for whole environment
- Promotes consistent security policy in heterogeneous computing environment
- Developer
- Debug components independently
PAM GINA
- PAM authentication functionality
- Separate DLLs for GINA, PAM, and authentication system specific modules
NI_PAM Structure
Implementation
- Minimum modification to GINA
- Allan Bjorklund GINA starting point
- Added about 10 lines of code
Current Status
- NI_KRB4, NI_KRB5
- Supports MIT MINK and SnapShot-2
- Limited support for smartcard
Security Considerations
- NI_PAM component is secure
- One password for all realms is a problem
- Smartcard should play a role
Performance
PAM GINA advantages
- Make system administrator’s life easier
- One flexible configuration table for all computers in an environment
- Make user’s life easier
- Single sign-on eliminates many concerns about authentication systems
- Make developer’s life easier
- Permits development and debugging without rebooting
Questions?
http://www.citi.umich.edu/
PAM Services Available
Is password correct? Can I get my tokens?
Am I allowed to use this service now?
Accounting, home directory access
PPT Slide
Future Direction
- Static account / profile support