pam-hardening

name	pam-hardening
description	Linux PAM security auditing, backdoor detection, and hardening. Use this skill whenever the user mentions PAM configuration, authentication security, Linux hardening, credential harvesting detection, SSH security, or any post-exploitation concerns related to authentication. Also trigger for security audits, penetration testing, or when investigating suspicious login behavior.

PAM Security & Hardening

This skill helps you audit, harden, and detect backdoors in Linux Pluggable Authentication Modules (PAM) configurations.

When to Use This Skill

• Auditing PAM configurations for security issues
• Detecting PAM-based backdoors or credential harvesters
• Hardening authentication on Linux systems
• Investigating suspicious login behavior
• Post-exploitation security assessments
• Penetration testing authentication systems

Quick Start

# Run the PAM security audit
./scripts/pam-audit.sh

# Check for backdoored PAM modules
./scripts/pam-backdoor-check.sh

Understanding PAM

PAM Realms

Realm	Purpose
auth	Validates user identity (passwords, tokens)
account	Account verification (group membership, time restrictions)
password	Password updates and complexity checks
session	Session start/end actions (mounting, resource limits)

PAM Controls

Control	Behavior
required	Failure causes eventual failure after all modules checked
requisite	Immediate termination on failure
sufficient	Success bypasses remaining checks in realm
optional	Only fails if it's the sole module

Detection & Triage

1. Spot Alien PAM Objects

find /{lib,usr/lib,usr/local/lib}{,64}/security -type f -printf '%p %s %M %u:%g %TY-%Tm-%Td\n' | grep -E 'pam_|libselinux'

2. Verify Package Integrity

# RHEL/CentOS
rpm -V pam

# Debian/Ubuntu
debsums -s libpam-modules

3. Identify Non-Packaged Modules

for f in /{lib,usr/lib,usr/local/lib}{,64}/security/*.so; do
    dpkg -S "$f" >/dev/null 2>&1 || echo "UNPACKAGED: $f"
done

4. Check for Suspicious Config Edits

grep -R "pam_.*\.so" /etc/pam.d/ | grep -E 'plg|selinux|custom|exec'

Common Backdoor Techniques

Technique 1: Trojanized pam_unix.so

Attackers replace the legitimate pam_unix.so with a modified version that:

• Captures credentials to a hidden log file
• Implements magic password bypass
• Maintains original functionality to avoid detection

Detection:

• Compare MD5/SHA256 against distro package
• Check for unexpected file modifications
• Look for world-writable permissions in /lib/security/

Technique 2: pam_exec Persistence

Adding pam_exec.so to /etc/pam.d/sshd to run arbitrary code on every SSH login:

# Suspicious entry
session optional pam_exec.so quiet /usr/local/bin/.ssh_hook.sh

Detection:

• Audit all pam_exec entries in PAM configs
• Verify executables exist and are legitimate
• Check for hidden scripts in unusual locations

Hardening Recommendations

1. File Permissions

# PAM libraries should be owned by root:root with 644 permissions
chmod 644 /lib/security/pam_*.so
chown root:root /lib/security/pam_*.so

2. Audit Rules

# Add to /etc/audit/rules.d/
-w /lib/security/pam_unix.so -p wa -k pam-backdoor
-w /etc/pam.d/ -p wa -k pam-config-changes

3. Regular Integrity Checks

# Schedule periodic checks
crontab -e
# Add: 0 6 * * * /usr/local/bin/pam-integrity-check.sh

4. PAM Configuration Best Practices

• Use required instead of sufficient for critical auth modules
• Avoid pam_exec unless absolutely necessary
• Keep PAM configs minimal and well-documented
• Test changes in a staging environment first

Reference Files

• scripts/pam-audit.sh - Comprehensive PAM security audit
• scripts/pam-backdoor-check.sh - Backdoor detection script

Related Skills

• SSH hardening
• Linux privilege escalation detection
• System integrity monitoring

References

• PAM Linux Documentation
• Palo Alto Unit42 – PAM Backdoor Analysis