{"id":23498602,"url":"https://github.com/eehakkin/pam-ssh-auth-info","last_synced_at":"2025-08-01T19:31:48.508Z","repository":{"id":45564447,"uuid":"327654324","full_name":"eehakkin/pam-ssh-auth-info","owner":"eehakkin","description":"PAM authentication based on SSH authentication information","archived":false,"fork":false,"pushed_at":"2023-09-07T15:22:43.000Z","size":150,"stargazers_count":10,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-15T16:42:23.152Z","etag":null,"topics":["pam-module","ssh","ssh-server"],"latest_commit_sha":null,"homepage":"https://eehakkin.github.io/pam-ssh-auth-info/","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"lgpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/eehakkin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-01-07T15:40:38.000Z","updated_at":"2025-04-11T04:31:16.000Z","dependencies_parsed_at":"2025-04-15T16:34:28.667Z","dependency_job_id":"0cb6abd6-6060-4518-8a85-e8167b371532","html_url":"https://github.com/eehakkin/pam-ssh-auth-info","commit_stats":null,"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"purl":"pkg:github/eehakkin/pam-ssh-auth-info","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eehakkin%2Fpam-ssh-auth-info","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eehakkin%2Fpam-ssh-auth-info/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eehakkin%2Fpam-ssh-auth-info/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eehakkin%2Fpam-ssh-auth-info/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/eehakkin","download_url":"https://codeload.github.com/eehakkin/pam-ssh-auth-info/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eehakkin%2Fpam-ssh-auth-info/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":268285655,"owners_count":24225773,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-01T02:00:08.611Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["pam-module","ssh","ssh-server"],"created_at":"2024-12-25T05:37:28.227Z","updated_at":"2025-08-01T19:31:48.496Z","avatar_url":"https://github.com/eehakkin.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Build CI](https://github.com/eehakkin/pam-ssh-auth-info/actions/workflows/build.yml/badge.svg)](https://github.com/eehakkin/pam-ssh-auth-info/actions/workflows/build.yml)\n\n# PAM SSH Authentication Information Module\n\nThe pam_ssh_auth_info.so PAM module is designed to succeed or fail\nauthentication based on SSH authentication information consisting of\na list of successfully completed authentication methods and public\ncredentials (e.g. keys) used to authenticate the user.\nOne use is to select whether to load other modules based on this test.\n\n## Requirements\n\nThe following packages are required in order to build and install this\nmodule:\n\n* PAM development files (libpam-dev, pam-devel or such)\n* Autoconf (autoconf)\n* Automake (automake)\n* C development files and tools (build-essential, Development tools or such)\n  consisting at least of:\n  * C compiler (such as gcc)\n  * C development files (libc6-dev, glibc-devel or such)\n  * GNU Libtool (libtool)\n  * Make (make)\n\nThe following packages are required in order to make use of this module:\n\n* OpenSSH server (openssh-server \u003e= 7.8p1 or \u003e= 9.8p1 recommended)\n\n## Building and Installation\n\nThe following commands can be used to build this module:\n\n1. autoreconf --install\n2. ./configure\n3. make\n4. sudo make install\n\nIt may be necessary to pass\n--libdir=DIR,\n--exec-prefix=EPREFIX or\n--prefix=PREFIX\noption to ./configure in order to get the PAM module to be installed in\nthe right directory.\n\n## SSH Server Configuration\n\nIt is possible to enable PAM authentication in SSH server using\nkeyboard-interactive challenge-response authentication or\npassword authentication.\n\n### Keyboard-Interactive Authentication\n\nIf keyboard-interactive challenge-response authentication is used, SSH\nauthentication information is available to PAM **auth** modules\nbeginning with OpenSSH version 7.8p1.\n\nIn order to enable PAM authentication using keyboard-interactive\nchallenge-response authentication, the following SSH server options must\nbe set in **/etc/ssh/sshd_config** or such (either explicitly or via\ndefaults):\n\n* AuthenticationMethods\n  - must contain **keyboard-interactive** (or\n    **keyboard-interactive:pam**) or must not be set\n  - should contain comma-separated lists of authentication method names\n    with **keyboard-interactive** (or **keyboard-interactive:pam**) as\n    the last list items so that there are successfully completed\n    authentication methods and public credentials (e.g. keys) during\n    the PAM authentication, for example\n    ```\n    AuthenticationMethods publickey,keyboard-interactive\n    ```\n    for mandatory public key authentication and mandatory PAM\n    authentication using keyboard-interactive challenge-response\n    authentication or\n    ```\n    AuthenticationMethods publickey,keyboard-interactive keyboard-interactive\n    ```\n    for optional public key authentication and mandatory PAM\n    authentication using keyboard-interactive challenge-response\n    authentication\n* KbdInteractiveAuthentication yes\n  - NOTE: Before OpenSSH version 8.7p1,\n    **ChallengeResponseAuthentication yes** was needed for\n    **KbdInteractiveAuthentication yes** to have an effect.\n* UsePAM yes\n\n### Password Authentication\n\nIf password authentication is used, SSH authentication information is\navailable to PAM **auth** modules beginning with OpenSSH version 9.8p1.\n\nIn order to enable PAM authentication using password authentication,\nthe following SSH server options must be set in **/etc/ssh/sshd_config**\nor such (either explicitly or via defaults):\n\n* AuthenticationMethods\n  - must contain **password** or must not be set\n  - should contain comma-separated lists of authentication method names\n    with **password** as the last list items so that there are\n    successfully completed authentication methods and public credentials\n    (e.g. keys) during the PAM authentication, for example\n    ```\n    AuthenticationMethods publickey,password\n    ```\n    for mandatory public key authentication and mandatory PAM\n    authentication using password authentication or\n    ```\n    AuthenticationMethods publickey,password password\n    ```\n    for optional public key authentication and mandatory PAM\n    authentication using password authentication\n* PasswordAuthentication yes\n* UsePAM yes\n\n### Account Management, Session Management and Authentication Token Update\n\nSSH authentication information is available to PAM **account**,\n**session** and **password** modules beginning with OpenSSH version\n7.6p1. However, these are undoubtedly less usefull module types than\nthe **auth** type described above.\n\nIn order to enable PAM account management, session management and\nauthentication token update, the following SSH server options must be\nset in **/etc/ssh/sshd_config** or such (either explicitly or via\ndefaults):\n\n* UsePAM yes\n\n## PAM Configuration\n\nIn order to enable this module, an appropriate file in\nthe **/etc/pam.d/** directory (such as **/etc/pam.d/sshd**) must be\nmodified to contain a line in form of\n\n    auth [auth_err=fail-action, default=error-action, ignore=ignore-action, success=success-action] pam_ssh_auth_info.so [option]... [pattern]...\n\nFor more information,\nsee\n[pam_ssh_auth_info(8)](https://github.Eero.Häkkinen.fi/pam-ssh-auth-info/),\n[pam.conf(5)](https://manpages.debian.org/pam.conf.5) and\n[sshd_config(5)](https://manpages.debian.org/sshd_config.5).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feehakkin%2Fpam-ssh-auth-info","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feehakkin%2Fpam-ssh-auth-info","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feehakkin%2Fpam-ssh-auth-info/lists"}