---
name: "pamd"
section: "8"
platform: "linux"
package: "dacs"
version: "1.4.40-2"
release: "Debian 10 (Buster)"
platforms: ["linux"]
url: "https://new.carta.tech/pamd"
---

# pamd(8)

PAM transaction server

## NAME

pamd - PAM transaction server

## SYNOPSIS

**pamd** \[**dacsoptions**\[1\]\] \[**-daemon**\] \[**-fork**\] \[**-h** *hostname*\] \[**-http**\] \[**-inetd**\] \[**-nofork**\]\
 \[**-p** *portnum*\] \[**-policy** *name*\] \[**-secure**\] \[**-unsecure**\]

## DESCRIPTION

This program is part of the **DACS** suite.

The **pamd** server is required by the **local\_pam\_authenticate**\[2\] authentication module. It acts as a proxy for **local\_pam\_authenticate**, calling PAM functions on its behalf. The **pamd** server may be started from **[inetd(8)](/inetd/8.md)**\[3\] or from the command line, but it must be running for **DACS** to perform PAM-based authentication.

Each **pamd** process is involved in an arbitrarily long "conversation" or "transaction" with one or more executions of **local\_pam\_authenticate**. For instance, **pamd's** initial response to **local\_pam\_authenticate** might be that it requires an account name; upon receiving the account name from **local\_pam\_authenticate**, **pamd's** response might be that it requires the password for the account; and upon receiving the password, **pamd** would indicate success or failure, depending on whether an acceptable username/password pair was received. The eventual outcome of a transaction is that authentication succeeds, fails, or could not be completed because an error occurs.

**pamd** must be run on the host where **[pam(3)](/pam/3.md)**\[4\] processing is being performed, which is not necessarily the same host where **local\_pam\_authenticate** is executed.

**Security**\

• **pamd** will usually be run as root so that it can access the files it needs to perform authentication.

• **pamd** is not a **DACS** web service and is not protected by **DACS**.

• The protocol between **pamd** and its client may include sensitive material, such as passwords. If both programs are run on the same host, this is probably not an issue. If there is any possibility of eavesdropping etc. by an attacker, however, communication should be secured through an SSL/TLS wrapper.

• **pamd** should probably not be run on a world-accessible server, since it would offer a way for attackers to try to guess passwords.

The operating system's PAM policy file is consulted - see **[pam.conf(5)](/pam.conf/5.md)**\[5\]. The default PAM service name is "dacs" (see **[pam\_start(3)](/pam_start/3.md)**\[6\]), which may be used by PAM to locate the appropriate policy file. A different policy name can be specified using the **-policy** flag.

The prompts that passed from PAM to **pamd** to **local\_pam\_authenticate** to **dacs\_authenticate** (or **dacsauth**) are simply displayed to the user. The user must understand what the prompts mean (e.g., that "Login:" means to provide a Unix account name).

**pamd** can be used by non-**DACS** applications. The protocol, though simple, is not yet documented other than within the source code. A program called **pamd-client** is available for testing and debugging **pamd**; it is built when PAM support is required, but is neither installed nor documented (see the source code for basic instructions).

## OPTIONS

In addition to the standard *dacsoptions*\[1\], **pamd** recognizes these command line flags:

- **-daemon**

  Wait for a connection, then service the request. Mutually exclusive with **-inetd**.

- **-fork**

  Create a new process to service each request. It implies the **-daemon** flag.

- **-h** *hostname*

  If **pamd** is running on a host with multiple IP addresses, this specifies the hostname (or IP address) to listen to for incoming requests. If not provided, the **PAMD\_HOST**\[7\] directive will be consulted; if unavailable, **[gethostname(3)](/gethostname/3.md)**\[8\] will be used.

- **-http**

  This flag is reserved for future use.

- **-inetd**

  The server assumes it has been started by **[inetd(8)](/inetd/8.md)**\[3\] and therefore does not wait for a connection. It exits after servicing the request. This is the default behaviour and preferred way to configure **pamd**. This mode of operation assumes that an entry has been added to **[inetd.conf(5)](/inetd.conf/5.md)**\[9\] that looks much like this:

  ```
  dacs-pamd stream tcp nowait root /usr/local/dacs/sbin/pamd pamd -uj EXAMPLE -inetd
  ```

- **-nofork**

  This flag, which implies the **-daemon**, causes the **pamd** server to exit after servicing one request (which is useful when debugging). This is the default behaviour of **-daemon** mode.

- **-p** *portnum*

  This specifies the port number to listen to, overriding any **PAMD\_PORT**\[10\] directive in effect. It can also be a service name. Any otherwise unassigned port number on the system from 49152 through 65535 (i.e., one in the dynamic and/or private range) ought to be acceptable.

  If neither this flag nor a PAMD\_PORT directive is provided, the program will try to find the port associated with the dacs-pamd service name in **[services(5)](/services/5.md)**\[11\]. For example:

  ```
  dacs-pamd       17000/tcp  # DACS pamd
  ```

- **-policy** *name*

  Use *name* as the PAM policy name instead of the default.

- **-secure**

  The client must supply valid **DACS** administrative credentials encapsulated within a **DACS** cookie. This is the default.

- **-unsecure**

  Administrative credentials are not required, but if they are provided they must be valid. This should probably be used only when testing or if client identification is not an issue or has been addressed in some other way.

**Note**\

When the **-secure** flag is in effect, **pamd** must be associated with a jurisdiction. Therefore, the **DACS** configuration files are read and the jurisdiction must be specified on the command line (e.g., using the **-uj** flag).

## EXAMPLE

For testing purposes, or to better understand how **pamd** works, you can run it manually and interact with it using **[telnet(1)](/telnet/1.md)**\[12\], for example, which takes the place of **local\_pam\_authenticate**. You must have PAM authentication configured on the host where you run **pamd** and you will probably need to run it as root. This is best done using two windows; start **pamd** in the first window and then **telnet** to it from the second window.

An interaction to perform username/password authentication will look something like the following (substitute your jurisdiction's name for myjur, your jurisdiction's domain name or IP address for myjur.example.com, and use a username and password pair that is recognized on your system). The first **telnet** connection receives a prompt for a username (labeled "Login:" and assigned the variable name *AUTH\_PROMPT\_VAR1*) from **pamd**, a transaction identifier (*TRANSID*) "10.0.0.124:56372:66664:53983facb39881b2" for this session, and port number to use for subsequent operations belonging to this transaction (62475). The second **telnet** connection provides the *TRANSID* and username (AUTH\_PROMPT\_VAR1="auggie"), and receives a prompt for a password ("Password:", assigned the variable name *AUTH\_PROMPT\_VAR2*). The third **telnet** connection provides the *TRANSID* and the password (AUTH\_PROMPT\_VAR2="doggy"), and receives the result of authentication ("Success").

```
# ./pamd -uj myjur -ll debug -daemon -unsecure -nofork
pamd[info]: Site config file is "/usr/local/dacs/federations/site.conf"
pamd[info]: Config file is "/usr/local/dacs/federations/dacs.conf"
pamd[info]: This is jurisdiction DSS::myjur
pamd[info]: Secure mode is off
pamd[debug]: Waiting for initial input block...
pamd[debug]: No username
pamd[debug]: Calling pam_authenticate
pamd[debug]: pamd_conv: reply to port 62475
pamd[debug]: TRANSID is "10.0.0.124:56372:66664:53983facb39881b2"
pamd[debug]:   type="text"
pamd[debug]:   label="Login:"
pamd[debug]:   varname="AUTH_PROMPT_VAR1"
pamd[debug]: pamd_conv: waiting 60 seconds for reply
pamd[debug]: pamd_conv: received connection
pamd[debug]: Reading reply...
pamd[debug]: pamd_conv: reply to port 62475
pamd[debug]: TRANSID is "10.0.0.124:62475:66695:fc855a7d68e8b1eb"
pamd[debug]:   type="password"
pamd[debug]:   label="Password:"
pamd[debug]:   varname="AUTH_PROMPT_VAR2"
pamd[debug]: pamd_conv: waiting 60 seconds for reply
pamd[debug]: pamd_conv: received connection
pamd[debug]: Reading reply...
pamd[debug]: Success
pamd[debug]: result="ok"
pamd[debug]: username="auggie"
```

```
% telnet myjur.example.com 17000
Trying 10.0.0.124...
Connected to bsd6.dss.bc.ca.
Escape character is '^]'.
Connection closed by foreign host.
% telnet myjur.example.com 62475
Trying 10.0.0.124...
Connected to bsd6.dss.bc.ca.
Escape character is '^]'.
TRANSID="10.0.0.124:62475:66695:fc855a7d68e8b1eb"
AUTH_PROMPT_VAR1="auggie"
Connection closed by foreign host.
% telnet myjur.example.com 62475
Trying 10.0.0.124...
Connected to bsd6.dss.bc.ca.
Escape character is '^]'.
TRANSID="10.0.0.124:62475:66695:fc855a7d68e8b1eb"
AUTH_PROMPT_VAR2="doggy"
result="ok"
username="auggie"
Connection closed by foreign host.
```

## DIAGNOSTICS

The program exits 0 if everything was fine, 1 if an error occurred.

## BUGS

The **-daemon** flag should cause the process to detach and put itself in the background unless overridden by another flag; at present it must be started in the background "manually".

The **-http** flag, which would allow a **pamd** session to be started with a web service request, is not implemented.

## SEE ALSO

**[dacs\_authenticate(8)](/dacs_authenticate/8.md)**\[13\], **[dacsauth(1)](/dacsauth/1.md)**\[14\], **[pam(3)](/pam/3.md)**\[15\], **X/Open Single Sign-On Service (XSSO) preliminary specification**\[16\]

## AUTHOR

Distributed Systems Software (**www.dss.ca**\[17\])

## COPYING

Copyright © 2003-2018 Distributed Systems Software. See the **LICENSE**\[18\] file that accompanies the distribution for licensing information.

## NOTES

- 1\.

  dacsoptions

  http://dacs.dss.ca/man/dacs.1.html#dacsoptions

- 2\.

  local\_pam\_authenticate

  http://dacs.dss.ca/man/dacs\_authenticate.8.html#local\_pam\_authenticate

- 3\.

  [inetd(8)](/inetd/8.md)

  https://www.freebsd.org/cgi/man.cgi?query=inetd&apropos=0&sektion=8&manpath=FreeBSD+10.3-RELEASE&format=html

- 4\.

  [pam(3)](/pam/3.md)

  https://www.freebsd.org/cgi/man.cgi?query=pam&apropos=0&sektion=0&manpath=FreeBSD+10.3-RELEASE&format=html

- 5\.

  [pam.conf(5)](/pam.conf/5.md)

  https://www.freebsd.org/cgi/man.cgi?query=pam.conf&apropos=0&sektion=5&manpath=FreeBSD+10.3-RELEASE&format=html

- 6\.

  [pam\_start(3)](/pam_start/3.md)

  https://www.freebsd.org/cgi/man.cgi?query=pam\_start&apropos=0&sektion=3&manpath=FreeBSD+10.3-RELEASE&format=html

- 7\.

  PAMD\_HOST

  http://dacs.dss.ca/man/dacs.conf.5.html#PAMD\_HOST

- 8\.

  [gethostname(3)](/gethostname/3.md)

  https://www.freebsd.org/cgi/man.cgi?query=gethostname&apropos=0&sektion=3&manpath=FreeBSD+10.3-RELEASE&format=html

- 9\.

  [inetd.conf(5)](/inetd.conf/5.md)

  https://www.freebsd.org/cgi/man.cgi?query=inetd.conf&apropos=0&sektion=5&manpath=FreeBSD+10.3-RELEASE&format=html

- 10\.

  PAMD\_PORT

  http://dacs.dss.ca/man/dacs.conf.5.html#PAMD\_PORT

- 11\.

  [services(5)](/services/5.md)

  https://www.freebsd.org/cgi/man.cgi?query=services&apropos=0&sektion=5&manpath=FreeBSD+10.3-RELEASE&format=html

- 12\.

  [telnet(1)](/telnet/1.md)

  https://www.freebsd.org/cgi/man.cgi?query=telnet&apropos=0&sektion=1&manpath=FreeBSD+10.3-RELEASE&format=html

- 13\.

  [dacs\_authenticate(8)](/dacs_authenticate/8.md)

  http://dacs.dss.ca/man/dacs\_authenticate.8.html

- 14\.

  [dacsauth(1)](/dacsauth/1.md)

  http://dacs.dss.ca/man/dacsauth.1.html

- 15\.

  [pam(3)](/pam/3.md)

  https://www.freebsd.org/cgi/man.cgi?query=pam&apropos=0&sektion=3&manpath=FreeBSD+10.3-RELEASE&format=html

- 16\.

  X/Open Single Sign-On Service (XSSO) preliminary specification

  http://www.opengroup.org/pubs/catalog/p702.htm

- 17\.

  www.dss.ca

  http://www.dss.ca

- 18\.

  LICENSE

  http://dacs.dss.ca/man/../misc/LICENSE