Hacktricks-skills pam-hardening

Linux PAM security auditing, backdoor detection, and hardening. Use this skill whenever the user mentions PAM configuration, authentication security, Linux hardening, credential harvesting detection, SSH security, or any post-exploitation concerns related to authentication. Also trigger for security audits, penetration testing, or when investigating suspicious login behavior.

install

source · Clone the upstream repo

git clone https://github.com/abelrguezr/hacktricks-skills

manifest: skills/linux-hardening/linux-post-exploitation/pam-pluggable-authentication-modules/SKILL.MD

source content

PAM Security & Hardening

This skill helps you audit, harden, and detect backdoors in Linux Pluggable Authentication Modules (PAM) configurations.

When to Use This Skill

Auditing PAM configurations for security issues
Detecting PAM-based backdoors or credential harvesters
Hardening authentication on Linux systems
Investigating suspicious login behavior
Post-exploitation security assessments
Penetration testing authentication systems

Quick Start

# Run the PAM security audit
./scripts/pam-audit.sh

# Check for backdoored PAM modules
./scripts/pam-backdoor-check.sh

Understanding PAM

PAM Realms

Realm	Purpose
`auth`	Validates user identity (passwords, tokens)
`account`	Account verification (group membership, time restrictions)
`password`	Password updates and complexity checks
`session`	Session start/end actions (mounting, resource limits)

PAM Controls

Control	Behavior
`required`	Failure causes eventual failure after all modules checked
`requisite`	Immediate termination on failure
`sufficient`	Success bypasses remaining checks in realm
`optional`	Only fails if it's the sole module

Detection & Triage

1. Spot Alien PAM Objects

find /{lib,usr/lib,usr/local/lib}{,64}/security -type f -printf '%p %s %M %u:%g %TY-%Tm-%Td\n' | grep -E 'pam_|libselinux'

2. Verify Package Integrity

# RHEL/CentOS
rpm -V pam

# Debian/Ubuntu
debsums -s libpam-modules

3. Identify Non-Packaged Modules

for f in /{lib,usr/lib,usr/local/lib}{,64}/security/*.so; do
    dpkg -S "$f" >/dev/null 2>&1 || echo "UNPACKAGED: $f"
done

4. Check for Suspicious Config Edits

grep -R "pam_.*\.so" /etc/pam.d/ | grep -E 'plg|selinux|custom|exec'

Common Backdoor Techniques

Technique 1: Trojanized pam_unix.so

Attackers replace the legitimate

pam_unix.so

with a modified version that:

Captures credentials to a hidden log file
Implements magic password bypass
Maintains original functionality to avoid detection

Detection:

Compare MD5/SHA256 against distro package
Check for unexpected file modifications
Look for world-writable permissions in
```
/lib/security/
```

Technique 2: pam_exec Persistence

Adding

pam_exec.so

/etc/pam.d/sshd

to run arbitrary code on every SSH login:

# Suspicious entry
session optional pam_exec.so quiet /usr/local/bin/.ssh_hook.sh