Warning: This document is for the development version of Bareos Documentation. The main version is bareos-24.

PAM

PAM is an authentication method provided by many operating systems to establish a standardized interface for the authorization of users.

The name of the service to be registered with the respective PAM module is “bareos”.

The following sequence diagram shows three options how a user can be authorized on a Bareos Director Daemon:

  • Option 1: No PAM authentication using named console

  • Option 2: Interactive PAM authentication

  • Option 3: Direct PAM authentication

In this example the complete connection and authorization sequence of a Bareos Console respective Bareos Webui is shown.

A detailed description on the configuration see this chapter: Pluggable Authentication Modules (PAM).

skinparam SequenceMessageAlign reversedirection actor "Console\nWebUI" as W participant "director\ndaemon" as D W <-> D: Initiate TCP connection W <-> D: TLS Cert/PSK Handshake note right of D: <b>default console</b>: identity *UserAgent*,\npassword/key from director resource\n\n<b>named console</b>: identity <console-name>,\npassword/key from console resource W -> D: "Hello <*UserAgent*|console-name> calling" W <- D: "auth cram-md5[c] <password-md5> ssl=<0|1|2|4>" W -> D: "<password-md5>" W <-- D: On Failure [Close TLS connection] W <- D: On Success: "1000 OK auth" W -> D: "auth cram-md5[c] <password-md5> ssl=<0|1|2|4>" W <- D: "<password-md5>" W --> D: On Failure [Close TLS connection] W -> D: On Success: "1000 OK auth" ... ... == Option 1: No PAM authentication (Default Console) == ... no further action ... == Option 2: Interactive PAM authentication (Console) == note right of D: pam can only be used when connected \nwith a named console (__not__ default console) \nusing EnablePamAuthentication= yes note left of W: (__RS__) is the Record Separator \n(ASCII-character 0x1e) W <- D: "1001__RS__" (Pam Authentication required) W -> D: "4001__RS__" (Interactive Pam (i.e. pam_unix)) W <- D: "0x2" (type = PAM_PROMPT_ECHO_ON) note left of W: type as bcd: \n0x0 (PAM_SUCCESS)\n0x1 (PAM_PROMPT_ECHO_OFF) \n0x2 (PAM_PROMPT_ECHO_ON) W <- D: "Login:" W -> D: "<cleartext pam-username>" W <- D: "0x1" (type = PAM_PROMPT_ECHO_OFF) W <- D: "Password:" W -> D: "<cleartext pam-password>" W <- D: On Success: "0x0" (PAM_SUCCESS) W <- D: On Success: "0x0" (empty message) == Option 3: Direct PAM authentication (WebUI) == W <- D: "1001__RS__" (Pam Authentication required) W -> D: "4002__RS__Username__RS__Password" (PAM credentials) ... ... == On any failure == W <--> D: [Close TLS connection] W <--> D: Close TCP connection == On success == W <- D: 1000__RS__OK:__RS__<director-name> Version: <version> (<date>) W <- D: 1002__RS__<You are logged in as: <username>|You are connected using the default console> ... run some console commands ... W <-> D: [Close TLS connection] W <-> D: Close TCP connection

Console/WebUI connection sequence from Bareos 18.2