Enabling Console Access for Other Applications


If you wish to make other applications accessible to console users, you will have to do a bit more work. First of all, console access works only for applications that reside in /sbin or /usr/sbin, so the application you wish to run must be there. After verifying that, perform the following steps:

  1. Create a link from the name of your application, such as the foo program used as an example in this section, to the /usr/bin/consolehelper application:

    cd /usr/bin ln -s consolehelper foo
  2. Create the file /etc/security/console.apps/foo:

    touch /etc/security/console.apps/foo
  3. Create a PAM configuration file for the foo service in /etc/pam.d/. An easy way to do this is to start with a copy of the halt service’s PAM configuration file and then modify the file if you want to change the behavior:

    cp /etc/pam.d/halt /etc/pam.d/foo

Now, when you run /usr/bin/foo, it will call consolehelper, which will authenticate the user with the help of /usr/sbin/userhelper. To authenticate the user, consolehelper will ask for the user’s password if /etc/pam.d/foo is a copy of /etc/pam.d/halt (otherwise, it will do precisely what is specified in /etc/pam.d/foo) and then run /usr/sbin/foo with root permissions.

In the PAM configuration file, an application can be configured to use the pam_timestamp module to remember (cache) a successful authentication attempt. When an application is started and proper authentication is provided (the root password), a timestamp file is created. By default, a successful authentication is cached for five minutes. During this time, any other application that is configured to use pam_timestamp and run from the same session is automatically authenticated for the user — the user does not have to enter the root password again.

This module is included in the pam package. To enable this feature, the PAM configuration file in /etc/pam.d/ must include the following lines:

auth sufficient /lib/security/pam_timestamp.so session optional /lib/security/pam_timestamp.so

The first line that begins with auth should be after any other auth sufficient lines, and the line that begins with session should be after any other session optional lines. If an application configured to use pam_timestamp is successfully authenticated from the Main Menu Button (on the Panel), an icon is displayed in the notification area of the panel if you are running the GNOME desktop environment. After the authentication expires (the default is five minutes), the icon disappears. The user can select to forget the cached authentication by clicking on the icon and selecting the option to forget authentication.




Official Red Hat Linux Administrator's Guide
Official Red Hat Linux Administrators Guide
ISBN: 0764516957
EAN: 2147483647
Year: 2002
Pages: 278
Authors: Red Hat Inc

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net