my
pam_namespace.so模块应用，polyinstantiation（多实例化），提高安全性
通过配置pam，在用户登录时实际登录的是虚拟目录，类似chroot，用户的所有操作都限定在该虚拟目录中。
修改/etc/security/namespace.conf，添加：
$HOME $HOME/$USER.inst/inst- context
# mkdir /home/test/test.inst
# chown root:root /home/test/test.inst
# chmod 000 /home/test/test.inst
在/etc/pam.d/login 和 /etc/pam.d/sshd 中添加：
session required pam_namespace.so
Ctrl+Alt+F1，以test用户登录
$ touch test_file
$ ls
test_file
$ pwd
/home/test
再以root用户来看：
root@jfo-laptop:/home/test# cd test.inst/inst-test/
root@jfo-laptop:/home/test/test.inst/inst-test# ls
test_file
root@jfo-laptop:/home/test/test.inst/inst-test# pwd
/home/test/test.inst/inst-test
for more info, refer:
使用多实例化提高安全性
http://www.ibm.com/developerworks/cn/linux/l-polyinstantiation/index.htmlmy
Linux的鉴别(Authentication)机制–PAM
http://blog.csdn.net/absurd/archive/2007/04/23/1576621.aspx
The Linux-PAM System Administrators’ Guide
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/Linux-PAM_SAG.html
Linux-PAM (Pluggable Authentication Modules for Linux) is a suite of shared libraries that enable the local system administrator to choose how applications authenticate users.
In other words, without (rewriting and) recompiling a PAM-aware application, it is possible to switch between the authentication mechanism(s) it uses. Indeed, one may entirely upgrade the local authentication system without touching the applications themselves.
Historically an application that has required a given user to be authenticated, has had to be compiled to use a specific authentication mechanism. For example, in the case of traditional UN*X systems, the identity of the user is verified by the user entering a correct password. This password, after being prefixed by a two character salt'', is encrypted (with crypt(3)). The user is then authenticated if this encrypted password is identical to the second field of the user's entry in the system password database (the <code>/etc/passwd</code> file). On such systems, most if not all forms of privileges are granted based on this single authentication scheme. Privilege comes in the form of a personal user-identifier (UID) and membership of various groups. Services and applications are available based on the personal and group identity of the user. Traditionally, group membership has been assigned based on entries in the <code>/etc/group</code> file.</p><p>It is the purpose of the <em>Linux-PAM</em> project to separate the development of privilege granting software from the development of secure and appropriate authentication schemes. This is accomplished by providing a library of functions that an application may use to request that a user be authenticated. This PAM library is configured locally with a system file, <code>/etc/pam.conf</code> (or a series of configuration files located in <code>/etc/pam.d/</code>) to authenticate a user request via the locally available authentication modules. The modules themselves will usually be located in the directory <code>/lib/security</code> or <code>/lib64/security</code> and take the form of dynamically loadable object files (see dlopen(3)).</p><br /><br /><br />Overview<br /><p>For the uninitiated, we begin by considering an example. We take an application that grants some service to users; <strong>login</strong> is one such program. <strong>Login</strong> does two things, it first establishes that the requesting user is whom they claim to be and second provides them with the requested service: in the case of <strong>login</strong> the service is a command shell (bash, tcsh, zsh, etc.) running with the identity of the user.</p><p>Traditionally, the former step is achieved by the <strong>login</strong> application prompting the user for a password and then verifying that it agrees with that located on the system; hence verifying that as far as the system is concerned the user is who they claim to be. This is the task that is delegated to <em>Linux-PAM</em>.</p><p>From the perspective of the application programmer (in this case the person that wrote the <strong>login</strong> application), <em>Linux-PAM</em> takes care of this authentication task -- verifying the identity of the user.</p><p>The flexibility of <em>Linux-PAM</em> is that <em>you</em>, the system administrator, have the freedom to stipulate which authentication scheme is to be used. You have the freedom to set the scheme for any/all PAM-aware applications on your Linux system. That is, you can authenticate from anything as naive as <em>simple trust</em> (<strong>pam_permit</strong>) to something as paranoid as a combination of a retinal scan, a voice print and a one-time password!</p><p>To illustrate the flexibility you face, consider the following situation: a system administrator (parent) wishes to improve the mathematical ability of her users (children). She can configure their favoriteShoot ‘em up game’’ (PAM-aware of course) to authenticate them with a request for the product of a couple of random numbers less than 12. It is clear that if the game is any good they will soon learn their multiplication tables. As they mature, the authentication can be upgraded to include (long) division!
Linux-PAM deals with four separate types of (management) task. These are: authentication management; account management; session management; and password management. The association of the preferred management scheme with the behavior of an application is made with entries in the relevant Linux-PAM configuration file. The management functions are performed by modules specified in the configuration file. The syntax for this file is discussed in the section below.
Here is a figure that describes the overall organization of Linux-PAM:
+—————-+| application: X |
+—————-+ / +———-+ +================+
| authentication-[—->—-] Linux- |–<–| PAM config file|
| + [—-<–/–] PAM | |================|
|[conversation()][–+ | | | X auth .. a.so |
+—————-+ | / +-n–n—–+ | X auth .. b.so |
| | | | | | ___/
| service user | A | | |__,—–’
| | | V A
+—————-+ +——|—–|———+ —–+——+
+—u—–u—-+ | | |
| auth…. |–[ a ]–[ b ]–[ c ]
+————–+
| acct…. |–[ b ]–[ d ]
+————–+
| password |–[ b ]–[ c ]
+————–+
| session |–[ e ]–[ c ]
+————–+
By way of explanation, the left of the figure represents the application; application X. Such an application interfaces with the Linux-PAM library and knows none of the specifics of its configured authentication method. The Linux-PAM library (in the center) consults the contents of the PAM configuration file and loads the modules that are appropriate for application-X. These modules fall into one of four management groups (lower-center) and are stacked in the order they appear in the configuration file. These modules, when called by Linux-PAM, perform the various authentication tasks for the application. Textual information, required from/or offered to the user, can be exchanged through the use of the application-supplied conversation function.
If a program is going to use PAM, then it has to have PAM functions explicitly coded into the program. If you have access to the source code you can add the appropriate PAM functions. If you do not have accessto the source code, and the binary does not have the PAM functions included, then it is not possible to use PAM.