Asynchronous PAM authentication for NodeJS. Implements two PAM methods pam_authenticate(3) и pam_acct_mgmt(3).

Usage

Callback example

const { pamAuthenticate, pamErrors } = require('node-linux-pam');

const options = {
  username: 'username',
  password: 'password',
};

pamAuthenticate(options, (err, code) => {
  if (!err) {
    console.log('Authenticated!');
    return;
  }

  if (code === pamErrors.PAM_NEW_AUTHTOK_REQD) {
    console.log('Authentication token is expired');
    return;
  }

  console.log(err, code);
});

Promises example

const { pamAuthenticatePromise, pamErrors, PamError } = require('node-linux-pam');

const options = {
  username: 'username',
  password: 'password',
};

pamAuthenticatePromise(options)
  .then(() => {
    console.log('Authenticated!');
  })
  .catch((err) => {
    if (err instanceof PamError) {
      const { message, code } = err;

      if (code === pamErrors.PAM_NEW_AUTHTOK_REQD) {
        console.log('Authentication token is expired');
        return;
      }

      console.log(message, code);
    }
  });

CLI parameters

$ sudo nlp --username user --password pass --stderr-template "{ status: {name} }"
Error: Authentication failure
{ status: PAM_AUTH_ERR }

| Option name | Description | Default | Required | | --------------- | ------------------------------------------------------------------------------------------------------------------- | --------------- | -------- | | username | The name of the target user | | Yes | | password | User password | | Yes | | service-name | The name of the service to apply | login | No | | remote-host | Sets the PAM_RHOST option via the pam_set_item(3) call | | No | | stdout-template | The template of the message that is printed to stdout on error. Available values to substitute: name, code, message | {message} | No | | stderr-template | The template of the message that is printed to stderr on error. Available values to substitute: name, code, message | {name} [{code}] | No |

Requirements

This module require atleast NodeJS 8

Note that you will have a warning about N-API in version < 10, you can disable it by adding the --no-warnings flag to node

First you need to install the development version of PAM libraries for your distro.

• Centos and RHEL: yum install pam-devel
• Debian/Ubuntu: apt-get install libpam0g-dev

The user running the NodeJS process must have read permissions on the /etc/shadow file.

Installation

npm install node-linux-pam -S

Options

| Name | Description | Default | Required | | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -------- | | username | The name of the target user | '' | Yes | | password | User password | '' | Yes | | serviceName | The name of the service to apply | 'login' | No | | remoteHost | Sets the PAM_RHOST option via the pam_set_item(3) call | '' | No |

Responce PAM code

| Code | | Description | | ------------------------- | --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | PAM_SUCCESS | 0 | Successful function return | | PAM_OPEN_ERR | 1 | dlopen() failure when dynamically loading a service module | | PAM_SYMBOL_ERR | 2 | Symbol not found | | PAM_SERVICE_ERR | 3 | Error in service module | | PAM_SYSTEM_ERR | 4 | System error | | PAM_BUF_ERR | 5 | Memory buffer error | | PAM_PERM_DENIED | 6 | Permission denied | | PAM_AUTH_ERR | 7 | Authentication failure | | PAM_CRED_INSUFFICIENT | 8 | Can not access authentication data due to insufficient credentials | | PAM_AUTHINFO_UNAVAIL | 9 | Underlying authentication service can not retrieve authentication information | | PAM_USER_UNKNOWN | 10 | User not known to the underlying authenticaiton module | | PAM_MAXTRIES | 11 | An authentication service has maintained a retry count which has been reached. No further retries should be attempted | | PAM_NEW_AUTHTOK_REQD | 12 | New authentication token required. This is normally returned if the machine security policies require that the password should be changed beccause the password is NULL or it has aged | | PAM_ACCT_EXPIRED | 13 | User account has expired | | PAM_SESSION_ERR | 14 | Can not make/remove an entry for the specified session | | PAM_CRED_UNAVAIL | 15 | Underlying authentication service can not retrieve user credentials unavailable | | PAM_CRED_EXPIRED | 16 | User credentials expired | | PAM_CRED_ERR | 17 | Failure setting user credentials | | PAM_NO_MODULE_DATA | 18 | No module specific data is present | | PAM_CONV_ERR | 19 | Conversation error | | PAM_AUTHTOK_ERR | 20 | Authentication token manipulation error | | PAM_AUTHTOK_RECOVERY_ERR | 21 | Authentication information cannot be recovered | | PAM_AUTHTOK_LOCK_BUSY | 22 | Authentication token lock busy | | PAM_AUTHTOK_DISABLE_AGING | 23 | Authentication token aging disabled | | PAM_TRY_AGAIN | 24 | Preliminary check by password service | | PAM_IGNORE | 25 | Ignore underlying account module regardless of whether the control flag is required, optional, or sufficient | | PAM_ABORT | 26 | Critical error (?module fail now request) | | PAM_AUTHTOK_EXPIRED | 27 | user's authentication token has expired | | PAM_MODULE_UNKNOWN | 28 | module is not known | | PAM_BAD_ITEM | 29 | Bad item passed to pam_*_item() | | PAM_CONV_AGAIN | 30 | conversation function is event driven and data is not available yet | | PAM_INCOMPLETE | 31 | please call this function again to complete authentication stack. Before calling again, verify that conversation is completed |

License

MIT