Security and PAM

Documentation / Contents - CyLogin

• Overview of CyLogin
  • What It Is
  • What It Is Not
  • The Programs
  • In This Book
• Setting Up
  • What You Need
  • Build and Install
  • Enable With the Helper
  • Linux SysV and systemd
  • NetBSD rc.d
  • PAM Service File
  • Xservers and VT
  • Headless and LXC
  • Competing Display Managers
  • Check That It Works
  • Disable and Rollback
  • Common Mistakes
• Using CyLogin
  • Logging In
  • Faces
  • noiconlogin
  • Session Lock
  • Autologin and Classroom
  • After Login (Session)
  • Failsafe
• Configuration
  • Master Conf
  • Appearance
  • Session Path
  • Unsafe Knobs
  • Autologin Knobs
  • Lock Timeout
  • Classroom Sample
• Enable and Disable Helpers
  • cylogin-enable
  • Every enable Flag
  • cylogin-disable
  • Examples
• Security and PAM
  • Defaults
  • PAM Stacks
  • Empty Password Gate
  • Auth Dir and Cookies
  • Vs XDM and login
  • Lab Matrix
• Command Line
  • cylogind
  • cylogin Greeter
  • cylogin-authcheck
  • cychooser
• Keys and Shortcuts
• Files and Paths
  • System Conf
  • Runtime
  • Share Install
  • Init and PAM
• Troubleshooting
  • Greeter Never Appears
  • No Screens Found
  • PAM Failures
  • Wrong Session After Login
  • Setuid and Nobody
• Copyright

Security and PAM

CyLogin ships secure defaults and a few deliberately unsafe options that restore 1990s IRIX clogin friendliness when you turn them on on purpose. Longer prose: src/cylogin/docs/security.md. Setup of the service file: Setting Up.

Defaults

Behavior              | Default |
Graphical root login  | refused; root not in face grid |
Null-password walk-in | refused |
/dev/null shell tiles | hidden |
Greeter process       | nobody (never root) |
Auth dir              | 0711; cookies 0600 |
Failure copy/time     | uniform (no user enum) |
--canonical           | look only; does not open unsafe knobs |

Unsafe knobs (all off): allow_root_login, allow_null_passwd, show_devnull_shell. Autologin is separate and also off by default.

PAM Stacks

Built with ./configure --with-pam. Service name:

/etc/pam.d/cylogin

Samples under share/cylogin:

• pam.d-cylogin -- Debian/Devuan/Ubuntu common-* (same class as stock login / xdm on those distros)
• pam.d-cylogin.rhel -- RHEL/Rocky/Alma/Fedora system-auth + pam_nologin

cylogin-enable installs the matching sample only when missing. NetBSD skips PAM entirely (native master.passwd / crypt).

PAM may accept a directory user (AD/LDAP/Centrify). CyLogin still applies root / home / nologin / expiry rules afterward. Missing pam.d/cylogin fails closed when PAM was compiled in; there is no silent weaker path.

Empty Password Gate

Many RHEL-family system-auth stacks carry pam_unix.so nullok. PAM alone would accept an empty typed password for a null-hash account. CyLogin refuses an empty typed password unless allow_null_passwd is on in cylogin.conf, after the root check and before trusting that PAM success. Defaults stay closed; demos opt in deliberately.

Auth Dir and Cookies

/var/lib/cyanotype/authdir   mode 0711

Per-display cookie files (cylogind-_N, greeter-_N) mode 0600. The cookie IS the X authorization. World-writable authdir is a failure; enable and the PAM matrix check modes. Greeter runs as greeter_user (nobody) so an untrusted X client path does not talk to a root Motif process.

Vs XDM and login

Concern            | Stock XDM/login class     | CyLogin default |
PAM includes       | common-* or system-auth   | same class |
Root at greeter    | often PAM-allowed         | refused unless allow_root_login |
Null password      | depends on nullok         | refused unless allow_null_passwd |
Greeter privilege  | historically root X client| greeter as nobody |
Cookie dir         | xdm authDir modes         | authdir 0711; cookies 0600 |
Missing PAM file   | PAM fail                  | fail closed with --with-pam |

Goal: no wider hole than a typical XDM/login seat, plus policy knobs that default safer.

Lab Matrix

Tree tool for negative tests on Linux CTs:

tools/cylogin-pam-matrix.sh

Covers good pass, wrong pass, empty typed, null-hash+empty (nullok closed), root empty, /etc/nologin, authdir 0711, pam.d present. Run on snapshotted lab LXCs after enable. Punchlist acceptance lives in docs/punchlists/CYLOGIN-ENABLE.md.