0.2.1 • Published 3 years ago

node-linux-pam v0.2.1

Weekly downloads
63
License
MIT
Repository
github
Last release
3 years ago

logo

Actions Status node-current

Asynchronous PAM authentication for NodeJS. Implements two PAM methods pam_authenticate(3) и pam_acct_mgmt(3).

Usage

Callback example

const { pamAuthenticate, pamErrors } = require('node-linux-pam');

const options = {
  username: 'username',
  password: 'password',
};

pamAuthenticate(options, (err, code) => {
  if (!err) {
    console.log('Authenticated!');
    return;
  }

  if (code === pamErrors.PAM_NEW_AUTHTOK_REQD) {
    console.log('Authentication token is expired');
    return;
  }

  console.log(err, code);
});

Promises example

const { pamAuthenticatePromise, pamErrors, PamError } = require('node-linux-pam');

const options = {
  username: 'username',
  password: 'password',
};

pamAuthenticatePromise(options)
  .then(() => {
    console.log('Authenticated!');
  })
  .catch((err) => {
    if (err instanceof PamError) {
      const { message, code } = err;

      if (code === pamErrors.PAM_NEW_AUTHTOK_REQD) {
        console.log('Authentication token is expired');
        return;
      }

      console.log(message, code);
    }
  });

CLI parameters

$ sudo nlp --username user --password pass --stderr-template "{ status: {name} }"
Error: Authentication failure
{ status: PAM_AUTH_ERR }
Option nameDescriptionDefaultRequired
usernameThe name of the target userYes
passwordUser passwordYes
service-nameThe name of the service to applyloginNo
remote-hostSets the PAM_RHOST option via the pam_set_item(3) callNo
stdout-templateThe template of the message that is printed to stdout on error. Available values to substitute: name, code, message{message}No
stderr-templateThe template of the message that is printed to stderr on error. Available values to substitute: name, code, message{name} {code}No

Requirements

This module require atleast NodeJS 8

Note that you will have a warning about N-API in version < 10, you can disable it by adding the --no-warnings flag to node

First you need to install the development version of PAM libraries for your distro.

  • Centos and RHEL: yum install pam-devel
  • Debian/Ubuntu: apt-get install libpam0g-dev

The user running the NodeJS process must have read permissions on the /etc/shadow file.

Installation

npm install node-linux-pam -S

Options

NameDescriptionDefaultRequired
usernameThe name of the target user''Yes
passwordUser password''Yes
serviceNameThe name of the service to apply'login'No
remoteHostSets the PAM_RHOST option via the pam_set_item(3) call''No

Responce PAM code

CodeDescription
PAM_SUCCESS0Successful function return
PAM_OPEN_ERR1dlopen() failure when dynamically loading a service module
PAM_SYMBOL_ERR2Symbol not found
PAM_SERVICE_ERR3Error in service module
PAM_SYSTEM_ERR4System error
PAM_BUF_ERR5Memory buffer error
PAM_PERM_DENIED6Permission denied
PAM_AUTH_ERR7Authentication failure
PAM_CRED_INSUFFICIENT8Can not access authentication data due to insufficient credentials
PAM_AUTHINFO_UNAVAIL9Underlying authentication service can not retrieve authentication information
PAM_USER_UNKNOWN10User not known to the underlying authenticaiton module
PAM_MAXTRIES11An authentication service has maintained a retry count which has been reached. No further retries should be attempted
PAM_NEW_AUTHTOK_REQD12New authentication token required. This is normally returned if the machine security policies require that the password should be changed beccause the password is NULL or it has aged
PAM_ACCT_EXPIRED13User account has expired
PAM_SESSION_ERR14Can not make/remove an entry for the specified session
PAM_CRED_UNAVAIL15Underlying authentication service can not retrieve user credentials unavailable
PAM_CRED_EXPIRED16User credentials expired
PAM_CRED_ERR17Failure setting user credentials
PAM_NO_MODULE_DATA18No module specific data is present
PAM_CONV_ERR19Conversation error
PAM_AUTHTOK_ERR20Authentication token manipulation error
PAM_AUTHTOK_RECOVERY_ERR21Authentication information cannot be recovered
PAM_AUTHTOK_LOCK_BUSY22Authentication token lock busy
PAM_AUTHTOK_DISABLE_AGING23Authentication token aging disabled
PAM_TRY_AGAIN24Preliminary check by password service
PAM_IGNORE25Ignore underlying account module regardless of whether the control flag is required, optional, or sufficient
PAM_ABORT26Critical error (?module fail now request)
PAM_AUTHTOK_EXPIRED27user's authentication token has expired
PAM_MODULE_UNKNOWN28module is not known
PAM_BAD_ITEM29Bad item passed to pam_*_item()
PAM_CONV_AGAIN30conversation function is event driven and data is not available yet
PAM_INCOMPLETE31please call this function again to complete authentication stack. Before calling again, verify that conversation is completed

License

MIT