Chapter 10.  Authentication in ThinLinc

Table of Contents

10.1. Pluggable Authentication Modules
10.1.1. Configuration files for PAM
10.2. Limitations
10.3. Using Public Key Authentication
10.3.1. Introduction
10.3.2. Key Generation
10.3.3. Server Configuration
10.3.4. Client Configuration
10.4. Using Smart Card Public Key Authentication
10.4.1. Introduction
10.4.2. General Requirements
10.4.3. Key Generation
10.4.4. Server Configuration
10.4.5. Client Configuration
10.4.6. Automatic Connection
10.4.7. LDAP Automatic Update (tl-ldap-certalias)
10.5. Using One Time Passwords
10.5.1. Introduction
10.5.2. General Requirements
10.5.3. Configuration for RSA SecurID

In this chapter we will describe how authentication of users is performed in ThinLinc

10.1.  Pluggable Authentication Modules

Authentication of users in ThinLinc is performed using the Pluggable Authentication Modules (PAM). This means ThinLinc can authenticate users using any system for which there is a PAM module. Examples of PAM modules are pam_ldap for accessing LDAP directories (including Novell NDS/eDirectory) and pam_winbind for authenticating against a Windows Domain. Of course, authentication using the standard plaintext password files of Linux is also possible using the PAM module pam_unix.

10.1.1.  Configuration files for PAM

PAM is configured by editing the files located in the directory /etc/pam.d/.

Different Linux distributions have slightly different ways of configuring PAM. The ThinLinc installation program will setup ThinLinc to authenticate using the same PAM setup as the Secure Shell Daemon, by creating a symbolic link from /etc/pam.d/thinlinc to either /etc/pam.d/sshd or /etc/pam.d/ssh, depending on which of the latter files that exists at installation. This seems to work on most distributions. Be aware that the PAM settings for the Secure Shell Daemon might really be somewhere else. For example, on Red Hat distributions, the file /etc/pam.d/system-auth is included by all other pam-files, so in most cases, that is the file that should be modified instead of the file used by sshd.