如何使用PAM静态认证账号。

最近在网上找了不少关于pam的资料，虽然很多，但是都只是动态交互进行验证。因为工作需要，需要进行静态的验证，于是写了如下代码。以下在Mac os X上验证通过。如果把#include <pam/pam_appl.h>，#include <pam/pam_misc.h>，改成#include <security/pam_appl.h>，#include <security/pam_misc.h>应该直接可以在Linux，和Unix等支持Posix标准的环境下运行。

#include <sys/param.h>

#include <sys/time.h>

#include <sys/resource.h>

#include <sys/wait.h>

#include <err.h>

#include <errno.h>

#include <grp.h>

#include <paths.h>

#include <pwd.h>

#include <signal.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <syslog.h>

#include <unistd.h>

#include <pam/pam_appl.h>

#include <pam/pam_misc.h>

//#include <pam/pam_misc.h>

int su_conv(int num_msg, const struct pam_message **msgm, //回调函数，非常重要！！！！

struct pam_response **response,void *appdata_ptr);

//static struct pam_conv conv = {misc_conv,NULL};

int main (int argc, const char * argv[])

{

// insert code here...

pam_handle_t *pamh;

const char* mytty,*p;

char *password = "718412";

char *user = "root";

struct pam_conv conv = {su_conv, password};

//其中password就是直接传递给su_conv回调函数void *appdata_ptr 指针

int retval = 100;

printf("uid: %d\n", getuid());

retval = pam_start("su","root",&conv,&pamh);

if(retval = PAM_SUCCESS)

//pam_get_item(pamh,PAM_USER,(const void **)&p);

pam_set_item(pamh,PAM_CONV, getlogin());

mytty = ttyname(STDERR_FILENO);

if (!mytty)

mytty = "tty";

pam_set_item(pamh,PAM_TTY, mytty);

retval = pam_authenticate(pamh,PAM_SILENT);

printf("return code: %d\n", retval);

if(retval != PAM_SUCCESS)

{

printf("invalid password\n");

return -1;

}

retval = pam_end(pamh,PAM_SUCCESS);

printf("uid: %d\n", getuid());

setuid(0);

printf("uid: %d\n", getuid());

printf("the retval is now %d",retval);

return 0;

}

int su_conv(int num_msg, const struct pam_message **msgm,

struct pam_response **response, void *appdata_ptr)

{

char *rec;

struct pam_message *m = (struct pam_message *)*msgm;

struct pam_response *r;

while(num_msg--)

{

switch(m->msg_style)

{

case PAM_PROMPT_ECHO_OFF:

// r->resp = strdup(getpass(m->msg));

r = (struct pam_response *)malloc(sizeof(struct pam_response));

r->resp = (char *)malloc(100);

r->resp_retcode = 0;

strcpy(r->resp, appdata_ptr);

*response = r;

break;

case PAM_PROMPT_ECHO_ON:

//r->resp = (char *)getpass(m->msg);

//fprintf(stdout,"%s",m->msg);

r->resp = malloc(PAM_MAX_RESP_SIZE);

fgets(r->resp,PAM_MAX_RESP_SIZE,stdin);

//gets(rec);

break;

case PAM_ERROR_MSG:

(void)fputs(m->msg,stdout);

break;

case PAM_TEXT_INFO:

fprintf(stdout,"%s\n",m->msg);

break;

default:

break;

}

}

return PAM_SUCCESS;

}