in reply to Authen PAM security question

I am planning to use the below the Authen PAM script( Example from the CPAN site) from mod_perl

Will the username,password we supply can be monitored on the server using ps -ef command?

Via ps - but not necessarily with the -ef options, more likely with ps axe (BSD style) - they will only be visible if they are exported into the environment (i.e. somehow accessible inside the perl script through the %ENV hash). But there are other methods to intercept them on a server, e.g. sniffing the network or tracing the apache process.

update - be aware also, that changing authentication tokens will only succeed if the process doing that runs under UID 0, that is, as root.

--shmem

_($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                              /\_¯/(q    /
----------------------------  \__(m.====·.(_("always off the crowd"))."·
");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}

Replies are listed 'Best First'.
Re^2: Authen PAM security question
by Anonymous Monk on Apr 11, 2007 at 13:48 UTC
    Thanks a lot for the reply