In this lesson, you will learn how to isolate SSH authentication logic from local console login requirements by utilizing PAM service-specific configuration files.
By default, many Linux distributions include generic rules in /etc/pam.d/common-auth that apply to every service requesting authentication, from local virtual terminals (TTYs) to remote SSH sessions. This "one-size-fits-all" approach is often insecure because it treats a physical console login the same as a remote network request. To tighten security, we can decouple these paths.
Isolating the SSH PAM Stack
When the OpenSSH daemon (sshd) initiates authentication, it references the /etc/pam.d/sshd configuration file. Instead of relying solely on common-* include files that govern local login, you can define specific security policies strictly for network access.
For example, if you want to mandate a specific security requirement—such as restricting SSH access to users within a specific group or requiring an additional check—you can modify /etc/pam.d/sshd directly without impacting your ability to log in at the local console.
Consider this modification to /etc/pam.d/sshd:
# /etc/pam.d/sshd
# Skip common-auth and apply strict logic only for SSH
auth required pam_listfile.so item=group sense=allow file=/etc/ssh/allowed_groups onerr=fail
@include common-account
@include common-session
In this example, the pam_listfile module is inserted only into the SSH stack. If a user tries to connect via SSH, they must belong to a group listed in /etc/ssh/allowed_groups. Because we did not add this to the global common-auth stack, the physical console remains unaffected, allowing administrators to maintain emergency local access even if the remote group-check fails or if the network authentication service is misconfigured.
By targeting /etc/pam.d/sshd specifically, you prevent "policy creep," where security changes intended for remote access accidentally break local system maintenance or console-based recovery procedures.
Key Takeaway: By modifying service-specific files in /etc/pam.d/ rather than shared common-* files, you can enforce strict, high-security authentication requirements for SSH while maintaining independent, reliable access policies for local console logins.