Successful or Fail login process in Linux

-
When the Linux system boots up you get a console similar to below,
machine_name login:

This prompt is generated by a program called getty which is regenerated every time when an incorrect password is provided, by the init process which is again created by fork function.

NOTE: Fork is a function which creates a new process by duplicating the calling process. The new process, referred to as the child, is an exact duplicate of the calling process, referred to as the parent.


To be brief the Linux login works as per the below steps

  1. Getty process presents the login prompt to the user console
  2. Once the username is provided, the password is validated and if successful the user is allowed to login into the shell
  3. If there is a failure getty process is re-initiated by the fork function and the password prompt re-appears.
  4. The maximum number of failure attempts would be allowed as defined under the pam configuration.
  5. Eventually once the maximum no. of failure attempts is reached the gety process would be suspended for a timeout value as defined in pam configuration after which again the login prompt would appear starting from Step 1.

Now the above steps were explained only in relative to the process used and it functions. But there are alot of other things happening in the background so lets get a overview on those topics as well.

Below are the steps using which the login process can be summarized

Login Prompt

Getty Process
As soon as you reach the console you will get a login console which is presented to you by getty process as explained above where you need to put the username using which you will be login into your account.



iles checked
Once you enter the username below are few files which are checked w.r.t. the name provided which determines the next course of action.

Filename
Desciption
/etc/nologin
If this file exists and the user is not root then the contents of this file will be printed to the screen and the login is terminated.
/etc/usertty
If special access restrictions are specified for the user logging in in this file, the restrictions must be met or the log in will be denied and the program syslog will log the attempt.
/etc/issue
Next if any content has been stored inside this file is printed on the screen before the password prompt appears. This is basically a pre-login message and identification file.

Now if the above conditions are met you will get a successful password prompt

Password Prompt

Next you get the prompt as shown below where you provide the password for your username(which is hidden as you type).

But how does the system verifies if the password provided is correct or incorrect?


If you recall there are two files which stores information about each user's password i.e. /etc/passwd and/etc/shadow, so the password is verified as per the username provided  from the password section inside /etc/passwd and /etc/shadow file.

From here there are two possibilities whether the password provided is correct or incorrect so we will look into both the scenarios

Password Incorrect
  • If the provided pasword is incorrect the getty process will be re-initiated again prompting for the password.
  • This will continue till you reach maximum allowed failed attempts of login as defined under the below mentioned files, a login failure message will be reported in syslog facility.
/etc/pam.d/login,
/etc/pam.d/system-auth
/etc/pam.d/sshd (if logging in through ssh)
  • Once the maximum no. of failed attempts is reached the login process is suspended for a timeout value again as defined in /etc/pam.d/system-auth file.
  • In this period you won't be allowed to make another attempt of login. Once the timeout value is finished again you will get a login prompt where you will have to give your username.

Password Correct
  • The password provided is verified with respect to the encrypted password as present in /etc/shadow.
  • Also other password aging factors are verified in case the password is expired or locked using the same file as well as /etc/passwd.
  • If the provided password ad all other required parameters are correct the getty process will next check for all other functions of the user profile as provided under /etc/passwd and /etc/shadow
At this point the login program would perform the below task
  • Setting up UID and GID
  • The HOME, PATH, SHELL, TERM, MAIL, and LOGNAME environment variables are set.
  • Setting up environment variables as defined under user's login shell i.e. ~/.bash_profile for /bin/bash shell
  • The users shell is started. The shell is specified in the file "/etc/passwd" 
NOTE: If the user has /sbin/nologin or any other shell restricting his/her login access then the below steps would not be executed and the user login process would be terminated here itself.
  • If the file "~/.hushlogin" exists in the user's home directory then a "quiet" login is performed which disables checking of mail and the printing of the last login time and the message of the day.
  • Otherwise if the file "/var/log/lastlog" exists the last login time is printed and then the current login is recorded in this file.
  • Next in case you have added any content to /etc/motd file then that will echoed to the screen. After which you will get you login console in your home directory as specified by user's HOMEvariable.
  • Another function that login will perform is to update the user accounting login files which are "/var/run/utmp" and "/var/log/wtmp" which hold information about the amount of time users have been on the system along with when they logged on and off.
Files used by the login program

Filename
Description
/etc/nologin
This file is used to prevent users from logging into the system.
/etc/securetty
Controls the terminals that the root user can login on
~/.hushlogin
When this file exists in the user's home directory, it will prevent check for mail, printing of the last login time, and the message of the day when the user logs in.
/var/log/lastlog
Contains information about the last time a login was done on the system.
/etc/passwd
Contains information about the user including the ID, name, home directory, and the path to the preferred shell program.

I would appreciate your feedback in case I missed something or you would like to update my content, do notify me through the below comment box.


Comments

Post a Comment

Popular posts from this blog

Python reference Interview questions

-
1)HCL Python scripting developer Interview questions:- 1) How do you check list of files in the given path in python ?? 2) How do you check whether file is exist or not in python 3) How do you perform copy file cmd in python ?? 4) What is d use of setup.py in python 5) What is d use of __init__=__main__: condition in python?? 6) What is d type of *args and **kargs ?? 7) sys.path use in python ??   2) CES Limited Python developer Interview Face2Face Interview questions:- 1.Basic questions on oops:   *.Implement Base class using Instance, static and Abstract method     instance method - takes two arguments to add operation     static method - takes two args to multiply operation     abstract method - takes two args to div operation   *. Implement child class using 3 instance methods     instance - takes three args for add operation     instance - takes two args for...
Read more

[SOLVED]* Please wait for the system Event Notification service

-
Image
There are different ways to solve this issue , Few of them are mentioned below .A permanent fix for this issue is yet to find. Solution : 1 Remove "Windows Live Messenger" from their terminal server resolved logout issues. Solution : 2 Start "Remote Desktop Services Manager" Identify the user ID in the Users tab In the Processes tab sort by ID Go down to the user ID and end the winlogon.exe process the user session will be logged off Solution : 3 From: mikefrobbins.com by graham ross From a command prompt on my PC or another computer on the domain I ran this to find out the PID of the svchost.exe associated with SENS sc \servername queryex SENS Note down the PID of that process and kill that process using PID. taskkill /S servername /PID xxxx /F Solution: 4 From : Windows Sever Forum The COM+ Event System timed out attempting to fire the Logoff method on event class {D5978650-5B9F-11D1-8DD2-00AA004ABD5E} for publisher and subscriber . The subscriber failed ...
Read more

Rebuild the initial ramdisk image in Red Hat Enterprise Linux

-
How to rebuild the initial ramdisk image in Red Hat Enterprise Linux  SOLUTION VERIFIED  - Updated  April 12 2016 at 10:15 AM  -  English  Environment Red Hat Enterprise Linux (RHEL) 3 Red Hat Enterprise Linux (RHEL) 4 Red Hat Enterprise Linux (RHEL) 5 Red Hat Enterprise Linux (RHEL) 6 Red Hat Enterprise Linux (RHEL) 7 initrd / initramfs image Issue How to rebuild the initial ramdisk image in Red Hat Enterprise Linux How to remake or recreate the initrd or initramfs The  /etc/lvm/lvm.conf  and root file system resides on a logical volume. How to ensure the changes are applied upon rebooting? The  /etc/multipath.conf  and my root file system resides on a multipath device. How to ensure the changes are applied upon rebooting? The module options in  /etc/modprobe.conf  or  /etc/modprobe.d/  have been modified. How to ensure the changes are applied upon rebooting? Resolution When adding new ha...
Read more