{"id":36535,"date":"2019-10-31T22:12:11","date_gmt":"2019-10-31T19:12:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\/"},"modified":"2019-10-31T22:12:11","modified_gmt":"2019-10-31T19:12:11","slug":"kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","title":{"rendered":"How to Use PAM Modules for Local Authentication in Linux Using GOST-2012 Keys on a Rutoken","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"How to Use PAM Modules for Local Authentication in Linux Using GOST-2012 Keys on a Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/e6656d4db027ab2705550726d5ab1908.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSimple passwords offer no protection, while complex ones are difficult to remember. That's why they often end up on a sticky note under the keyboard or on the monitor. To help forgetful users remember their passwords while maintaining security, two-factor authentication (2FA) is available.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>By combining ownership of a device with knowledge of its PIN code, the PIN can be simpler and easier to memorize. Any shortcomings in the length or randomness of the PIN are mitigated by the requirement for physical possession and restrictions on PIN cracking. <\/p>\n<p>Moreover, government institutions often prefer compliance with GOST standards. This discussion will focus on a 2FA option for logging into Linux. I'll start from the beginning.<\/p>\n<h1>PAM Modules<\/h1>\n<p>\nPluggable Authentication Modules (PAM) are modules with a standard API that implement various authentication mechanisms in applications. <br \/>\nAll utilities and applications that can work with PAM adopt them and may use them for user authentication.<br \/>\nIn practice, it works roughly like this: the login command interacts with PAM, which performs all necessary checks using the modules specified in the configuration file and returns the results back to the login command.<\/p>\n<h2>librtpam<\/h2>\n<p>\nThe module developed by Aktiv adds two-factor authentication for users through smart cards or USB tokens using asymmetric keys in accordance with the latest domestic cryptography standards. <\/p>\n<p>Let\u2019s examine how it works:<\/p>\n<ul>\n<li>the token stores the user's certificate and private key;<\/li>\n<li>the certificate is stored in the user's home directory as trusted.<\/li>\n<\/ul>\n<p>The authentication process occurs as follows:<\/p>\n<ol>\n<li>The Rutoken searches for the user's personal certificate.<\/li>\n<li>The token's PIN code is requested.<\/li>\n<li>Random data is signed with the private key directly in the Rutoken chip.<\/li>\n<li>The resulting signature is verified using the public key from the user's certificate.<\/li>\n<li>The module returns the verification result to the calling application.<\/li>\n<\/ol>\n<p>Authentication can occur using GOST R 34.10-2012 keys (with lengths of 256 or 512 bits) or the obsolete GOST R 34.10-2001. <\/p>\n<p>You don't have to worry about the security of the keys \u2013 they are generated directly in the Rutoken and never leave its memory during cryptographic operations.<\/p>\n<p><img decoding=\"async\" alt=\"How to Use PAM Modules for Local Authentication in Linux Using GOST-2012 Keys on a Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/61047962c9aee308d69553201e05203d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRutoken ECP 2.0 is certified by the FSB and FSTEC according to NDV 4, so it can be used in information systems that process confidential information. <\/p>\n<h2>Practical Use<\/h2>\n<p>\nAlmost any modern Linux will do, for example, we will use xUbuntu 18.10.<\/p>\n<h3>1) Install the required packages<\/h3>\n<p>\n<code>sudo apt-get install libccid pcscd opensc<\/code><br \/>\nIf you want to add a screen saver to lock the desktop, additionally install the package <code>libpam-pkcs11<\/code>.<\/p>\n<h3>2) Add the PAM module with GOST support<\/h3>\n<p>\nLoad the library from <noindex><a rel=\"nofollow\" href=\"https:\/\/download.rutoken.ru\/Rutoken\/PAM\/\">https:\/\/download.rutoken.ru\/Rutoken\/PAM\/<\/a><\/noindex><br \/>\nCopy the contents of the PAM folder librtpam.so.1.0.0 to the system folder<br \/>\n<code>\/usr\/lib\/<\/code> or <code>\/usr\/lib\/x86_64-linux-gnu\/<\/code>or <code>\/usr\/lib64<\/code><\/p>\n<h3>3) Install the package with librtpkcs11ecp.so<\/h3>\n<p>\nDownload and install the DEB or RPM package from the link: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rutoken.ru\/support\/download\/pkcs\/\">https:\/\/www.rutoken.ru\/support\/download\/pkcs\/<\/a><\/noindex><\/p>\n<h3>4) Check that Rutoken ECP 2.0 works in the system<\/h3>\n<p>\nExecute in the terminal<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -T<\/code><br \/>\nIf you see the line <code>Rutoken ECP<\/code> \u2013 then everything is fine.<\/p>\n<h3>5) Read the certificate<\/h3>\n<p>\nCheck that the device has a certificate<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -O<\/code><br \/>\nIf the following line appears:<br \/>\n<code>Using slot 0 with a present token (0x0)<\/code><\/p>\n<ul>\n<li><b>and information about keys and certificates is displayed, then you need to read the certificate and save it to disk. To do this, execute the following command, where instead of {id}, you should substitute the ID of the certificate you saw in the output of the previous command:<\/b> $ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -r -y cert --id {id} --output-file cert.crt<br \/>\n<code>If the file cert.crt is created, proceed to step 6).<\/code><br \/>\n nothing<\/li>\n<li><b>, then the device is empty. Contact the administrator or create the keys and certificate yourself by following the next step.<\/b>5.1) Create a test certificate<\/li>\n<\/ul>\n<h4>Attention! The methods described for creating keys and certificates are suitable for testing and are not intended for use in operational mode. For this, you need to use keys and certificates issued by a trusted certification authority of your organization or an accredited certifying center.<\/h4>\n<p><\/p>\n<blockquote><p>Attention! The methods described for creating keys and certificates are suitable for testing and are not intended for production use. For this, you need to use keys and certificates issued by a trusted certification authority of your organization or an accredited certificate authority.<br \/>\nThe PAM module is designed to protect local computers and is intended for use in small organizations. Since there are few users, the Administrator can monitor certificate revocation and manually block accounts, as well as manage certificate expiration. The PAM module currently does not support checking certificates against CRLs or building trust chains.<\/p><\/blockquote>\n<h4>A simple way (via the browser)<\/h4>\n<p>\nTo obtain a test certificate, use <noindex><a rel=\"nofollow\" href=\"https:\/\/ra.rutoken.ru\/\">the web service \"Rutoken Registration Center\"<\/a><\/noindex>. The process will take no more than 5 minutes.<\/p>\n<h4>The geek way (via the console and possibly the compiler)<\/h4>\n<p>\n<b>Check the version of OpenSC <\/b><br \/>\n<code>$ opensc-tool --version<\/code><br \/>\nIf the version is less than 0.20, update or build <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/AktivCo\/OpenSC\/tree\/gostr3410-2012\/\">the pkcs11-tool branch with GOST-2012 support<\/a><\/noindex> from our GitHub (as of the publication of this article, release 0.20 has not yet been released) or from the master branch of the main OpenSC project no later than <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OpenSC\/OpenSC\/tree\/8cf1e6f769b36bdcadc3958574305b90e88c816d\">commit 8cf1e6f<\/a><\/noindex><\/p>\n<p>Generate a key pair with the parameters:<br \/>\n<code>--key-type: GOSTR3410-2012-512:A (GOST-2012 512 bits with parameter set A), GOSTR3410-2012-256:A (GOST-2012 256 bits with parameter set A)<\/code><\/p>\n<p><code>--id: <\/code> object identifier (CKA_ID) in the form of two-digit hex numbers from the ASCII table. Use only ASCII codes of printable characters since the id will need to be passed to OpenSSL as a string. For example, the ASCII code \"3132\" corresponds to the string \"12\". <b> For convenience, you can use <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapidtables.com\/convert\/number\/ascii-to-hex.html\">an online service for converting strings to ASCII codes<\/a><\/noindex><\/b>.<\/p>\n<p><code>$ .\/pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so --keypairgen --key-type GOSTR3410-2012-512:A -l --id 3132<\/code><\/p>\n<p>Next, we will create a certificate. Below, two paths will be described: the first through a CA (we will use test CAs), the second \u2013 self-signed. For this, you first need to install and configure OpenSSL version 1.1 or newer to work with Rutoken through the special rtengine module using the guide <noindex><a rel=\"nofollow\" href=\"https:\/\/dev.rutoken.ru\/display\/PUB\/%D0%A3%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D0%BA%D0%B0+%D0%B8+%D0%BD%D0%B0%D1%81%D1%82%D1%80%D0%BE%D0%B9%D0%BA%D0%B0+OpenSSL\">Installing and configuring OpenSSL<\/a><\/noindex>.<br \/>\nFor example: for '-<code>-id 3132<\/code>In OpenSSL, you need to specify \u201c<code>pkcs11:id=12<\/code>&#171;. <\/p>\n<p>You can use the services of a test CA, many of which exist, for example, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cryptopro.ru\/solutions\/test-ca\">here<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"http:\/\/testcert.infotecs.ru\/\">here <\/a><\/noindex>and <noindex><a rel=\"nofollow\" href=\"http:\/\/soft.lissi.ru\/services\/test_ca\/\">here<\/a><\/noindex>, for this, let's create a certificate request<\/p>\n<p>Another option is to give in to laziness and create a self-signed one.<br \/>\n<code>$ openssl req -utf8 <b>-new<\/b> -keyform engine -key \"pkcs11:id=12\" -engine rtengine -out req.csr<\/code><\/p>\n<p>Upload the certificate to the device<br \/>\n<code>$ openssl req -utf8 <b>-x509<\/b> -keyform engine -key \"pkcs11:id=12\" -engine rtengine -out cert.cer<\/code><\/p>\n<h3>6) Register the certificate in the system<\/h3>\n<p>\nMake sure your certificate looks like a base64 file:<\/p>\n<p><img decoding=\"async\" alt=\"How to Use PAM Modules for Local Authentication in Linux Using GOST-2012 Keys on a Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/83a7e25541041d02365141e682bd4635.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIf your certificate looks like this:<\/p>\n<p><img decoding=\"async\" alt=\"How to Use PAM Modules for Local Authentication in Linux Using GOST-2012 Keys on a Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/f385e4e288a49acfb2c54be4c24749e7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nthen you need to convert the certificate from DER format to PEM format (base64)<\/p>\n<p><code>$ openssl x509 -in cert.crt -out cert.pem -inform DER -outform PEM<\/code><br \/>\nCheck again to ensure everything is now in order.<\/p>\n<p>Adding the certificate to the list of trusted certificates<br \/>\n<code>$ mkdir ~\/.eid<br \/>\n$ chmod 0755 ~\/.eid<br \/>\n$ cat cert.pem &gt;&gt; ~\/.eid\/authorized_certificates<br \/>\n$ chmod 0644 ~\/.eid\/authorized_certificates<\/code><br \/>\nThe last line protects the list of trusted certificates from accidental or intentional changes by other users. This prevents someone from adding their certificate here and being able to log in as you.<\/p>\n<h3>7) Configuring authentication <\/h3>\n<p>\nSetting up our PAM module is entirely standard and is done exactly the same way as the setup of other modules. Create a file <code>\/usr\/share\/pam-configs\/rutoken-gost-pam<\/code> containing the full name of the module, whether it is enabled by default, the module's priority, and the authentication parameters.<br \/>\nThe authentication parameters have requirements for a successful operation:<\/p>\n<ul>\n<li>required: such modules must return a positive response. If the result of the module call contains a negative response, it will lead to an authentication error. The request will be dropped, but the remaining modules will be called.<\/li>\n<li>requisite: similar to required, but it immediately leads to an authentication failure and ignores the remaining modules.<\/li>\n<li>sufficient: if no required or sufficient modules before it returned a negative result, then the module will return a positive response. The remaining modules will be ignored.<\/li>\n<li>optional: if there are no required modules in the stack and none of the sufficient modules returned a positive result, then at least one of the optional modules must return a positive response.<\/li>\n<\/ul>\n<p>\nThe full content of the file <code>\/usr\/share\/pam-configs\/rutoken-gost-pam<\/code>:<br \/>\n<code>Name: Rutoken PAM GOST<br \/>\nDefault: yes<br \/>\nPriority: 800<br \/>\nAuth-Type: Primary<br \/>\nAuth: sufficient \/usr\/lib\/librtpam.so.1.0.0 \/usr\/lib\/librtpkcs11ecp.so<\/code><\/p>\n<p><img decoding=\"async\" alt=\"How to Use PAM Modules for Local Authentication in Linux Using GOST-2012 Keys on a Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/804bd960918413e2134617b2ce31f0af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nsave the file, after which we execute<br \/>\n<code>$ sudo pam-auth-update<\/code><br \/>\nin the window that appears, place a star next to <b>Rutoken PAM GOST<\/b> and click <b>OK<\/b><\/p>\n<p><img decoding=\"async\" alt=\"How to Use PAM Modules for Local Authentication in Linux Using GOST-2012 Keys on a Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/2fb2e020c943ef3a22f09985a939a1c9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>8) Check the configuration <\/h3>\n<p>\nTo understand that everything is set up correctly and not lose the ability to log in, enter the command<br \/>\n<code>$ sudo login<\/code><br \/>\nEnter the username. Everything is set up correctly if the system prompts for the device's PIN code.<\/p>\n<p><img decoding=\"async\" alt=\"How to Use PAM Modules for Local Authentication in Linux Using GOST-2012 Keys on a Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/2501ca77a0c881ebb9fe588031a2c8ef.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>9) Configure computer lock when the token is removed<\/h3>\n<p>\nThe package includes the utility <code>libpam-pkcs11<\/code> pkcs11_eventmgr, <code>which allows various actions to be performed when PKCS#11 events occur.<\/code> For configuration,<br \/>\npkcs11_eventmgr <code>serves the configuration file:<\/code> For various Linux distributions, the command that invokes the account lock when smart cards or tokens are removed will differ. See <code>\/etc\/pam_pkcs11\/pkcs11_eventmgr.conf<\/code><br \/>\n<i>event card_remove <code>An example of the configuration file is presented below:<\/code>.<\/i><br \/>\nAn example configuration file is shown below:<\/p>\n<pre><code class=\"xml\">pkcs11_eventmgr\n{\n    # Run in background\n    daemon = true;\n     \n    # Set debug messages\n    debug = false;\n \n    # Polling time in seconds\n    polling_time = 1;\n \n    # Set timeout for card removal\n    # Default 0\n    expire_time = 0;\n \n    # Select pkcs11 library for working with Rutoken\n    pkcs11_module = usr\/lib\/librtpkcs11ecp.so;\n \n    # Actions with the card\n    # Card inserted:\n    event card_insert {\n        # Keep default values (do nothing)\n        on_error = ignore ;\n \n        action = \"\/bin\/false\";\n    }\n \n    # Card removed\n    event card_remove {\n        on_error = ignore;\n         \n        # Call the screen lock function\n        \n        # For GNOME \n        action = \"dbus-send --type=method_call --dest=org.gnome.ScreenSaver \/org\/gnome\/ScreenSaver org.gnome.ScreenSaver.Lock\";\n        \n        # For XFCE\n        # action = \"xflock4\";\n        \n        # For Astra Linux (FLY)\n        # action = \"fly-wmfunc FLYWM_LOCK\";\n    }\n \n    # Card has been removed for a long time\n    event expire_time {\n        # Keep default values (do nothing)\n        on_error = ignore;\n \n        action = \"\/bin\/false\";\n    }\n}<\/code><\/pre>\n<p>After that, add the application <code>serves the configuration file:<\/code> to the startup. To do this, edit the .bash_profile file:<br \/>\n<code>$ nano \/home\/\/.bash_profile<\/code><br \/>\nAdd the line pkcs11_eventmgr at the end of the file and reboot.<\/p>\n<p><b>The described steps for configuring the operating system can be used as a guide in any modern Linux distribution, including local ones. <\/b><\/p>\n<p><img decoding=\"async\" alt=\"How to Use PAM Modules for Local Authentication in Linux Using GOST-2012 Keys on a Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/ec235d0d0d50e23fbf09d4849d1fdd11.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Conclusion <\/h2>\n<p>\nLinux PCs are becoming increasingly popular in Russian government structures, and setting up reliable two-factor authentication on this OS is not always easy. We hope this guide helps solve the \"password problem\" and securely protect access to PCs without spending much time on it.<br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/aktiv-company\/blog\/461199\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0441\u0442\u044b\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043d\u0435 \u0437\u0430\u0449\u0438\u0449\u0430\u044e\u0442, \u0430 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u043e\u043c\u043d\u0438\u0442\u044c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u043d\u0438 \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0441\u0442\u0438\u043a\u0435\u0440\u0435 \u043f\u043e\u0434 \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043e\u0439 \u0438\u043b\u0438 \u043d\u0430 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0435. \u0427\u0442\u043e\u0431\u044b \u043f\u0430\u0440\u043e\u043b\u0438 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0433\u043e\u043b\u043e\u0432\u0430\u0445 \u201c\u0437\u0430\u0431\u044b\u0432\u0447\u0438\u0432\u044b\u0445\u201d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0435 \u0442\u0435\u0440\u044f\u043b\u0430\u0441\u044c \u2013 \u0435\u0441\u0442\u044c \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f (2\u0424\u0410). \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0438 \u0437\u043d\u0430\u043d\u0438\u044f \u0435\u0433\u043e PIN-\u043a\u043e\u0434\u0430, \u0441\u0430\u043c PIN-\u043a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435 \u0438 \u043b\u0435\u0433\u0447\u0435 \u0434\u043b\u044f \u0437\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27347,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36535","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PAM-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Linux \u043f\u043e \u043a\u043b\u044e\u0447\u0430\u043c \u0413\u041e\u0421\u0422-2012 \u043d\u0430 \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:12:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:12:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47How to use PAM modules for local authentication in Linux with GOST-2012 keys on Rutoken | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PAM-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Linux \u043f\u043e \u043a\u043b\u044e\u0447\u0430\u043c \u0413\u041e\u0421\u0422-2012 \u043d\u0430 \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u0435 | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:12:11+00:00","article:modified_time":"2019-10-31T19:12:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36535","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 03:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:43:32","updated":"2026-01-22 03:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/36535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=36535"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/36535\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/27347"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=36535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=36535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=36535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}