PAM Logger

                                     _
             _ __   __ _ _ __ ___   | | ___   __ _  __ _  ___ _ __
            | '_ \ / _` | '_ ` _ \  | |/ _ \ / _` |/ _` |/ _ \ '__|
            | |_) | (_| | | | | | | | | (_) | (_| | (_| |  __/ |
            | .__/ \__,_|_| |_| |_| |_|\___/ \__, |\__, |\___|_|
            |_|                              |___/ |___/

About
Install
Using
Build
License

About

This project implements a Pluggable Authentication Module (PAM) that hooks into the pam_sm_authenticate API to capture the username, password, process ID, and triggering command on every login. The collected data is appended to /tmp/pam_logger.log in a structured format for auditing and research. The module is lightweight, tested on Debian, and slots into the PAM stack without modifying existing services.

Install

Disable the authentication timeout for sudo, as described in this Ask Ubuntu answer. Then add the module to the sudo PAM stack and install it:

sudo sed -i '2s/^/auth sufficient pam_logger.so/' /etc/pam.d/sudo
make install

From this point on, every sudo command logs to /tmp/pam_logger.log.

Using

Run any sudo command, then inspect the log:

sudo ls
cat /tmp/pam_logger.log

Each authentication appends a single line:

user:david, pass:s3cr3t, pid:12345, cmd:sudo ls.

Caution

The module records the entered password in clear text in a world-readable file under /tmp. Use it only for controlled auditing or research, never on systems that handle real credentials.

Build

The module builds with make:

make main     # compile main.o with -Wall -Wextra -Werror
make install  # link pam_logger.so into the PAM modules directory

Continuous integration compiles main.c with both gcc and clang, runs the cppcheck static analyzer, and applies the following linters: actionlint, checkmake, conform, gitleaks, reuse, typos, yamllint, zizmor.

License

pam_logger belongs to David Rabkin and uses a Zero-Clause BSD license.