View source for BSD Authentication

'''BSD Authentication''', otherwise known as '''BSD Auth''', is an [[authentication]] [[software framework|framework]] and [[software]] [[API]] employed by [[OpenBSD]] and accompanying software such as [[OpenSSH]]. It originated with [[BSD/OS]], and although the specification and implementation were donated to the [[FreeBSD]] project by [[BSDi]], OpenBSD chose to adopt the framework in release 2.9. [[Pluggable Authentication Modules]] (PAM) serves a similar purpose on other operating systems such as [[Linux]], [[FreeBSD]] and [[NetBSD]].

BSD Auth performs authentication by executing scripts or programs as separate [[Process (computing)|process]]es from the one requiring the authentication. This prevents the child authentication process from interfering with the parent except through a narrowly defined [[inter-process communication]] API, a technique inspired by the [[principle of least privilege]] and known as [[privilege separation]]. This behaviour has significant security benefits, notably improved [[fail-safe]]ness of software, and robustness against malicious and accidental [[software bug]]s.<ref name="privsep">{{cite conference |author=[[Niels Provos]] |author2=Markus Friedl |author3=Peter Honeyman | date = 2003 | url = http://www.usenix.org/events/sec03/tech/provos_et_al.html | title = Preventing Privilege Escalation | book-title = Proceedings of the 12th USENIX Security Symposium | pages = 231–242}}</ref>

== See also ==
* [[Name Service Switch]]

== References ==
{{reflist}}

== External links ==
*{{man|3|authenticate|OpenBSD|simplified interface to the BSD Authentication system}}
*{{man|3|auth_subr|OpenBSD|interface to the BSD Authentication system}}

{{Authentication APIs}}

[[Category:Berkeley Software Distribution]]
[[Category:Computer access control frameworks]]
[[Category:Unix authentication-related software]]


{{Compu-library-stub}}
{{Unix-stub}}