PAM abuse, password cracking, and SSH credential theft are related but distinct. A malicious change to Pluggable Authentication Modules (PAM) can capture credentials entered during authentication or make authentication accept unauthorized values. Password cracking, by contrast, attempts to recover a password from material already obtained, such as a hash. SSH credentials can also be stolen through routes that do not involve PAM or password cracking.
What PAM does—and what an attacker can change
PAM is a modular authentication framework: configuration files, libraries, and executable components determine how applications handle authentication. On Linux, the pam_unix.so module commonly retrieves, sets, and verifies account authentication information associated with /etc/passwd and /etc/shadow. MITRE ATT&CK describes PAM modification as a way to harvest credentials or alter authentication so attacker-supplied values are accepted.
As an Amazon Associate I earn from qualifying purchases.
That means PAM abuse can happen at the authentication layer. A compromised or malicious component might capture a password as it is entered, or create an authentication bypass. Neither outcome necessarily requires cracking a password hash. PAM configuration and module locations vary by platform, so the exact files and controls to protect depend on the system.
How the credential-access methods differ
| Method | What the attacker targets | Where the attempt happens | Key distinction |
|---|---|---|---|
| PAM modification | Authentication modules or their configuration | On the system handling authentication | Can capture submitted credentials or alter authentication behavior; modifying PAM components generally requires the ability to change protected system files. |
| Password cracking | Obtained password hashes or other credential material | Often offline, against acquired material | Attempts to recover a usable password from material already in hand. MITRE identifies hashes in /etc/shadow as a potential target. MITRE ATT&CK: Credential Access |
| Password guessing | A live account or service login | Online, through authentication attempts | Tries passwords against a login without prior knowledge of the correct password; it is not the same as cracking an acquired hash. MITRE ATT&CK: Credential Access |
| SSH private-key passphrase attack | An acquired, passphrase-protected private key | Offline, against the key’s passphrase protection | Targets the passphrase protecting a private key, not an SSH account password captured through PAM. MITRE ATT&CK: Private Keys |
| Credential API hooking | Input handled by credential-related system functions | On the system processing the input | Can capture credentials through function hooking, including SSH/SCP input handling; this is separate from changing PAM. MITRE ATT&CK: Credential API Hooking |
How PAM abuse can expose SSH credentials
When SSH authentication relies on PAM, a malicious PAM component may be positioned to observe or manipulate authentication. If it captures a password during a login, the attacker may then try that credential elsewhere or use it to access an account, depending on the system and account controls. If the component changes the authentication decision, it may enable access without recovering the user’s password at all.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
These are possibilities, not proof that every SSH password theft involves PAM. SSH credentials can be exposed through other mechanisms, and SSH private keys are a different credential type from account passwords. MITRE separately documents credential API hooking that can capture SSH/SCP input, as well as offline passphrase attacks against acquired private keys.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What defenders should monitor
Focus monitoring on unauthorized changes to PAM configuration and module files, then correlate those changes with authentication activity. A file change on its own does not prove compromise, and telemetry availability depends on the operating system, audit configuration, and log collection in place.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
- Watch PAM files and module locations: Alert on unexpected changes, especially changes made by accounts or processes that should not manage authentication components.
- Correlate changes with logons: Investigate unusual authentication after a PAM change, including unexpected access times, simultaneous sessions, or logons that do not fit the account’s normal context.
- Review authentication telemetry: Depending on the system’s audit setup, useful events can include PAM authentication activity,
pam_authenticateandsshdaudit events, SSH authentication, and use of previously unseen credentials or keys. MITRE ATT&CK lists these as relevant authentication data. - Investigate sequences, not isolated clues: A new key, an unusual login, or a file modification is more informative when tied to related changes and activity. MITRE’s PAM detection strategy recommends monitoring module and configuration changes alongside unusual logon patterns.
How to reduce the risk
- Restrict who can modify PAM components. Limit privileged access and protect authentication files and modules from unnecessary write access.
- Use multi-factor authentication where supported. MITRE identifies MFA integration as a mitigation for malicious PAM modification, though the protection depends on how authentication is configured and enforced.
- Protect SSH private keys separately. Use strong passphrases for private keys and appropriate file permissions. A passphrase protects an acquired key against use, but does not prevent theft of the key itself.
- Make monitoring fit the deployment. Confirm which PAM paths and authentication events exist on each platform, ensure relevant audit data is collected, and establish a baseline for expected changes and logons.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
