The
pam.conf file specifies how Pluggable Authentication Modules (PAM) should operate. For an overview of the Pluggable Authentication Modules framework, see
pam(8).
PAM may be configured using a single
/etc/pam.conf configuration file or by using multiple configuration files, one for each PAM-aware service, located in the
/etc/pam.d/ directory. If
/etc/pam.d/ exists,
/etc/pam.conf will be ignored.
/etc/pam.d/ is the preferred method for configuring PAM.
PAM's configuration is based on “stacking” different modules together to form a processing chain for the task. A standard PAM configuration stanza is structured as follows:
[service-name] module-type control-flag module-name [options]
service-name is used only (and is mandatory) in
/etc/pam.conf. It specifies the PAM-aware service whose PAM behavior is being configured. When
/etc/pam.d/ is used, the name of the configuration file specifies the service.
module-type specifies which of the four classes of PAM module functionality is being configured. These four classes are
account (account management),
auth (authentication),
password (password management), and
session (session management).
control-flag specifies the behavior of the processing chain upon success or failure of the PAM module's authentication task. The following are valid values for
control-flag:
binding
If the module succeeds and no earlier module in the chain has failed, the chain is immediately terminated and the request is granted. If the module fails, the rest of the chain is executed, but the request is ultimately denied.
requisite
If the module returns success, continue to execute the processing chain. If the module fails, immediately return the error code from the first ‘required' failure.
required
If the module returns success, continue to execute the processing chain. If the module fails, record as a ‘required' failure and continue to execute the processing chain. If there are any ‘required' failures in the processing chain, the chain will ultimately return failure.
optional
If the module returns success, continue to execute the processing chain. If the module fails, record as an ‘optional' failure and continue to execute the processing chain.
sufficient
If the module returns success and there have been no recorded ‘required' failures, immediately return success without calling any subsequent modules in the processing chain. If the module fails, return as an ‘optional' failure and continue to execute the processing chain.
module-name specifies the module to execute for this stanza. This is either an absolute path name or a path name relative to the default module location:
/usr/lib/security.
options are additional options that may be specified for the module. Refer to the individual modules' documentation for more information on available options.
In addition to the standard configuration stanza format, there is an additional stanza format available when
/etc/pam.d/ is used:
module-type include service-name
This stanza format provides a simple inheritance model for processing chains.