1 <?xml version="1.0" encoding='UTF-8'?>
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
3 "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
5 <refentry id="pam_unix">
8 <refentrytitle>pam_unix</refentrytitle>
9 <manvolnum>8</manvolnum>
10 <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo>
13 <refnamediv id="pam_unix-name">
14 <refname>pam_unix</refname>
15 <refpurpose>Module for traditional password authentication</refpurpose>
19 <cmdsynopsis id="pam_unix-cmdsynopsis">
20 <command>pam_unix.so</command>
27 <refsect1 id="pam_unix-description">
29 <title>DESCRIPTION</title>
32 This is the standard Unix authentication module. It uses standard
33 calls from the system's libraries to retrieve and set account
34 information as well as authentication. Usually this is obtained
35 from the /etc/passwd and the /etc/shadow file as well if shadow is
40 The account component performs the task of establishing the status
41 of the user's account and password based on the following
42 <emphasis>shadow</emphasis> elements: expire, last_change, max_change,
43 min_change, warn_change. In the case of the latter, it may offer advice
44 to the user on changing their password or, through the
45 <emphasis remap='B'>PAM_AUTHTOKEN_REQD</emphasis> return, delay
46 giving service to the user until they have established a new password.
47 The entries listed above are documented in the <citerefentry>
48 <refentrytitle>shadow</refentrytitle><manvolnum>5</manvolnum>
49 </citerefentry> manual page. Should the user's record not contain
50 one or more of these entries, the corresponding
51 <emphasis>shadow</emphasis> check is not performed.
55 The authentication component performs the task of checking the
56 users credentials (password). The default action of this module
57 is to not permit the user access to a service if their official
62 A helper binary, <citerefentry>
63 <refentrytitle>unix_chkpwd</refentrytitle><manvolnum>8</manvolnum>
64 </citerefentry>, is provided
65 to check the user's password when it is stored in a read
66 protected database. This binary is very simple and will only
67 check the password of the user invoking it. It is called
68 transparently on behalf of the user by the authenticating
69 component of this module. In this way it is possible
70 for applications like <command>xlock</command> to work without
71 being setuid-root. The module, by default, will temporarily turn
72 off SIGCHLD handling for the duration of execution of the helper
73 binary. This is generally the right thing to do, as many applications
74 are not prepared to handle this signal from a child they didn't know
75 was <function>fork()</function>d. The <option>noreap</option> module
76 argument can be used to suppress this temporary shielding and may be
77 needed for use with certain applications.
81 The password component of this module performs the task of updating
86 The session component of this module logs when a user logins
91 Remaining arguments, supported by others functions of this
92 module, are silently ignored. Other arguments are logged as
93 errors through <citerefentry>
94 <refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum>
99 <refsect1 id="pam_unix-options">
101 <title>OPTIONS</title>
105 <option>debug</option>
109 Turns on debugging via
111 <refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum>
119 <option>audit</option>
123 A little more extreme than debug.
130 <option>nullok</option>
134 The default action of this module is to not permit the
135 user access to a service if their official password is blank.
136 The <option>nullok</option> argument overrides this default.
142 <option>try_first_pass</option>
146 Before prompting the user for their password, the module first
147 tries the previous stacked module's password in case that
148 satisfies this module as well.
154 <option>use_first_pass</option>
158 The argument <option>use_first_pass</option> forces the module
159 to use a previous stacked modules password and will never prompt
160 the user - if no password is available or the password is not
161 appropriate, the user will be denied access.
167 <option>nodelay</option>
171 This argument can be used to discourage the authentication
172 component from requesting a delay should the authentication
173 as a whole fail. The default action is for the module to
174 request a delay-on-failure of the order of two second.
180 <option>use_authtok</option>
184 When password changing enforce the module to set the new
185 password to the one provided by a previously stacked
186 <option>password</option> module (this is used in the
187 example of the stacking of the <command>pam_cracklib</command>
188 module documented above).
194 <option>not_set_pass</option>
198 This argument is used to inform the module that it is not to
199 pay attention to/make available the old or new passwords from/to
200 other (stacked) password modules.
210 NIS RPC is used for setting new passwords.
216 <option>remember=<replaceable>n</replaceable></option>
220 The last <replaceable>n</replaceable> passwords for each
221 user are saved in <filename>/etc/security/opasswd</filename>
222 in order to force password change history and keep the user
223 from alternating between the same password too frequently.
229 <option>shadow</option>
233 Try to maintain a shadow based system.
243 When a user changes their password next, encrypt
244 it with the MD5 algorithm.
250 <option>bigcrypt</option>
254 When a user changes their password next,
255 encrypt it with the DEC C2 algorithm.
261 <option>broken_shadow</option>
265 Ignore errors reading shadow inforation for
266 users in the account management module.
272 Invalid arguments are logged with <citerefentry>
273 <refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum>
278 <refsect1 id="pam_unix-services">
279 <title>MODULE SERVICES PROVIDED</title>
281 All service are supported.
285 <refsect1 id='pam_unix-return_values'>
286 <title>RETURN VALUES</title>
289 <term>PAM_IGNORE</term>
299 <refsect1 id='pam_unix-examples'>
300 <title>EXAMPLES</title>
302 An example usage for <filename>/etc/pam.d/login</filename>
305 # Authenticate the user
306 auth required pam_unix.so
307 # Ensure users account and password are still active
308 account required pam_unix.so
309 # Change the users password, but at first check the strength
310 # with pam_cracklib(8)
311 password required pam_cracklib.so retry=3 minlen=6 difok=3
312 password required pam_unix.so use_authtok nullok md5
313 session required pam_unix.so
318 <refsect1 id='pam_unix-see_also'>
319 <title>SEE ALSO</title>
322 <refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum>
325 <refentrytitle>pam.d</refentrytitle><manvolnum>8</manvolnum>
328 <refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum>
333 <refsect1 id='pam_unix-author'>
334 <title>AUTHOR</title>
336 pam_unix was written by various people.