NAME
pam_unix - Module for traditional password authentication
SYNOPSIS
pam_unix.so [...]
DESCRIPTION
This is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and the /etc/shadow file as well if shadow is enabled.
The account component performs the task of establishing the status of the user's account and password based on the following shadow elements: expire, last_change, max_change, min_change, warn_change. In the case of the latter, it may offer advice to the user on changing their password or, through the PAM_AUTHTOKEN_REQD return, delay giving service to the user until they have established a new password. The entries listed above are documented in the shadow(5) manual page. Should the user's record not contain one or more of these entries, the corresponding shadow check is not performed.
The authentication component performs the task of checking the users credentials (password). The default action of this module is to not permit the user access to a service if their official password is blank.
A helper binary, unix_chkpwd(8), is provided to check the user's password when it is stored in a read protected database. This binary is very simple and will only check the password of the user invoking it. It is called transparently on behalf of the user by the authenticating component of this module. In this way it is possible for applications like xlock(1) to work without being setuid-root. The module, by default, will temporarily turn off SIGCHLD handling for the duration of execution of the helper binary. This is generally the right thing to do, as many applications are not prepared to handle this signal from a child they didn't know was fork()d. The noreap module argument can be used to suppress this temporary shielding and may be needed for use with certain applications.
The maximum length of a password supported by the pam_unix module via the helper binary is PAM_MAX_RESP_SIZE - currently 512 bytes. The rest of the password provided by the conversation function to the module will be ignored.
The password component of this module performs the task of updating the user's password. The default encryption hash is taken from the ENCRYPT_METHOD variable from /etc/login.defs
The session component of this module logs when a user logins or leave the system.
Remaining arguments, supported by others functions of this module, are silently ignored. Other arguments are logged as errors through syslog(3).
OPTIONS
debug
audit
quiet
nullok
nullresetok
try_first_pass
use_first_pass
nodelay
use_authtok
authtok_type=type
nis
remember=n
shadow
md5
bigcrypt
sha256
sha512
blowfish
gost_yescrypt
yescrypt
rounds=n
broken_shadow
minlen=n
obscure
Palindrome
Case Change Only
Similar
Simple
Rotated
no_pass_expiry
Invalid arguments are logged with syslog(3).
MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.
RETURN VALUES
PAM_IGNORE
EXAMPLES
An example usage for /etc/pam.d/login would be:
# Authenticate the user
auth required pam_unix.so
# Ensure user's account and password are still active
account required pam_unix.so
# Change the user's password, but at first check the strength
# with pam_passwdqc(8)
password required pam_passwdqc.so config=/etc/passwdqc.conf
password required pam_unix.so use_authtok nullok yescrypt
session required pam_unix.so
\nSEE ALSO
login.defs(5), pam.conf(5), pam.d(5), pam(7)
AUTHOR
pam_unix was written by various people.