PAM_UNIX_AUTH(7) Standards, Environments, and Macros PAM_UNIX_AUTH(7)
NAME
pam_unix_auth - PAM authentication module for UNIX
SYNOPSIS
pam_unix_auth.so.1DESCRIPTION
The
pam_unix_auth module implements
pam_sm_authenticate(3PAM), which
provides functionality to the PAM authentication stack. It provides
functions that use
crypt(3C) to verify that the password contained in
the
PAM item
PAM_AUTHTOK is the correct password for the user
specified in the item
PAM_USER. If
PAM_REPOSITORY is specified, then
user's password is fetched from that repository. Otherwise, the
default
nsswitch.conf(5) repository is searched for that user.
For accounts in the name services which support automatic account
locking, the account may be configured to be automatically locked
(see
user_attr(5) and
policy.conf(5)) after multiple failed login
attempts. For accounts that are configured for automatic locking, if
authentication failure is to be returned, the failed login counter is
incremented upon each failure. If the number of successive failures
equals or exceeds
RETRIES as defined in
login(1), the account is
locked and
PAM_MAXTRIES is returned. Currently, only the "files"
repository (see
passwd(5) and
shadow(5)) supports automatic account
locking. A successful authentication by this module clears the failed
login counter and reports the number of failed attempts since the
last successful authentication.
Authentication service modules must implement both
pam_sm_authenticate() and
pam_sm_setcred(). To allow the
authentication portion of UNIX authentication to be replaced,
pam_sm_setcred() in this module always returns
PAM_IGNORE. This
module should be stacked with
pam_unix_cred(7) to ensure a successful
return from
pam_setcred(3PAM).
The following options can be passed to the module:
nowarn Turn off warning messages.
server_policy If the account authority for the user, as specified by
PAM_USER,
is a server, do not apply the UNIX policy from the
passwd entry
in the name service switch.
nolock Regardless of the automatic account locking setting for the
account, do not lock the account, increment or clear the failed
login count. The
nolock option allows for exempting account
locking on a per service basis.
ERRORS
The following error codes are returned from
pam_sm_authenticate():
PAM_AUTH_ERR Authentication failure.
PAM_BUF_ERR Memory buffer error.
PAM_IGNORE Ignores module, not participating in result.
PAM_MAXTRIES Maximum number of retries exceeded.
PAM_PERM_DENIED Permission denied.
PAM_SUCCESS Successfully obtains authentication token.
PAM_SYSTEM_ERR System error.
PAM_USER_UNKNOWN No account present for user.
The following error codes are returned from
pam_sm_setcred():
PAM_IGNORE Ignores this module regardless of the control flag.
ATTRIBUTES
See
attributes(7) for descriptions of the following attributes:
+--------------------+-------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+--------------------+-------------------------+
|Interface Stability | Committed |
+--------------------+-------------------------+
|MT Level | MT-Safe with exceptions |
+--------------------+-------------------------+
SEE ALSO
login(1),
passwd(1),
crypt(3C),
syslog(3C),
libpam(3LIB),
pam(3PAM),
pam_setcred(3PAM),
pam_sm_authenticate(3PAM),
pam_sm_setcred(3PAM),
nsswitch.conf(5),
pam.conf(5),
passwd(5),
policy.conf(5),
shadow(5),
user_attr(5),
attributes(7),
pam_authtok_check(7),
pam_authtok_get(7),
pam_authtok_store(7),
pam_dhkeys(7),
pam_passwd_auth(7),
pam_unix_account(7),
pam_unix_cred(7),
pam_unix_session(7),
NOTES
The interfaces in
libpam(3LIB) are MT-Safe only if each thread within
the multi-threaded application uses its own
PAM handle.
The
pam_unix(7) module is no longer supported. Similar functionality
is provided by
pam_authtok_check(7),
pam_authtok_get(7),
pam_authtok_store(7),
pam_dhkeys(7),
pam_passwd_auth(7),
pam_setcred(3PAM),
pam_unix_account(7),
pam_unix_cred(7),
pam_unix_session(7).
If the
PAM_REPOSITORY item_type is set and a service module does not
recognize the type, the service module does not process any
information, and returns
PAM_IGNORE. If the
PAM_REPOSITORY item_type is not set, a service module performs its default action.
August 19, 2023 PAM_UNIX_AUTH(7)
