PAM_UNIX_AUTH(7) Device and Network Interfaces PAM_UNIX_AUTH(7)


pam_unix_auth - PAM authentication module for UNIX



The pam_unix_auth module implements pam_sm_authenticate(), which provides
functionality to the PAM authentication stack. It provides functions that
use crypt(3C) to verify that the password contained in the PAM item
PAM_AUTHTOK is the correct password for the user specified in the item
PAM_USER. If PAM_REPOSITORY is specified, then user's password is fetched
from that repository. Otherwise, the default nsswitch.conf(5) repository
is searched for that user.

For accounts in the name services which support automatic account
locking, the account may be configured to be automatically locked (see
user_attr(5) and policy.conf(5)) after multiple failed login attempts.
For accounts that are configured for automatic locking, if authentication
failure is to be returned, the failed login counter is incremented upon
each failure. If the number of successive failures equals or exceeds
RETRIES as defined in login(1), the account is locked and PAM_MAXTRIES is
returned. Currently, only the "files" repository (see passwd(5) and
shadow(5)) supports automatic account locking. A successful
authentication by this module clears the failed login counter and reports
the number of failed attempts since the last successful authentication.

Authentication service modules must implement both pam_sm_authenticate()
and pam_sm_setcred(). To allow the authentication portion of UNIX
authentication to be replaced, pam_sm_setcred() in this module always
returns PAM_IGNORE. This module should be stacked with pam_unix_cred(7)
to ensure a successful return from pam_setcred(3PAM).

The following options can be passed to the module:


Turn off warning messages.


If the account authority for the user, as specified by PAM_USER, is a
server, do not apply the UNIX policy from the passwd entry in the
name service switch.


Regardless of the automatic account locking setting for the account,
do not lock the account, increment or clear the failed login count.
The nolock option allows for exempting account locking on a per
service basis.


The following error codes are returned from pam_sm_authenticate():


Authentication failure.


Memory buffer error.


Ignores module, not participating in result.


Maximum number of retries exceeded.


Permission denied.


Successfully obtains authentication token.


System error.


No account present for user.

The following error codes are returned from pam_sm_setcred():


Ignores this module regardless of the control flag.


See attributes(7) for descriptions of the following attributes:

|Interface Stability | Committed |
|MT Level | MT-Safe with exceptions |


login(1), passwd(1), crypt(3C), syslog(3C), libpam(3LIB), pam(3PAM),
pam_authenticate(3PAM), pam_setcred(3PAM), nsswitch.conf(5), pam.conf(5),
passwd(5), policy.conf(5), shadow(5), user_attr(5), attributes(7),
pam_authtok_check(7), pam_authtok_get(7), pam_authtok_store(7),
pam_dhkeys(7), pam_passwd_auth(7), pam_unix_account(7),
pam_unix_session(7), roleadd(8), rolemod(8), useradd(8), usermod(8)


The interfaces in libpam(3LIB) are MT-Safe only if each thread within the
multi-threaded application uses its own PAM handle.

The pam_unix(7) module is no longer supported. Similar functionality is
provided by pam_authtok_check(7), pam_authtok_get(7),
pam_authtok_store(7), pam_dhkeys(7), pam_passwd_auth(7),
pam_setcred(3PAM), pam_unix_account(7), pam_unix_cred(7),

If the PAM_REPOSITORY item_type is set and a service module does not
recognize the type, the service module does not process any information,
and returns PAM_IGNORE. If the PAM_REPOSITORY item_type is not set, a
service module performs its default action.

April 23, 2008 PAM_UNIX_AUTH(7)