Sample Pam Configuration Files - Red Hat ENTERPRISE LINUX 3 Reference Manual

232
In the previous example, replace
file.
Invalid arguments are ignored and do not otherwise affect the success or failure of the PAM module.
However, most modules will report an error to the
15.4. Sample PAM Configuration Files
Below is a sample PAM application configuration file:
#%PAM-1.0
auth required
auth required
auth required
account required
password required
password required
session required
The first line is a comment as denoted by the hash mark (
Lines two through four stack three modules for login authentication.
auth required
This module makes sure that if the user is trying to log in as root, the tty on which the user is logging
in is listed in the
/etc/securetty
auth required
This module prompts the user for a password and then checks the password using the information
stored in
/etc/passwd
detects and uses shadow passwords to authenticate users. Please refer to Section 6.5 Shadow Pass-
words for more information.
The argument
nullok
auth required
This is the final authentication step. It verifies whether or not the file
does exist and the user is not root, authentication fails.
nologin
Note
In this example, all three
the user from knowing at what stage their authentication failed. Such knowledge in the hands of an
attacker could allow them to more easily deduce how to crack the system.
account required
This module performs any necessary account verification. For example, if shadow passwords have
been enabled, the account component of the
expired or if the user has not changed the password within the grace period allowed.
password required
Chapter 15. Pluggable Authentication Modules (PAM)
path-to-file with the full path to the Berkeley DB database
pam_securetty.so
pam_unix.so shadow nullok
pam_nologin.so
pam_unix.so
pam_cracklib.so retry=3
pam_unix.so shadow nullok use_authtok
pam_unix.so
pam_securetty.so
file, if that file exists.
pam_unix.so shadow nullok
and, if it exists,
/etc/shadow
instructs the
pam_unix.so
pam_nologin.so
modules are checked, even if the first
auth
pam_unix.so
pam_cracklib.so retry=3
/var/log/messages
) at the beginning of the line.
#
. The
pam_unix.so
module to allow a blank password.
module checks to see if the account has
pam_unix.so
file.
module automatically
/etc/nologin
module fails. This prevents
auth
exists. If