Control Flag - Red Hat ENTERPRISE LINUX 4.5.0 Reference Manual

Stacking makes it very easy for an administrator to require specific conditions to exist before
allowing the user to authenticate. For example,
modules, as seen in its PAM configuration file:
auth required pam_nologin.so auth required pam_securetty.so auth required
pam_env.so auth sufficient pam_rhosts_auth.so auth required pam_stack.so
service=system-auth
Before someone is allowed to use
exist, that they are not trying to log in remotely as a root user over a network connection, and
that any environmental variables can be loaded. Then, if a successful
performed, the connection is allowed. If the
authentication is performed.

3.2. Control Flag

All PAM modules generate a success or failure result when called. Control flags tell PAM what
do with the result. Since modules can be stacked in a particular order, control flags decide how
important the success or failure of a particular module is to the overall goal of authenticating the
user to the service.
There are four predefined control flags:
• — The module result must be successful for authentication to continue. If a
required
module result fails, the user is not notified until results on all modules referencing
required
that interface are completed.
• — The module result must be successful for authentication to continue. However,
requisite
if a module result fails, the user is notified immediately with a message reflecting
requisite
the first failed
required
• — The module result is ignored if it fails. However, if a
sufficient
module result is successful and no
other results are required and the user is authenticated to the service.
• — The module result is ignored. A module flagged as
optional
necessary for successful authentication when there are no other modules referencing the
interface.
Important
The order in which
and
requisite
rlogin
, PAM verifies that the
rlogin
rhosts
or module.
requisite
flagged modules above it have failed, then no
required
modules are called is not critical. The
required
control flags cause order to become important.
normally uses five stacked
/etc/nologin
rhosts
authentication fails, then standard password
sufficient
optional
Control Flag
auth
file does not
authentication is
flagged
only becomes
sufficient
299