48.4.3. PAM Configuration File Format
<module interface> <control flag> <module name> <module arguments>
18.104.22.168. Module Interface
auth— This module interface authenticates use. For example, it requests and verifies the validity of a password. Modules with this interface can also set credentials, such as group memberships or Kerberos tickets.
account— This module interface verifies that access is allowed. For example, it may check if a user account has expired or if a user is allowed to log in at a particular time of day.
password— This module interface is used for changing user passwords.
session— This module interface configures and manages user sessions. Modules with this interface can also perform additional tasks that are needed to allow access, like mounting a user's home directory and making the user's mailbox available.
pam_unix.soprovides all four module interfaces.
auth required pam_unix.so
22.214.171.124.1. Stacking Module Interfaces
rebootcommand normally uses several stacked modules, as seen in its PAM configuration file:
cat /etc/pam.d/reboot#%PAM-1.0 auth sufficient pam_rootok.so auth required pam_console.so #auth include system-auth account required pam_permit.so
- The first line is a comment and is not processed.
auth sufficient pam_rootok.so— This line uses the
pam_rootok.somodule to check whether the current user is root, by verifying that their UID is 0. If this test succeeds, no other modules are consulted and the command is executed. If this test fails, the next module is consulted.
auth required pam_console.so— This line uses the
pam_console.somodule to attempt to authenticate the user. If this user is already logged in at the console,
pam_console.sochecks whether there is a file in the
/etc/security/console.apps/directory with the same name as the service name (reboot). If such a file exists, authentication succeeds and control is passed to the next module.
#auth include system-auth— This line is commented and is not processed.
account required pam_permit.so— This line uses the
pam_permit.somodule to allow the root user or anyone logged in at the console to reboot the system.