PAM-AUTH-UPDATE(8)                   System Manager's Manual                   PAM-AUTH-UPDATE(8)



NAME
       pam-auth-update - manage PAM configuration using packaged profiles

SYNOPSIS
       pam-auth-update [--package [--remove profile [profile...]]]  [--force]

DESCRIPTION
       pam-auth-update  is  a  utility that permits configuring the central authentication policy
       for the system using pre-defined profiles as supplied by PAM  module  packages.   Profiles
       shipped  in  the  /usr/share/pam-configs/  directory specify the modules, with options, to
       enable; the preferred ordering with respect to  other  profiles;  and  whether  a  profile
       should  be  enabled by default.  Packages providing PAM modules register their profiles at
       install time by calling pam-auth-update --package.  Selection of profiles  is  done  using
       the  standard debconf interface.  The profile selection question will be asked at `medium'
       priority when packages are added or  removed,  so  no  user  interaction  is  required  by
       default.  Users may invoke pam-auth-update directly to change their authentication config‐
       uration.

       The script makes every effort to respect local changes to /etc/pam.d/common-*.  Local mod‐
       ifications  to  the  list  of  module  options will be preserved, and additions of modules
       within the managed portion of the stack will cause pam-auth-update  to  treat  the  config
       files  as  locally  modified and not make further changes to the config files unless given
       the --force option.

       If the user specifies that pam-auth-update should override  local  configuration  changes,
       the locally-modified files will be saved in /etc/pam.d/ with a suffix of .pam-old.

OPTIONS
       --package
              Indicate  that  the  caller  is a package maintainer script; lowers the priority of
              debconf questions to `medium' so that the user is not prompted by default.

       --remove profile [profile...]
              Remove the specified  profiles  from  the  system  configuration.   pam-auth-update
              --remove  should  be used to remove profiles from the configuration before the mod‐
              ules they reference are removed from disk, to ensure that PAM is  in  a  consistent
              and usable state at all times during package upgrades or removals.

       --force
              Overwrite  the  current PAM configuration, without prompting.  This option must not
              be used by package maintainer scripts; it is intended  for  use  by  administrators
              only.

FILES
       /etc/pam.d/common-*
           Global configuration of PAM, affecting all installed services.

       /usr/share/pam-configs/
           Package-supplied authentication profiles.

AUTHOR
       Steve Langasek <steve.langasek AT canonical.com>

COPYRIGHT
       Copyright (C) 2008 Canonical Ltd.

SEE ALSO
       PAM(7), pam.d(5), debconf(7)



Debian                                      08/23/2008                         PAM-AUTH-UPDATE(8)