| pam_unix2(8) - phpMan
pam_unix2(8) Reference Manual pam_unix2(8)
NAME
pam_unix2 - Standard PAM module for traditional password authentication
DESCRIPTION
The pam_unix2 PAM module is for traditional password authentication. It uses standard
calls from the glibc NSS libraries to retrieve and set account information as well as
authentication. Usually this is obtained from the the local files /etc/passwd and
/etc/shadow or from a NIS map.
The options can be added in the PAM configuration files for every single service.
/etc/security/pam_unix2.default defines, which password encryption algorithm should be
used in case of a password change.
OPTIONS
The following options may be passed to all types of management groups except session:
debug A lot of debug information is printed with syslog(3).
nullok Normally the account is disabled if no password is set or if the length of the
password is zero. With this option the user is allowed to change the password for
such accounts. This option does not overwrite a hardcoded default by the calling
process.
use_first_pass
The default is, that pam_unix2 tries to get the authentication token from a previ‐
ous module. If no token is available, the user is asked for the old password.
With this option, pam_unix2 aborts with an error if no authentication token from a
previous module is available.
The following additional options may be passed to the passwd rules of this modules:
nisdir=<path>
This options specifies a path to the source files for NIS maps on a NIS master
server. If this option is given, the passwords of NIS accounts will not be changed
with yppasswd(1), instead the local passwd and shadow files below <path> will be
modified. In conjunction with rpasswdd(8) and pam_make rpc.yppasswdd(8) can be
replaced with a more secure solution on the NIS master server.
use_authtok
Set the new password to the one provided by the previously stacked password module.
If this option is not set, pam_unix2 would ask the user for the new password.
One of the following options may be passed to the session rules of this modules:
debug Some messages (login time, logout time) are logged to syslog with priority
LOG_DEBUG.
trace Some messages (login time, logout time) are logged to syslog with priority
LOG_NOTICE.
none No messages are logged. This is the default.
The acct management does not recognize any additional options. For root, password and
login expire are ignored, only on aging warning is printed. If no shadow information
exists, it always returns success.
FILES
/etc/security/pam_unix2.default
SEE ALSO
login(1), passwd(1), pam.conf(8), pam.d(8), pam_pwcheck(8), pam(8), rpasswd(1), rpass‐
wdd(8), rpc.yppasswdd(8), yppasswd(1)
pam_unix2 August 2006 pam_unix2(8)
|