1.\" $NetBSD: pam_unix.8,v 1.3 2005/02/20 19:40:20 wiz Exp $ 2.\" Copyright (c) 2001 Mark R V Murray 3.\" All rights reserved. 4.\" Copyright (c) 2001 Networks Associates Technology, Inc. 5.\" All rights reserved. 6.\" 7.\" This software was developed for the FreeBSD Project by ThinkSec AS and 8.\" NAI Labs, the Security Research Division of Network Associates, Inc. 9.\" under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 10.\" DARPA CHATS research program. 11.\" 12.\" Redistribution and use in source and binary forms, with or without 13.\" modification, are permitted provided that the following conditions 14.\" are met: 15.\" 1. Redistributions of source code must retain the above copyright 16.\" notice, this list of conditions and the following disclaimer. 17.\" 2. Redistributions in binary form must reproduce the above copyright 18.\" notice, this list of conditions and the following disclaimer in the 19.\" documentation and/or other materials provided with the distribution. 20.\" 3. The name of the author may not be used to endorse or promote 21.\" products derived from this software without specific prior written 22.\" permission. 23.\" 24.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 25.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 28.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34.\" SUCH DAMAGE. 35.\" 36.\" $FreeBSD: src/lib/libpam/modules/pam_unix/pam_unix.8,v 1.10 2004/01/17 09:46:49 schweikh Exp $ 37.\" 38.Dd November 26, 2001 39.Dt PAM_UNIX 8 40.Os 41.Sh NAME 42.Nm pam_unix 43.Nd UNIX PAM module 44.Sh SYNOPSIS 45.Op Ar service-name 46.Ar module-type 47.Ar control-flag 48.Pa pam_unix 49.Op Ar options 50.Sh DESCRIPTION 51The 52.Ux 53authentication service module for PAM, 54.Nm 55provides functionality for two PAM categories: 56authentication 57and account management. 58In terms of the 59.Ar module-type 60parameter, they are the 61.Dq Li auth 62and 63.Dq Li account 64features. 65It also provides a null function for session management. 66.Ss Ux Ss Authentication Module 67The 68.Ux 69authentication component 70provides functions to verify the identity of a user 71.Pq Fn pam_sm_authenticate , 72which obtains the relevant 73.Xr passwd 5 74entry. 75It prompts the user for a password 76and verifies that this is correct with 77.Xr crypt 3 . 78.Pp 79The following options may be passed to the authentication module: 80.Bl -tag -width ".Cm use_first_pass" 81.It Cm debug 82.Xr syslog 3 83debugging information at 84.Dv LOG_DEBUG 85level. 86.It Cm use_first_pass 87If the authentication module 88is not the first in the stack, 89and a previous module 90obtained the user's password, 91that password is used 92to authenticate the user. 93If this fails, 94the authentication module returns failure 95without prompting the user for a password. 96This option has no effect 97if the authentication module 98is the first in the stack, 99or if no previous modules 100obtained the user's password. 101.It Cm try_first_pass 102This option is similar to the 103.Cm use_first_pass 104option, 105except that if the previously obtained password fails, 106the user is prompted for another password. 107.It Cm auth_as_self 108This option will require the user 109to authenticate himself as the user 110given by 111.Xr getlogin 2 , 112not as the account they are attempting to access. 113This is primarily for services like 114.Xr su 1 , 115where the user's ability to retype 116their own password 117might be deemed sufficient. 118.It Cm nullok 119If the password database 120has no password 121for the entity being authenticated, 122then this option 123will forgo password prompting, 124and silently allow authentication to succeed. 125.It Cm local_pass 126Use only the local password database, 127even if NIS is in use. 128This will cause an authentication failure 129if the system is configured 130to only use NIS. 131.It Cm nis_pass 132Use only the NIS password database. 133This will cause an authentication failure 134if the system is not configured 135to use NIS. 136.El 137.Ss Ux Ss Account Management Module 138The 139.Ux 140account management component 141provides a function to perform account management, 142.Fn pam_sm_acct_mgmt . 143The function verifies 144that the authenticated user 145is allowed to login to the local user account 146by checking the password expiry date. 147.Pp 148The following options may be passed to the management module: 149.Bl -tag -width ".Cm use_first_pass" 150.It Cm debug 151.Xr syslog 3 152debugging information at 153.Dv LOG_DEBUG 154level. 155.El 156.Ss Ux Ss Password Management Module 157The 158.Ux 159password management component 160provides a function to perform account management, 161.Fn pam_sm_chauthtok . 162The function changes 163the user's password. 164.Pp 165The following options may be passed to the password module: 166.Bl -tag -width ".Cm use_first_pass" 167.It Cm debug 168.Xr syslog 3 169debugging information at 170.Dv LOG_DEBUG 171level. 172.It Cm no_warn 173suppress warning messages to the user. 174These messages include 175reasons why the user's 176authentication attempt was declined. 177.It Cm local_pass 178forces the password module 179to change a local password 180in favour of a NIS one. 181.It Cm nis_pass 182forces the password module 183to change a NIS password 184in favour of a local one. 185.El 186.Sh FILES 187.Bl -tag -width ".Pa /etc/master.passwd" -compact 188.It Pa /etc/master.passwd 189default 190.Ux 191password database. 192.El 193.Sh SEE ALSO 194.Xr passwd 1 , 195.Xr getlogin 2 , 196.Xr crypt 3 , 197.Xr getpwent 3 , 198.Xr syslog 3 , 199.Xr nsswitch.conf 5 , 200.Xr passwd 5 , 201.Xr nis 8 , 202.Xr pam 8 203