Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is PAM (Pluggable Authentication Modules) in Linux? I know it is used for authentication, but what good is this? How does it work?

I am using CentOS 6.2.

share|improve this question

maybe this overview gives you all you want to know or a good start for even more:

Some quotes:

Linux-PAM deals with four separate types of (management) task. These are: authentication management; account management; session management; and password management.

    Here is a figure that describes the overall organization of Linux-PAM:

  | application: X |
  +----------------+       /  +----------+     +================+
  | authentication-[---->--\--] Linux-   |--<--| PAM config file|
  |       +        [----<--/--]   PAM    |     |================|
  |[conversation()][--+    \  |          |     | X auth .. |
  +----------------+  |    /  +-n--n-----+     | X auth .. |
  |                |  |       __|  |           |           _____/
  |  service user  |  A      |     |           |____,-----'
  |                |  |      V     A
  +----------------+  +------|-----|---------+ -----+------+
                         +---u-----u----+    |      |      |
                         |   auth....   |--[ a ]--[ b ]--[ c ]
                         |   acct....   |--[ b ]--[ d ]
                         |   password   |--[ b ]--[ c ]
                         |   session    |--[ e ]--[ c ]
share|improve this answer
Explains it perfectly. You could repost important parts though. – Sandro Dzneladze Jul 20 '12 at 6:45
ok, added some text from the link – user4711 Jul 20 '12 at 8:25
I am using CentOS 6.2, inside /etc/pam.d/ directory plenty of files are there such as login,sshd,passwd,reboot,vsftpd and many more, my question is how to configure these files, for sshd I configured like this and its working fine, for other files what should I do... I googled lot but nowhere exact Answer... – max Jul 25 '12 at 5:39
Maybe you could add more specific questions what you would like to do to you initial question. If its unspecific, @bahamat 's answer should be just fine? – user4711 Jul 25 '12 at 6:18
PAM isn't a daemon that is running, so much as a series of library calls that any daemon can make when it wants to authenticate a connection. – Don Simon Aug 30 '12 at 15:19

In a nutshell, PAM the Pluggable Authentication Modules.

As its name implies it uses a plug-in style architecture. PAM makes it so that each program does not have to implement its own authentication mechanism. Instead it just checks the PAM stack.

Because PAM is pluggable you can configure the authentication stack however you like. Authenticating against LDAP, NIS, RADIUS, MySQL, Oracle, BerkelyDB, SQLite, RSA tokens, x509 certificates, flat files, one time passwords, Google two-factor, phases of the moon, etc. can all be configured in any combination.

PAM can also trigger actions such as mounting filesystems, creating directories, logging, or any other action when the stack is activated, fails or succeeds.

PAM is the authentication Swiss Army Knife, giving infinite flexibility to custom tailor authentication in any way necessary, for any application.

Without it every program would have to independently support all of these features, and that would be a sad world indeed.

share|improve this answer

PAM is a framework that assists applications in performing what I'll call "authentication-related activities". The core pieces of PAM are a library (libpam) and a collection of PAM modules, which are dynamically linked libraries (.so) files in the folder /lib/security.


1.Backup all data and PAM configuration files before any modification.

2.Please be careful to perform the configuration option. Wrong configuration can lock down all login access including root access.

3.Read The PAM syntax correctly.

Below are the some examples, be careful while trying this.

Allow any user to su to root without a password.

For this, Edit the file /etc/pam.d/su and comment out any lines relating to the auth stack, replacing them with the single line:

auth sufficient

To test this Log in as a normal user and verify that you can now use su - to become root without supplying a password.

[raj@avi ~]$ su -
[root@avi ~]#

Disable direct root login

NOTE: Before doing this, ensure that you have at least one account that can use su to become root, or you will lock yourself out from the machine.

To disable root logins on virtual terminals, edit the file /etc/pam/d/login and add the entry.

auth required

This module will prevent root login on terminal devices that aren't listed in /etc/securetty.


If you comment on #tty2 and #tty3, then from the virtual terminal tty2 and tty3 it is not possible to login direct as root.

Prevent non-root users from shutting down the system

Taking the PAM configuration of the halt command as an example, edit the file /etc/pam.d/halt. like this

auth sufficient

auth required

To test this login as a normal user and try halt command, then you will get below error.

[test2@avi ~]$ halt
halt: Need to be root
[test2@avi ~]$

These are some examples only.

original source

share|improve this answer
It looks like you copy-pasted the entire contents of this answer from this site. Unless you have the rights to copy this content given to you by the site owner, this is basically plagiarism. Can you rephrase your answer in your own words or at least properly quote everything you didn't write yourself? Thank you. – slhck Jul 26 '12 at 9:30
No, you don't have to delete it; it would just be nice to add a link to the source and try not to 1:1 copy everything. Maybe you can just rephrase a few passages in your own words. You did the screenshots yourself, right? They're certainly nice to have! – slhck Jul 26 '12 at 9:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .