One (probably slightly simpler) alternative is to use pam_pwdfile. It essentially allows authentication against a user-specified file, formatted like the default /etc/passwd
file.
pam_pwdfile does not seem to be developed, but it probably just works and needs no new features. It is also available in the Debian archive, which gives it security support (if ever needed).
To use it, install it (e.g. libpam-pwdfile
on Debian) and put a line like this in your pam config:
auth required pam_pwdfile.so pwdfile=/path/to/passwd_file
See the README for details.
The /path/to/passwd
file should contain a list of usernames and hashed passwords, separated by colons, one user on each line. The hashed password can be taken from your /etc/shadow
file, or generated with mkpasswd
or openssl
. E.g., to get a SHA-512-hashed password use either of these commands:
$ mkpasswd -m SHA-512
$ openssl passwd -6
An example passwd
file could look like below. This shows a SHA-512 and descrypt hashed password:
user1:$6$usgsi1RNu7wI$4rly97OA5ot5nsVSusW1jmwdjpHY7qbzGOX.E/TPfJqDuFnmMoCGVd1p1U/ew7e599QQLPnfkW0yLyuyaoAPl0
user2:NxR.0DdgI2Jnc
A similar alternative pam-module is pam_fshadow, but this module does not seem packaged by Debian, so I have not investigated it further.