What is PAM (Pluggable Authentication Modules) in Linux? I know it is used for authentication, but what good is this? How does it work?

I am using CentOS 6.2.


In a nutshell, PAM the Pluggable Authentication Modules.

As its name implies it uses a plug-in style architecture. PAM makes it so that each program does not have to implement its own authentication mechanism. Instead it just checks the PAM stack.

Because PAM is pluggable you can configure the authentication stack however you like. Authenticating against LDAP, NIS, RADIUS, MySQL, Oracle, BerkelyDB, SQLite, RSA tokens, x509 certificates, flat files, one time passwords, Google two-factor, phases of the moon, etc. can all be configured in any combination.

PAM can also trigger actions such as mounting filesystems, creating directories, logging, or any other action when the stack is activated, fails or succeeds.

PAM is the authentication Swiss Army Knife, giving infinite flexibility to custom tailor authentication in any way necessary, for any application.

Without it every program would have to independently support all of these features, and that would be a sad world indeed.


maybe this overview gives you all you want to know or a good start for even more: http://www.linux-pam.org/Linux-PAM-html/sag-overview.html

Some quotes:

Linux-PAM deals with four separate types of (management) task. These are: authentication management; account management; session management; and password management.

    Here is a figure that describes the overall organization of Linux-PAM:

  | application: X |
  +----------------+       /  +----------+     +================+
  | authentication-[---->--\--] Linux-   |--<--| PAM config file|
  |       +        [----<--/--]   PAM    |     |================|
  |[conversation()][--+    \  |          |     | X auth .. a.so |
  +----------------+  |    /  +-n--n-----+     | X auth .. b.so |
  |                |  |       __|  |           |           _____/
  |  service user  |  A      |     |           |____,-----'
  |                |  |      V     A
  +----------------+  +------|-----|---------+ -----+------+
                         +---u-----u----+    |      |      |
                         |   auth....   |--[ a ]--[ b ]--[ c ]
                         |   acct....   |--[ b ]--[ d ]
                         |   password   |--[ b ]--[ c ]
                         |   session    |--[ e ]--[ c ]
  • 1
    Explains it perfectly. You could repost important parts though. – user98645 Jul 20 '12 at 6:45
  • ok, added some text from the link – user118305 Jul 20 '12 at 8:25
  • I am using CentOS 6.2, inside /etc/pam.d/ directory plenty of files are there such as login,sshd,passwd,reboot,vsftpd and many more, my question is how to configure these files, for sshd I configured like this and its working fine, for other files what should I do... I googled lot but nowhere exact Answer... – max Jul 25 '12 at 5:39
  • Maybe you could add more specific questions what you would like to do to you initial question. If its unspecific, @bahamat 's answer should be just fine? – user118305 Jul 25 '12 at 6:18
  • 1
    PAM isn't a daemon that is running, so much as a series of library calls that any daemon can make when it wants to authenticate a connection. – Don Simon Aug 30 '12 at 15:19

PAM is a framework that assists applications in performing what I'll call "authentication-related activities". The core pieces of PAM are a library (libpam) and a collection of PAM modules, which are dynamically linked libraries (.so) files in the folder /lib/security.


1.Backup all data and PAM configuration files before any modification.

2.Please be careful to perform the configuration option. Wrong configuration can lock down all login access including root access.

3.Read The PAM syntax correctly.

Below are the some examples, be careful while trying this.

Allow any user to su to root without a password.

For this, Edit the file /etc/pam.d/su and comment out any lines relating to the auth stack, replacing them with the single line:

auth sufficient pam_permit.so

To test this Log in as a normal user and verify that you can now use su - to become root without supplying a password.

[raj@avi ~]$ su -
[root@avi ~]#

Disable direct root login

NOTE: Before doing this, ensure that you have at least one account that can use su to become root, or you will lock yourself out from the machine.

To disable root logins on virtual terminals, edit the file /etc/pam/d/login and add the entry.

auth required pam_securetty.so

This module will prevent root login on terminal devices that aren't listed in /etc/securetty.


If you comment on #tty2 and #tty3, then from the virtual terminal tty2 and tty3 it is not possible to login direct as root.

Prevent non-root users from shutting down the system

Taking the PAM configuration of the halt command as an example, edit the file /etc/pam.d/halt. like this

auth sufficient pam_rootok.so

auth required pam_deny.so

To test this login as a normal user and try halt command, then you will get below error.

[test2@avi ~]$ halt
halt: Need to be root
[test2@avi ~]$

These are some examples only.

original source

  • 3
    It looks like you copy-pasted the entire contents of this answer from this site. Unless you have the rights to copy this content given to you by the site owner, this is basically plagiarism. Can you rephrase your answer in your own words or at least properly quote everything you didn't write yourself? Thank you. – slhck Jul 26 '12 at 9:30
  • 1
    No, you don't have to delete it; it would just be nice to add a link to the source and try not to 1:1 copy everything. Maybe you can just rephrase a few passages in your own words. You did the screenshots yourself, right? They're certainly nice to have! – slhck Jul 26 '12 at 9:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.