Unix/Linux Go Back    

OpenSolaris 2009.06 - man page for pam_unix_auth (opensolaris section 5)

Linux & Unix Commands - Search Man Pages
Man Page or Keyword Search:   man
Select Man Page Set:       apropos Keyword Search (sections above)

pam_unix_auth(5)	       Standards, Environments, and Macros		 pam_unix_auth(5)

       pam_unix_auth - PAM authentication module for UNIX


       The pam_unix_auth module implements pam_sm_authenticate(), which provides functionality to
       the PAM authentication stack. It provides functions that use crypt(3C) to verify that  the
       password contained in the PAM item PAM_AUTHTOK is the correct password for the user speci-
       fied in the item PAM_USER. If PAM_REPOSITORY is specified, then user's password is fetched
       from  that  repository. Otherwise, the default nsswitch.conf(4) repository is searched for
       that user.

       For accounts in the name services which support automatic account locking, the account may
       be  configured to be automatically locked (see user_attr(4) and policy.conf(4)) after mul-
       tiple failed login attempts.  For accounts that are configured for automatic  locking,  if
       authentication  failure	is  to	be returned, the failed login counter is incremented upon
       each failure. If the number of successive failures equals or exceeds RETRIES as defined in
       login(1),  the account is locked and PAM_MAXTRIES is returned. Currently, only the "files"
       repository (see passwd(4) and shadow(4)) supports automatic account locking. A  successful
       authentication  by  this  module clears the failed login counter and reports the number of
       failed attempts since the last successful authentication.

       Authentication service modules must implement both pam_sm_authenticate()  and  pam_sm_set-
       cred().	To  allow  the	authentication	portion  of  UNIX  authentication to be replaced,
       pam_sm_setcred() in this module always returns PAM_IGNORE. This module should  be  stacked
       with pam_unix_cred(5) to ensure a successful return from pam_setcred(3PAM).

       The following options can be passed to the module:


	   Turn off warning messages.


	   If  the  account authority for the user, as specified by PAM_USER, is a server, do not
	   apply the UNIX policy from the passwd entry in the name service switch.


	   Regardless of the automatic account locking setting for the account, do not	lock  the
	   account,  increment	or  clear  the	failed	login count. The nolock option allows for
	   exempting account locking on a per service basis.

       The following error codes are returned from pam_sm_authenticate():


	   Authentication failure.


	   Memory buffer error.


	   Ignores module, not participating in result.


	   Maximum number of retries exceeded.


	   Permission denied.


	   Successfully obtains authentication token.


	   System error.


	   No account present for user.

       The following error codes are returned from pam_sm_setcred():


	   Ignores this module regardless of the control flag.

       See attributes(5) for descriptions of the following attributes:

       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       |Interface Stability	     |Committed 		   |
       |MT Level		     |MT-Safe with exceptions	   |

       login(1), passwd(1), useradd(1M), usermod(1M), roleadd(1M), rolemod(1M),  crypt(3C),  lib-
       pam(3LIB),  pam(3PAM), pam_authenticate(3PAM), pam_setcred(3PAM), syslog(3C), pam.conf(4),
       passwd(4),  policy.conf(4),  nsswitch.conf(4),  shadow(4),  user_attr(4),   attributes(5),
       pam_authtok_check(5),	 pam_authtok_get(5),	 pam_authtok_store(5),	   pam_dhkeys(5),
       pam_passwd_auth(5), pam_unix_account(5), pam_unix_session(5)

       The interfaces in libpam(3LIB) are MT-Safe only if each thread within  the  multi-threaded
       application uses its own PAM handle.

       The  pam_unix(5)  module  is  no  longer  supported.  Similar functionality is provided by
       pam_authtok_check(5),	 pam_authtok_get(5),	 pam_authtok_store(5),	   pam_dhkeys(5),
       pam_passwd_auth(5),pam_setcred(3PAM), pam_unix_account(5), pam_unix_cred(5), pam_unix_ses-

       If the PAM_REPOSITORY item_type is set and a service module does not recognize  the  type,
       the  service  module  does  not	process  any  information, and returns PAM_IGNORE. If the
       PAM_REPOSITORY item_type is not set, a service module performs its default action.

SunOS 5.11				   23 Apr 2008				 pam_unix_auth(5)
Unix & Linux Commands & Man Pages : ©2000 - 2018 Unix and Linux Forums

All times are GMT -4. The time now is 11:45 AM.