2 .\" Copyright (c) 2005 Dag-Erling Coïdan Smørgrav
3 .\" All rights reserved.
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
8 .\" 1. Redistributions of source code must retain the above copyright
9 .\" notice, this list of conditions and the following disclaimer.
10 .\" 2. Redistributions in binary form must reproduce the above copyright
11 .\" notice, this list of conditions and the following disclaimer in the
12 .\" documentation and/or other materials provided with the distribution.
13 .\" 3. The name of the author may not be used to endorse or promote
14 .\" products derived from this software without specific prior written
17 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 .\" $P4: //depot/projects/openpam/doc/man/pam.conf.5#2 $
36 .Nd PAM policy file format
38 The PAM library searches for policies in the following files, in
39 decreasing order of preference:
42 .Pa /etc/pam.d/ Ns Ar service-name
46 .Pa /usr/local/etc/pam.d/ Ns Ar service-name
48 .Pa /usr/local/etc/pam.conf
51 If none of these locations contains a policy for the given service,
54 policy is used instead, if it exists.
56 Entries in per-service policy files must be of one of the two forms
58 .Bd -unfilled -offset indent
59 .Ar function-class Ar control-flag Ar module-path Op Ar arguments ...
60 .Ar function-class Cm include Ar other-service-name
64 .Pa pam.conf Ns -style
65 policy files are of the same form, but are prefixed by an additional
66 field specifying the name of the service they apply to.
68 In both types of policy files, blank lines are ignored, as is anything
69 to the right of a `#' sign.
73 field specifies the class of functions the entry applies to, and is
75 .Bl -tag -width "password"
77 Authentication functions
79 .Xr pam_authenticate 3 ,
83 Account management functions
84 .Pq Xr pam_acct_mgmt 3
86 Session handling functions
88 .Xr pam_open_session 3 ,
89 .Xr pam_close_session 3
92 Password management functions
93 .Pq Xr pam_chauthtok 3
98 field determines how the result returned by the module affects the
99 flow of control through (and the final result of) the rest of the
100 chain, and is one of:
101 .Bl -tag -width "sufficient"
103 If this module succeeds, the result of the chain will be success
104 unless a later module fails.
105 If it fails, the rest of the chain still runs, but the final result
106 will be failure regardless of the success of later modules.
108 If this module succeeds, the result of the chain will be success
109 unless a later module fails.
110 If it module fails, the chain is broken and the result is failure.
112 If this module succeeds, the chain is broken and the result is
114 If it fails, the rest of the chain still runs, but the final result
115 will be failure unless a later module succeeds.
117 If this module succeeds, the chain is broken and the result is
119 If it fails, the rest of the chain still runs, but the final result
120 will be failure regardless of the success of later modules.
122 If this module succeeds, the result of the chain will be success
123 unless a later module fails.
124 If this module fails, the result of the chain will be failure unless a
125 later module succeeds.
128 There are two exceptions to the above:
132 modules are treated as
139 .Xr pam_chauthtok 3 .
143 field specifies the name, or optionally the full path, of the module
146 The remaining fields are passed as arguments to the module if and when
151 form of entry causes entries from a different chain (specified by
152 .Ar other-system-name )
153 to be included in the current one.
154 This allows one to define system-wide policies which are then included
155 into service-specific policies.
156 The system-wide policy can then be modified without having to also
157 modify each and every service-specific policy.
162 .%T "X/Open Single Sign-On Service (XSSO) - Pluggable Authentication Modules"
166 The OpenPAM library was developed for the FreeBSD Project by ThinkSec
167 AS and Network Associates Laboratories, the Security Research Division
168 of Network Associates, Inc. under DARPA/SPAWAR contract
171 as part of the DARPA CHATS research program.
173 This manual page was written by
174 .An Dag-Erling Sm\(/orgrav Aq des@FreeBSD.org .