Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

After sucessfully configuring Kerberos, this is what I've found in /etc/pam.d/common-auth file:

auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so

Does the success=2 control value mean that if the pam_unix.so fails, the authentication skips to the auth requisite pam_deny.so line or to the last line?

share|improve this question

1 Answer 1

up vote 9 down vote accepted

From my understanding, success=$num will specify how many rules to skip when successful. So in both cases, with either pam_unix.so or pam_winbind.so, they will skip to the final line. Of course, the final line permits access in all cases.

share|improve this answer
Just to be clear; Lines 1 & 2 will skip to line 4 when either succeeds. Makes sense. –  Jamie Apr 21 '10 at 16:18
Thanks for responses to my other PAM questions too: it turns all my questions were moot; I'd restricted ssh logins to a particular list of users and forgot about that when I added domain authentication. When I added Kerberos, it modified the PAM files correctly for AD authentication. –  Jamie Apr 21 '10 at 16:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.