Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How does pam decide which files in /etc/pam.d to use depending on whether a user logs in via ssh, locally, a serial console, etc?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

The PAM "service" name ("sshd", "sudo", etc.) is compiled into the application. That is what decides which file will be initially loaded. After that, the @include lines are processed as described in freiheit's post.

share|improve this answer

It might be hardcoded into the programs, but each service has its own file in /etc/pam.d generally named after the actual process name. Local and serial consoles both work via getty which passes off actual logging in to "login", so you'd need to look at /etc/pam.d/login. SSH is actually "sshd", so it's in /etc/pam.d/sshd

On most modern distros, those files mostly contain lines like "@include common-password" or "auth include system-auth", so for those two you'd then need to look at /etc/pam.d/common-password or /etc/pam.d/system-auth. Slightly older distros (RHEL3, for instance), use something like "auth required pam_stack.so service=system-auth", which is a module based version of the same thing.

share|improve this answer
1  
Slightly older systems use the pam_stack.so module for this. –  wzzrd Jul 6 '09 at 18:59
    
oh yeah. I'll update. –  freiheit Jul 6 '09 at 20:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.