Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How does pam decide which files in /etc/pam.d to use depending on whether a user logs in via ssh, locally, a serial console, etc?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

The PAM "service" name ("sshd", "sudo", etc.) is compiled into the application. That is what decides which file will be initially loaded. After that, the @include lines are processed as described in freiheit's post.

share|improve this answer

It might be hardcoded into the programs, but each service has its own file in /etc/pam.d generally named after the actual process name. Local and serial consoles both work via getty which passes off actual logging in to "login", so you'd need to look at /etc/pam.d/login. SSH is actually "sshd", so it's in /etc/pam.d/sshd

On most modern distros, those files mostly contain lines like "@include common-password" or "auth include system-auth", so for those two you'd then need to look at /etc/pam.d/common-password or /etc/pam.d/system-auth. Slightly older distros (RHEL3, for instance), use something like "auth required service=system-auth", which is a module based version of the same thing.

share|improve this answer
Slightly older systems use the module for this. – wzzrd Jul 6 '09 at 18:59
oh yeah. I'll update. – freiheit Jul 6 '09 at 20:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.