Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to run a script when an authentication failure occurs. But, with the following conf file, authenitcation always fails even when the proper credentials are supplied.

auth       [success=1 new_authtok_reqd=ok ignore=ignore default=bad]
auth       optional  /usr/bin/log_failure
password   required  md5

Authentication works by changing "success=1" to "success=ok", though obviously the failure script will always run.

I tried looking through the source code of _pam_dispatch_aux and it doesn't seem to return the first rule's return when there is no rule to jump to. If I add another rule so there is something to jump to, everything works.

auth       [success=1 new_authtok_reqd=ok ignore=ignore default=bad] 
auth       optional  /usr/bin/log_failure
auth       optional  /usr/bin/noop
password   required  md5

Am I doing something wrong in my conf file, trying something that shouldn't work, or is there a bug?

share|improve this question
up vote 1 down vote accepted

This is working as intended.

success=n does not contribute to the return of the module stack. The result is that a successful authentication against returns failure (because nothing returns a success of ok or done), and a failed authentication returns failure (as expected, because returning success in this context would be Very Bad).

Try the following instead:

auth       sufficient
auth       optional  /usr/bin/log_failure
password   required  md5

sufficient means "stop here if we were successful, otherwise keep going". This should have the desired effect.

If /usr/bin/log_failure is a script though, the security nut in me would be more inclined to try this...

auth       sufficient
auth       [default=ignore]  /usr/bin/log_failure
password   required  md5

This prevents a success returned by log_failure from allowing a login.

share|improve this answer
Thanks for your help. – vader90210 Nov 5 '13 at 19:07
I've updated my answer to be slightly more security conscious. – Andrew B Nov 7 '13 at 16:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.