Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to create a pam.d configuration file that will test that a user has an account but will not test the password. How should I go about this? I've tried using nullok but I've not been able to get it to work. I'm not sure this matters but I am trying to do this using JPam, a Java API that uses a native library to invoke pam on a RH5.2 host. I'm completely new to pam.

share|improve this question
    
wasn't RH5.2 released in 1998? –  David Pashley Sep 8 '09 at 19:02
    
Actually, I think it was 2008. The version is something I have no control over though. –  John in MD Sep 8 '09 at 19:12

2 Answers 2

up vote 1 down vote accepted

You can use the pam_permit module to do this.

In the pam.d file for the service you want to remove the password checking for, you can put at the top:

auth sufficient pam_permit.so

You should be very careful how you use pam_permit, as it removes the password. You probably don't want to use it as part of a common pam file, or anything that allows remote access if the computer is available over the network. Basically, make sure you know what you're doing when you use it and understand that you could open the box to being hacked.

share|improve this answer
    
I want be sure the user has an account, this does not seem to do that, or am I missing something? Thanks. –  John in MD Sep 8 '09 at 18:42
    
Yes, this will work. The account phase makes sure the account exists. The auth phase checks the password. In this case you're telling it to allow anything. –  David Pashley Sep 8 '09 at 18:59
    
you're the man! I just tried it out it's just what we needed. Thanks. –  John in MD Sep 8 '09 at 19:16

Another approach would be to modiy system-auth in /etc/pam.d to add the following line below pam_unix.so in the auth section.

 auth sufficient pam_succees_if so uid eq UID

where UID is changed to the actual uid (number) of the user.

share|improve this answer
    
I see how that works for one user, or as many as I want to put in the condition. I want a more general soultion that works for any user that has an active account. –  John in MD Sep 8 '09 at 18:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.