I am reading a configuration file for Linux PAM and am wondering what it means:

auth    [success=2 default=ignore]      pam_krb5.so minimum_uid=1000

I understand that "auth" means this rule is applied to authentication. I also get that "pam_krb5.so" means "use Kerberos to authenticate". The part I don't understand is [success=2 default=ignore]. What does that mean?


If you read the pam.d manpage, more about what can be done inside the [ ] is explained in there.

success=2 means that if this particular authentication is successful, the next two items in that file will be skipped over.

default=ignore basically means to ignore any and all failures. They won't be a successful auth, but neither will they cause authentication to stop here.

For the first part, there are a ton of different possibilities, but everything other than 'success' is pretty much a type of failure, such as "user_unknown", "acct_expired" or "system_err".

Exactly what the combination means depends on what's in the rest of the file, since it's skipping 2 things and going to the third thing after it. It probably ends up meaning something like "sufficient", as in, "success with this authentication is enough and we won't require any other authentication methods to succeed". If there's 3 or more things after it, then it depends on what those are...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.