I've been reading everything I can find on PAM (e.g. http://wpollock.com/AUnix2/PAM-Help.htm), however I'm still confused about how precisely the advanced options are supposed to work. For example, every reference says this:
Each of the four control-flag keywords (required, requisite, sufficient, and optional) have an equivalent expression in terms of the [...] syntax: required [success=ok new_authtok_reqd=ok ignore=ignore default=bad]
My understanding is that modules can return a variety of tokens, and that the action associated with each token is described in the configuration file. Based on that understanding, what does
have to do with the required control flag? What's the meaning/purpose of
is what I would think matches the required behavior, but does
mean that if the module returns any other action token, the module fails? Is the action=value token success=ok overruled by default=bad, or vice versa? Which takes precendence? It's not clear from anything I've read.
More generally, suppose I have something like
What happens if the module returns success and one other token?
Finally, I can't find the answer to this question, either: can every value
ok, done, bad, die, ignore, reset, N be associated with any action? What would it even mean to say