Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What steps does the system go through when handling an SSH connection?

  1. We try to log in via ssh
  2. sshd starts pam and pam module to authenticate us
  3. Depending on pam configuration, we need to provide username and password (pam checks passwd and shadow files)
  4. pam checks for hosts.allow/deny, /etc/shells, and other things
  5. If everything goes fine we are logged in
  6. ???
  7. Shell is started

So my question is what mechanism is responsible for checking which shell is assigned to the user in their passwd file (in step 6)? Is it pam itself, some specific pam module, sshd, or something else? I know that I can replace the passwd file (for checking username and password) by writing a pam module, but how can I replace the passwd file for the shell entry?

share|improve this question
up vote 7 down vote accepted

As far as I know, PAM doesn't determine the user's shell, this is left to the application. PAM's session modules perform generic actions and checks that must be done for on every login using that particular service. If the application then wants to start a shell, it is free to do so, and will typically look up the shell in the user database.

Assuming your question is about OpenSSH, that's exactly what it does: once the user is authenticated, and the PAM session stuff has been done (if configured to use PAM¹), the ssh server looks up the shell in the user database (directly, not through the PAM library).

The user database isn't limited to /usr/passwd and friends. On Linux (which I assume you're using since you mention shadow), what makes up the user database is determined by the passwd setting in /etc/nsswitch.conf. In multi-computer setups, common additions to the local database are NIS and LDAP. If you want to use a shell that isn't the one in /etc/passwd, this may be what to configure (although it would be a bit strange, and maybe people can offer better suggestions if you tell us what you're trying to accomplish).

If you want to have users without full shell access, the natural solution is to change /etc/passwd to put a restricted shell — perhaps rssh to allow only a few file-copying-type applications such as scp, rsync and cvs. You can also use forced commands in the user's ~/.ssh/authorized_keys file.

If you'd like to see a trace of what the ssh server is doing, start the daemon as ssh -ddd. You can also get the client's view with ssh -vvv, though here the server's view is what will interest you most.

¹ OpenSSH only uses PAM if it is configured with PAM support and the UsePAM directive is set to yes in sshd_config. Even when it uses PAM, it offers other authentication methods in addition to PAM; in particular public key authentication does not go through PAM.

share|improve this answer
I want to allow users of my aplication to log in to shell as normal user without creating account in system. Users data (username, pass and shell) will be stored in sqlite db. First step is sqlite pam module that authenticate users agains db. Second step is to provide shell readed from database. So I think It could be accomplished by writing proper nis module. Thans for answer... – pbm Nov 14 '10 at 17:11
@pbm: I don't think you want nis, rather db (or perhaps a custom module). – Gilles Nov 14 '10 at 17:20
it's typo.. I meant "by writing proper (custom) nss module"... – pbm Nov 14 '10 at 17:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.