For the auth section of my PAM configuration, login and mdm etc. call common-auth. I have common-auth calling the following as a substack (as auth substack krb5ldap-cache-auth):

auth optional pam_echo.so Trying UNIX
# Try UNIX, empty passwords OK
auth sufficient pam_unix.so nullok

auth optional pam_echo.so Checking UID
# If the uid < 500 and UNIX didn't work, then die.
auth requisite pam_succeed_if.so uid >= 500 quiet_success

auth optional pam_echo.so Trying Kerberos
# Try Kerberos, using the same password
# If the password is correct (success), then skip next lines
# If the password is wrong (auth_err), then die
# If Kerberos can't connect (?), then ignore
auth [success=2 auth_err=die default=ignore] pam_krb5.so debug use_first_pass

# Try the cache, using the same password
# Last chance.
auth optional pam_echo.so Trying cache
auth [success=done default=die] pam_ccreds.so action=validate use_first_pass

# Kerberos validated our password.
auth optional pam_echo.so Kerberos validated
# Store the password hash.
auth optional pam_ccreds.so action=store use_first_pass
# See if we can mount user drives, since we have a Kerberos token.
auth optional pam_mount.so
auth optional pam_echo.so Done.

(Using pam_echo.so just for debugging.)

This seems to work fine for successful authentication. The substack mechanism is convenient, because I can use "sufficient" and "done" to terminate the substack without terminating the larger stack.

But for failing authentication, the larger stack continues (for example, mdm will uselessly call pam_gnome_keyring.so, login will uselessly call pam_group.so) when it ought to die.

Is there a way of calling a substack so that if the substack fails, the stack will die? I tried auth requisite substack krb5ldap-cache-auth but that's just bad PAM syntax.


From the PAM administrator's guide:


Include all lines of given type from the configuration file specified as an argument to this control. This differs from include in that evaluation of the done and die actions in a substack does not cause skipping the rest of the complete module stack, but only of the substack.

Reading your question, it seems to me like you are looking for include and not substack. Therefore you should probably replace...

auth substack krb5ldap-cache-auth


auth include krb5ldap-cache-auth

On a Debian system however, you might have to use this instead:

@include krb5ldap-cache-auth

Also, on RedHat systems and derivatives, you might even have to use pam_stack, which is often considered to be deprecated (I believe due to issues in handling include recursions) :

auth requisite pam_stack.so service=krb5ldap-cache-auth

In these cases, if anything triggers a done or die action in krb5ldap-cache-auth, PAM will put an end to the entire stack, and not just the substack.

  • Where is that @include syntax documented?? – Robert Siemer Dec 10 '17 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.