Some documentations, blogs and forums and other examples on the web use pam_unix2 in /etc/pam.d/ configurations. An example taken from pam_winbind manpage:

auth      required        pam_env.so
auth      sufficient      pam_unix2.so
auth      required        pam_winbind.so  use_first_pass
account   requisite       pam_unix2.so
account   required        pam_winbind.so  use_first_pass
password  sufficient      pam_winbind.so
password  requisite       pam_pwcheck.so  cracklib
password  required        pam_unix2.so    use_authtok
session   required        pam_unix2.so
session   required        pam_winbind.so

It seems pam_unix2 was merely meant to: additionally support bcrypt Blowfish-based password hashing (Debian RFP #237856).

The manpages are: pam_unix and pam_unix2

What is the difference between pam_unix.so and pam_unix2.so ? Which are still used? maintained? relevant ?

1 Answer 1


The package was originaly created by Thorsten Kukuk from SuSE. The original upstream FTP repository has disappeared (according to debian watch file it was ftp.suse.com/people/kukuk/pam/pam_unix2/... some mirrors still exist)

It seems that SuSE used and maintained that fork for a while, but it seems that Red Hat/CentOS/Scientific Linux never provided it RFE #173002. Also, Debian/Ubuntu provided it as an extra package, but it was removed from Jessie because it's buggy and unmaintained (Grave bug => autoremoval => supported debian dists with pam_unix2)

OpenSUSE still provides pam_unix2 (2.9.1) in their pam-modules package. In OpenSuSE Factory, pam-modules Version: 12.1 Release: 73.9, it says "This package contains additional, obsolete PAM Modules sometimes needed for migration: pam_unix2 and pam_pwcheck" (link)

Nowadays, pam_unix supports blowfish.

pam_unix2 seems unmaintained (opensuse use pam_unix2 version 2.9.1, which is 3 years old).

Finally, pam_unix2 lacks many pam_unix options.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .