I just read the pam.d man page. It states:

required: failure of such a PAM will ultimately lead to the PAM-API returning failure [...]


requisite: like required, [...]


sufficient: success of such a module is enough to satisfy the authentication requirements of the stack of modules (if a prior required module has failed the success of this one is ignored).

. The description of sufficient doesn't state that it will also be ignored for prior failed requisites. Will it?


requisite immediately returns to the app (or to the superstack) on failure. As such, a subsequent sufficient isn't even processed if a prior requisite failed.

requisite: like required, however, in the case that such a module returns a failure, control is directly returned to the application or to the superior PAM stack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.