This configuration was tested on Ubuntu 16.04.1 LTS Server. Modify
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_succeed_if.so user = the_username
auth requisite pam_deny.so
auth required pam_permit.so
success=x portion tells PAM to skip
x rules on success.
- Substitute the real username for
So, all users first try to authenticate with
pam_unix.so, which requires a correct username and password in order to succeed. If authentication succeeds with
pam_unix.so, then proceed to
pam_permit.so. That's the default behavior.
If authentication failed with
pam_unix.so, proceed to
pam_succeed_if.so, which succeeds whenever a user enters the username of
the_username, using whatever password was entered. If both
pam_succeed_if.so fail, then proceed to
pam_deny.so; otherwise, proceed to
A word of caution: be very careful on a live system because it's easy to make a mistake and lock yourself out, probably requiring a fix via rescue media.