I'm writing custom pam rules to restrict/define how users can login to my linux host over the serial console.
If the user guest logs in, I want his password to be verified by
pam_unix.so, whereas for any other user, I want my custom authentication program to perform the same task and be the final word on authentication i.e. I don't want any subsequent pam modules to be invoked at all.
Here's my minimal working
# On success skip the next rule auth [success=1 default=ignore] pam_succeed_if.so user in guest auth [success=done default=ignore] pam_exec.so expose_authtok /usr/bin/custom-pam.sh auth [success=1 default=ignore] pam_unix.so nullok auth requisite pam_deny.so auth required pam_permit.so
The above config works as expected when I login as guest (and
/var/log/journal also confirms this) but fails for other users.
/usr/bin/custom-pam.sh exits with 0, I expect processing of further modules to stop. From my understanding,
success=done should immediately return but that isn't happening.