I'm writing custom pam rules to restrict/define how users can login to my linux host over the serial console.

If the user guest logs in, I want his password to be verified by pam_unix.so, whereas for any other user, I want my custom authentication program to perform the same task and be the final word on authentication i.e. I don't want any subsequent pam modules to be invoked at all.

Here's my minimal working /etc/pam.d/login file.

# On success skip the next rule
auth [success=1 default=ignore] pam_succeed_if.so user in guest
auth [success=done default=ignore] pam_exec.so expose_authtok /usr/bin/custom-pam.sh
auth [success=1 default=ignore] pam_unix.so nullok 
auth requisite pam_deny.so
auth required pam_permit.so

The above config works as expected when I login as guest (and /var/log/journal also confirms this) but fails for other users.

If /usr/bin/custom-pam.sh exits with 0, I expect processing of further modules to stop. From my understanding, success=done should immediately return but that isn't happening.


Have you tried the PAM sufficient control? Per pam.conf(5)

       if such a module succeeds and no prior required module has failed
       the PAM framework returns success to the application or to the
       superior PAM stack immediately without calling any further modules
       in the stack. A failure of a sufficient module is ignored and
       processing of the PAM module stack continues unaffected.

This should stop the processing at your custom line:

auth sufficient pam_exec.so expose_authtok /usr/bin/custom-pam.sh

unless it fails, which could be handled by a subsequent nope-denying-you-here line.

  • Thanks @thrig. I totally missed the sufficient control option. It works now. – linuxfan Sep 25 '17 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.