According to the official Red Had documentation on pam for the account interface:

account — This module interface verifies that access is allowed. For example, it checks if a user account has expired or if a user is allowed to log in at a particular time of day.

However, similar information (on account validity) is incorporated in /etc/shadow file. As the tldp pages mention, some of the last fields include:

The number of days after password expires that account is disabled

The number of days since January 1, 1970 that an account has been disabled

A reserved field for possible future use

So when does an application (even a PAM-enabled one) reside to when checking account validity?

What happens when rules in /etc/pam.d/application may contradict /etc/shadow?

  • I'm not sure but PAM can use different backend in order and it will match the first one in the list making the other usless if another backend then etc/shadow matchs – Kiwy Sep 8 '18 at 14:33

Normally /etc/{group,passwd,shadow} are not used directly, but rather through pam. You can think of pam as kind of a connector that can be configured to use different backends like the /etc/{group,passwd,shadow} things or LDAP to query user information.

To make pam work this way, each backend does have a pam module that can query the backend and retrieve information.
The very basic configuration of pam is to use the pam_unix.so module which retrieves the information from /etc/{group,passwd,shadow} files.

You can also read more about the capabilities of the pam_unix.soin man pam_unix.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.