According to the official Red Had documentation on
pam for the
account — This module interface verifies that access is allowed. For example, it checks if a user account has expired or if a user is allowed to log in at a particular time of day.
However, similar information (on account validity) is incorporated in
/etc/shadow file. As the
tldp pages mention, some of the last fields include:
The number of days after password expires that account is disabled
The number of days since January 1, 1970 that an account has been disabled
A reserved field for possible future use
So when does an application (even a PAM-enabled one) reside to when checking account validity?
What happens when rules in
/etc/pam.d/application may contradict