3

According to the official Red Had documentation on pam for the account interface:

account — This module interface verifies that access is allowed. For example, it checks if a user account has expired or if a user is allowed to log in at a particular time of day.

However, similar information (on account validity) is incorporated in /etc/shadow file. As the tldp pages mention, some of the last fields include:

The number of days after password expires that account is disabled

The number of days since January 1, 1970 that an account has been disabled

A reserved field for possible future use

So when does an application (even a PAM-enabled one) reside to when checking account validity?

What happens when rules in /etc/pam.d/application may contradict /etc/shadow?

Improve this question
1
  • I'm not sure but PAM can use different backend in order and it will match the first one in the list making the other usless if another backend then etc/shadow matchs
    – Kiwy
    Commented Sep 8, 2018 at 14:33

1 Answer 1

Reset to default
4

Normally /etc/{group,passwd,shadow} are not used directly, but rather through pam. You can think of pam as kind of a connector that can be configured to use different backends like the /etc/{group,passwd,shadow} things or LDAP to query user information.

To make pam work this way, each backend does have a pam module that can query the backend and retrieve information.
The very basic configuration of pam is to use the pam_unix.so module which retrieves the information from /etc/{group,passwd,shadow} files.

You can also read more about the capabilities of the pam_unix.soin man pam_unix.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .