I am trying to implement a PAM for Linux which gets invoked for sudo operations, the purpose of it is to ask the user for SMS sent to his mobile right after he enters a password when performing sudo operation in cmd, I guess this password is asked by common-auth PAM which is default PAM in Linux and this plain password entered by the user is validated by this common-auth PAM by converting into a hash and then comparing it with hash from the shadow file. Now after this common-auth PAM authentication my custom PAM is getting invoked but I am not getting hold or access to the plain password that user entered (This is important because I need to make an API call with this plain username and password of the user in my custom PAM), how can I get access of the plain password that user has entered after sudo? Can we enable passing of plain password from common-auth PAM to my custom PAM?

I'm trying to implement a custom PAM which acts as Multi Factor Authentication when user tries to SUDO. So, I need to send these user credentials to an API which sends an SMS (OTP) to my mobile. I have a C program which sends API request and I need to pass the password into that program.

I got access to username from the "pwd.h" file. But, couldn't access the password.


In a PAM module, the way to get the user’s authentication token is pam_get_authtok.

However, passing passwords around is usually a bad idea; does your SMS-sending service really need to know the user’s password? (I’m not looking for an answer, just suggesting it’s worth questioning that.)

  • Yeah, I need to use the same credentials with the provider.
    – Umesh
    Aug 28 '20 at 14:17
  • 1
    I understand that, and like I said, I wasn’t looking for an answer. Having to deal with user passwords like this is really asking for trouble in the medium to long term; we’ve had good SSO and two-factor authentication systems for many years that don’t involve anything like this. Aug 28 '20 at 14:20
  • Thanks for your help, I resolved my problem with pam_get_authtok.
    – Umesh
    Sep 2 '20 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.