te
Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved.
The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
pam_unix_auth - PAM authentication module for UNIX

pam_unix_auth.so.1

The pam_unix_auth module implements pam_sm_authenticate(3PAM), which provides functionality to the PAM authentication stack. It provides functions that use crypt(3C) to verify that the password contained in the PAM item PAM_AUTHTOK is the correct password for the user specified in the item PAM_USER. If PAM_REPOSITORY is specified, then user's password is fetched from that repository. Otherwise, the default nsswitch.conf(5) repository is searched for that user.

For accounts in the name services which support automatic account locking, the account may be configured to be automatically locked (see user_attr(5) and policy.conf(5)) after multiple failed login attempts. For accounts that are configured for automatic locking, if authentication failure is to be returned, the failed login counter is incremented upon each failure. If the number of successive failures equals or exceeds RETRIES as defined in login(1), the account is locked and PAM_MAXTRIES is returned. Currently, only the "files" repository (see passwd(5) and shadow(5)) supports automatic account locking. A successful authentication by this module clears the failed login counter and reports the number of failed attempts since the last successful authentication.

Authentication service modules must implement both pam_sm_authenticate() and pam_sm_setcred(). To allow the authentication portion of UNIX authentication to be replaced, pam_sm_setcred() in this module always returns PAM_IGNORE. This module should be stacked with pam_unix_cred(7) to ensure a successful return from pam_setcred(3PAM).

The following options can be passed to the module: nowarn

server_policy nolock The following error codes are returned from pam_sm_authenticate(): PAM_AUTH_ERR PAM_BUF_ERR PAM_IGNORE PAM_MAXTRIES PAM_PERM_DENIED PAM_SUCCESS PAM_SYSTEM_ERR PAM_USER_UNKNOWN

The following error codes are returned from pam_sm_setcred(): PAM_IGNORE

See attributes(7) for descriptions of the following attributes:

ATTRIBUTE TYPE ATTRIBUTE VALUE

Interface Stability Committed

MT Level MT-Safe with exceptions

login (1), passwd (1), crypt (3C), syslog (3C), libpam (3LIB), pam (3PAM), pam_setcred (3PAM), pam_sm_authenticate (3PAM), pam_sm_setcred (3PAM), nsswitch.conf (5), pam.conf (5), passwd (5), policy.conf (5), shadow (5), user_attr (5), attributes (7), pam_authtok_check (7), pam_authtok_get (7), pam_authtok_store (7), pam_dhkeys (7), pam_passwd_auth (7), pam_unix_account (7), pam_unix_cred (7), pam_unix_session (7), The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle.

The pam_unix(7) module is no longer supported. Similar functionality is provided by pam_authtok_check(7), pam_authtok_get(7), pam_authtok_store(7), pam_dhkeys(7), pam_passwd_auth(7), pam_setcred(3PAM), pam_unix_account(7), pam_unix_cred(7), pam_unix_session(7).

If the PAM_REPOSITORY item_type is set and a service module does not recognize the type, the service module does not process any information, and returns PAM_IGNORE. If the PAM_REPOSITORY item_type is not set, a service module performs its default action.