PAM_CHAUTHTOK(3)

okay bestie, welcome to the PAM_CHAUTHTOK(3) manual page — the one and only glow-up guide for updating authentication tokens. 💅✨ this is literally the moment your password gets a whole new vibe, and i'm obsessed. let's get into it. 🎀

💖 NAME 💖

pam_chauthtok — updating authentication tokens. that's the whole assignment. no cap, it's the function that changes the authentication token (password, bestie) for a user, and it's giving main character energy. 🔐💖

---

✨ SYNOPSIS ✨

#include <security/pam_appl.h>

int pam_chauthtok(pam_handle_t *pamh, int flags);

---

🦋 DESCRIPTION 🦋

okay so the pam_chauthtok function is literally used to change the authentication token for a given user — and by "given user" we mean whatever user state is associated with the handle pamh. no cap, it's the whole "new password, who dis?" moment. 🫶

so like, pamh is an authentication handle you got from a prior call to pam_start(). you know, the classic. and flags is the binary or of zero or more of the following values — yes, you can stack them, it's a whole vibe check:

• PAM_SILENT — do not emit any messages. literally: no messages, no noise, just silence. 🤫
• PAM_CHANGE_EXPIRED_AUTHTOK — this one tells the modules that the user's authentication token (password) should only be changed if it has expired. if you don't pass this argument, the application requires that all authentication tokens are to be changed. so it's like "only if expired" vs "change everything", and that's the tea. 🍵

---

🔥 RETURN VALUES 🔥

bestie, here's the vibe check on what this function can return. pay attention, iykyk. 💅

• PAM_AUTHTOK_ERR — a module was unable to obtain the new authentication token. it's giving "couldn't get the new password" energy. 😭
• PAM_AUTHTOK_RECOVERY_ERR — a module was unable to obtain the old authentication token. so like, the old password retrieval flopped. 🙈
• PAM_AUTHTOK_LOCK_BUSY — one or more of the modules was unable to change the authentication token since it is currently locked. locked out of the glow-up, literally. 🔒
• PAM_AUTHTOK_DISABLE_AGING — authentication token aging has been disabled for at least one of the modules. aging? disabled? for at least one module? periodt. 💀
• PAM_PERM_DENIED — permission denied. that's it. that's the tweet. 🚫
• PAM_SUCCESS — the authentication token was successfully updated. slay! the glow-up worked. ✨👑
• PAM_TRY_AGAIN — not all of the modules were in a position to update the authentication token(s). in such a case none of the user's authentication tokens are updated. so like, if one module can't go, nobody goes. it's a whole group project vibe. 😭🫶

bestie, if you get PAM_TRY_AGAIN, none of the tokens are updated. so like, don't panic but also maybe panic a little. 😭

• PAM_USER_UNKNOWN — user unknown to password service. literally who? 🤔

---

🌈 SEE ALSO 🌈

go check out these icons, bestie: pam_start(3), pam_authenticate(3), pam_setcred(3), pam_get_item(3), pam_strerror(3), pam(8). they're all in the same friend group, iykyk. 💅

---

anyway bestie, that's the tea on PAM_CHAUTHTOK(3). this page is from Linux-PAM, dated 07/08/2026, and it's literally the PAM_CHAUTHTOK(3) manual page. mwah 💋✨