PWACCESSD.CONF(5)

✨ pwaccessd.conf — the manual page, section 5 ✨

okay bestie, buckle up 💖 this is pwaccessd.conf(5), the config file for pwaccessd. yes the number 5 means it's a file format page, iykyk.

🌸 NAME 🌸

pwaccessd.conf — the configuration file for pwaccessd, fr fr 💅

🎀 SYNOPSIS 🎀

/etc/account-utils/pwaccessd.conf

/etc/account-utils/pwaccessd.conf.d/*.conf

/usr/share/account-utils/pwaccessd.conf

/usr/share/account-utils/pwaccessd.conf.d/*.conf

🦋 DESCRIPTION 🦋

So pwaccessd.conf is literally the file that configures pwaccessd(8) — the service that hands out passwd and shadow info, verifies passwords, and checks whether an account has expired. she does it all, no cap 👑

---

💜 CONFIGURATION DIRECTORIES AND PRECEDENCE 💜

girl the config is read following the UAPI Configuration Files Specification[1]. and here's the tea: the main config file pwaccessd.conf gets looked up inside the account-utils namespace, below these directories — and they're listed from lowest to highest precedence, so the bottom one wins:

• /usr/share/account-utils/ — vendor defaults that ship with the distribution package. bestie, do not edit files here, the admin should leave them alone because package updates may just overwrite them 😭
• /etc/account-utils/ — local administrator configuration. settings here take precedence over the vendor defaults, and this is the recommended place for your local changes 🫶

and that's not all — besides the main config file, drop-in files with a .conf suffix get read from a pwaccessd.conf.d/ directory sitting right next to the main file in each of those directories above (for example /etc/account-utils/pwaccessd.conf.d/ and /usr/share/account-utils/pwaccessd.conf.d/).

All files are merged into a single configuration. one big happy config family 🌈

---

🌟 FILE FORMAT 🌟

the file uses a simple INI-style syntax. it's organized into sections (groups) and key=value assignments. everything after a # character counts as a comment and gets ignored, and leading and trailing whitespace around values gets stripped. ✨

for each setting, pwaccessd first looks in the section that matches the affected operation. if the key isn't there, it falls back to the [global] section. this is the moment bestie: it lets you set a default in [global] and override it per operation 💅

👑 SECTIONS 👑

these are the sections that get recognized. the per-operation sections correspond to the Varlink methods of the same name provided by pwaccessd(8). cute matching sets ✨

• [global] — default values used as a fallback for all operations when a key isn't set in the operation specific section.
• [ExpiredCheck] — applies to requests which check whether the password or account of a user has expired.
• [GetUserRecord] — applies to requests which return the passwd and shadow record of an account.
• [VerifyPassword] — applies to requests which verify the password of an account.

💖 VARIABLES 💖

• allow — a comma-separated list of users who are granted access to the operation of the enclosing section beyond their own account, in addition to root. each entry is either a user name or a numeric UID, and whitespace around the entries is ignored. account names which cannot be resolved to a valid UID are skipped. the UID 0 (root) is always allowed and is therefore ignored if listed explicitly (root doesn't need your permission bestie, she's root 💅). this key is honored in the [GetUserRecord], [VerifyPassword] and [ExpiredCheck] sections. if it isn't set in the relevant section, the value from the [global] section is used. if it's set in neither, only the account owner and root have access.
• SpMin — a boolean value which controls whether the minimum password age (the sp_min field of the shadow(5) entry) is taken into account during the expiration check. when enabled, a password that is younger than sp_min days is reported as not yet changeable. this key is read from the [ExpiredCheck] section and, if not set there, from the [global] section. if it's set in neither, the built-in default false is used.

---

🌈 EXAMPLE 🌈

Example 1. /etc/account-utils/pwaccessd.conf

[global]
# For mariadb:user mysql/mariadb needs to authenticate as database
# user so that the database user can get access to the database.
allow = mysql

[VerifyPassword]
# Only 'auth-service', the user with the UID 471 and may verify
# passwords, this overrides the value from [global] for this
# operation
allow = auth-service, 471

[ExpiredCheck]
# Use the minimum password age for the expiration check
SpMin = true

🫶 SEE ALSO 🫶

pwaccessd(8), pam_unix_ng(8), passwd(5), shadow(5)

UAPI Configuration Files Specification[1]

🧚 NOTES 🧚

1. UAPI Configuration Files Specification https://uapi-group.org/specifications/specs/configuration_files_specification/

---

okay that's the whole thing, you ate that 💅 the source/version is account-utils 1.4.0 and it's dated 07/17/2026, so go forth and configure responsibly, bestie — mwah 💖🌸✨