PAM-SCRIPT(7)

💖 PAM-SCRIPT 💖

okay bestie, so this is pam-script — a PAM module that can invoke scripts within the PAM stack. that's the whole vibe. she's a <pink>PAM module</pink> and she runs your lil scripts inside the PAM stack. iconic behavior fr fr. 🎀

---

✨ SYNOPSIS ✨

pam-script.so [onerr=(success|fail)][dir=/some/path/]

that's literally it. two optional lil knobs. no cap. 🦋

---

🌸 DESCRIPTION 🌸

pam-script lets you execute scripts during authorization, passwd changes, and on session opening or closing. she's everywhere you need her, bestie. 💅

such scripts can perform necessary tasks or influence the outcome of the PAM stack. yes, your lil script has main character energy and can actually change what happens. 😭

for example, if the following entry was included in pam.conf:

sshd auth required  pam_script

then if the script, pam_script_auth, exits with a non-zero value this would cause the user to be denied SSH access to the machine. 💀 so like. your script said no and the door is SHUT. that's the power we're dealing with.

---

✨ OPTIONS ✨

a summary of options is included below. she's not complicated, she's just particular. 👑

• onerr=(success|fail) — the default behavior if the module can not find or execute the script. the default is to <red>fail</red> if the option is not given. so if you don't say anything, she's gonna fail — no script, no entry. dramatic? maybe. correct? yes. 🙈
• dir=/some/path/ — where to find the pam-scripts to invoke for each of the various module-types as described below. the default is dir=/usr/share/libpam-script if not given. so if you don't point her somewhere, that's where she's looking. periodt. 📁

🎀 List of scripts 🎀

here's the whole roster. every single one. don't skip, they all matter:

• pam_script_auth — Executed under auth which handles the authentication stage of establishing the user via some challenge-response (i.e. username/password). yes, the "who even are you" stage. 🔐
• pam_script_acct — invoked under account module-type for non-authentication based account management. she's checking your account, not your password. different vibe entirely. 🧚
• pam_script_passwd — invoked under passwd for changing the password tokens. glow-up season for your credentials. 💅
• pam_script_ses_open — invoked when a session is first opened. welcome in, bestie! 🫶
• pam_script_ses_close — run after a session is first closed. bye babes, doors closed. 🌙

💜 the environment situation 💜

All the scripts will be passed several environment variables:

• PAM_USER
• PAM_RUSER
• PAM_RHOST
• PAM_SERVICE
• PAM_AUTHTOK
• PAM_TTY
• PAM_TYPE — referring to the module-type.

The pam_script.so arguments in the pam.conf will be passed on the command line, which can be used to modify the script behavior. so your config options ride along with the script, cute lil entourage. ✨

---

📁 FILES 📁

• /usr/lib/x86_64-linux-gnu/security/pam_script.so — the PAM module. the moment herself. 👑
• /usr/share/libpam-script — where the scripts should be placed by default. her house. 🏠

---

⭐ VERSION ⭐

pam-script 1.1.8

that's the version, bestie. write it down. 🍓

---

🌈 SEE ALSO 🌈

PAM(7) and the PAM "The System Administrators' Guide"

go read those too, iykyk. they're the prequel. 💖

---

🫶 AUTHOR 🫶

pam-script was written by Jeroen Nijhof <jeroen@jeroennijhof.nl> with some additions and modifications by R.K. Owen, Ph.D. <rkowen@nersc.gov>. legends, both of them, no notes. 🔥

This manual page was written by R.K. Owen <rkowen@nersc.gov>, for the Debian project (but may be used by others). sharing is caring, periodt. 💅

---

and that's the whole page, bestie!! this one's been serving since August 22, 2007 and it's still at <purple>pam-script 1.1.8</purple> — yes the version and date are doing the sign-off, so mwah, hope your PAM stack slays. 🎀✨💖