PAM-AUTH-UPDATE(8)

✨ PAM-AUTH-UPDATE(8) — NAME ✨

okay so bestie, this is the manual for pam-auth-update, the tool that lets you manage PAM configuration using packaged profiles 💅🔐

🎀 NAME

pam-auth-update - manage PAM configuration using packaged profiles 🌸

🦋 SYNOPSIS

pam-auth-update [--package [--remove profile [profile...]]]  [--force]
[--enable profile [profile...]]  [--disable profile [profile...]]

💖 DESCRIPTION

okay so pam-auth-update is a utility that lets you configure the central authentication policy for the system using pre-defined profiles that come from PAM module packages. it's giving organized 🧚

profiles shipped in the /usr/share/pam-configs/ directory are the ones that specify the modules (plus their options) to enable, the preferred ordering compared to other profiles, and whether a profile should be enabled by default. so iconic ✨

packages that provide PAM modules register their profiles at install time by calling pam-auth-update --package. picking profiles is done through the standard debconf interface. the profile selection question gets asked at medium'</lavender> priority when packages are added or removed, so no user interaction is required by default 🙈 users can also invoke pam-auth-update` directly to change their authentication configuration whenever they want 💜

the script makes every effort to respect local changes to /etc/pam.d/common-*. local modifications to the list of module options will be preserved, BUT additions of modules within the managed portion of the stack will make pam-auth-update treat the config files as locally modified, and it won't make further changes to them unless you give it the --force option 😭

if you tell pam-auth-update to override local configuration changes, the locally-modified files get saved in /etc/pam.d/ with a suffix of .pam-old. save your stuff, bestie 🫶

🌈 OPTIONS

• --package — this tells pam-auth-update that the caller is a package maintainer script. it lowers the priority of debconf questions to `medium' so the user doesn't get prompted by default 🍓
• --disable profile [profile...] — disables the specified profiles in the system configuration. system admin scripts can use this to switch profiles off 🌙
• --enable profile [profile...] — enables the specified profiles in the system configuration. this is how you turn on profiles that aren't on by default ⭐
• --remove profile [profile...] — removes the specified profiles from the system configuration. the vibe: always run pam-auth-update --remove BEFORE the modules they reference get deleted from disk, so PAM stays consistent and usable the whole time during package upgrades or removals 🔥
• --force — overwrites the current PAM configuration without prompting. ⚠️ this one must NOT be used by package maintainer scripts; it's for administrators only 💀

📂 FILES

• /etc/pam.d/common-* — global PAM configuration, affecting all installed services 🎀
• /usr/share/pam-configs/ — package-supplied authentication profiles 🧚

👑 AUTHOR

Steve Langasek <steve.langasek@canonical.com> 💜

🌸 COPYRIGHT

Copyright (C) 2008 Canonical Ltd. 🦋

🔗 SEE ALSO

PAM(7), pam.d(5), debconf(7) ✨

---

that's the whole tea, bestie 🫶 this page was from Debian, version 08/23/2008, and it's the manual for PAM-AUTH-UPDATE(8). periodt 💅💖