PAM-CONFIG(8)

📦 version 2.13+git.20250715, in opensuse-leap 16.0

🎀 PAM-CONFIG(8) 🎀

okay so welcome to the Reference Manual page for pam-config, bestie 💖 this is the part where the system's PAM config files get adjusted, and honestly? it's giving "small tool, big responsibility." let's get into it 🦋

✨ NAME ✨

pam-config — adjusts common PAM config files 💅

🌸 SYNOPSIS 🌸

       pam-config [--debug] [--list-modules] [--service service-name] -a | -c |
                  -d | -q  [-f] [module-name]

       pam-config --version

💜 DESCRIPTION 💜

pam-config adjusts predefined PAM config files. that's the whole sentence, no cap ✨ it's the little tool that goes in and edits the config files that were already set up for you 🫶

🔥 OPTIONS 🔥

💫 COMMON OPTIONS 💫

--debug — prints debug messages 🐛 so you can actually see what's going on
-f, --force — the new configuration gets activated regardless of whether there are other local changes. yeah, it does not care, it's giving main character energy 💀
--list-modules — prints a list of all supported modules to stdout 📋
--nullok — adds nullok to all modules which support this 🕳️
--pam-debug — adds debug to all modules which support this 🔍
--confdir directory — use a custom configuration directory 📁
--initialize — converts the old config and creates a new one 🧚
--update — reads the current config and writes them new 🔄

🦋 MODIFIER OPTIONS 🦋

use these to specify the action you want pam-config to apply, bestie. they need to be followed by a supported module option — like, non-negotiable. see the section called "SUPPORTED PAM MODULES" 👑

-a, --add — adds options or new PAM modules to the existing PAM configuration files ➕
-c, --create — creates new PAM configuration files for plain UNIX authentication, overwriting the existing ones ⚠️ (yes, overwriting — drama)
-d, --delete — removes options or PAM modules from the existing PAM configuration files ➖
-q, --query — prints a list of types and the corresponding module options for the queried PAM module 🔎
--verify — does some sanity checks on the current common PAM configuration files ✅

👑 SUPPORTED PAM MODULES 👑

this is the list of modules pam-config supports. they're split into two categories: global and single service modules 🌈

🌟 GLOBAL MODULES 🌟

the global modules get inserted into the common-{account,auth,password,session} files, which are included by the single service files 💫

🚪 pam_access

--access — pam_access, for account access rules
--access-debug — adds debug to all pam_access.so invocations
--access-nodefgroup — adds nodefgroup to all pam_access.so invocations
--access-noaudit — adds noaudit to all pam_access.so invocations
--access-accessfile=value — adds accessfile=value option to pam_access.so
--access-fieldsep=value — adds fieldsep=value option to pam_access.so
--access-listsep=value — adds listsep=value option to pam_access.so

🛡️ pam_apparmor

--apparmor — enable/disable pam_apparmor.so
--apparmor-debug — adds debug to all pam_apparmor.so invocations

🍪 pam_ccreds

--ccreds — enable/disable pam_ccreds.so

🔐 pam_cracklib

--cracklib — enable/disable pam_cracklib.so
--cracklib-debug — adds debug to all pam_cracklib.so invocations
--cracklib-reject_username — adds reject_username to all pam_cracklib.so invocations
--cracklib-gecoscheck — adds gecoscheck to all pam_cracklib.so invocations
--cracklib-enforce_for_root — adds enforce_for_root to all pam_cracklib.so invocations
--cracklib-authtok_type=value — adds authtok_type=value option to pam_cracklib.so
--cracklib-retry=value — adds retry=value option to pam_cracklib.so
--cracklib-difok=value — adds difok=value option to pam_cracklib.so
--cracklib-difignore=value — adds difignore=value option to pam_cracklib.so
--cracklib-minlen=value — adds minlen=value option to pam_cracklib.so
--cracklib-dcredit=value — adds dcredit=value option to pam_cracklib.so
--cracklib-ucredit=value — adds ucredit=value option to pam_cracklib.so
--cracklib-lcredit=value — adds lcredit=value option to pam_cracklib.so
--cracklib-ocredit=value — adds ocredit=value option to pam_cracklib.so
--cracklib-minclass=value — adds minclass=value option to pam_cracklib.so
--cracklib-dictpath=value — adds dictpath=value option to pam_cracklib.so
--cracklib-maxrepeat=value — adds maxrepeat=value option to pam_cracklib.so
--cracklib-maxsequence=value — adds maxsequence=value option to pam_cracklib.so
--cracklib-maxclassrepeat=value — adds maxclassrepeat=value option to pam_cracklib.so

🗄️ pam_ecryptfs

--ecryptfs — enable/disable pam_ecryptfs.so
--ecryptfs-unwrap — adds unwrap to all pam_ecryptfs.so invocations

🌱 pam_env

--env — enable/disable pam_env.so
--env-debug — adds debug to all pam_env.so invocations
--env-conffile=value — adds conffile=value option to pam_env.so
--env-envfile=value — adds envfile=value option to pam_env.so
--env-readenv=value — adds readenv=value option to pam_env.so

⚡ pam_exec

--exec — pam_exec, for password management
--exec-debug — adds debug to all pam_exec.so invocations
--exec-expose_authtok — adds expose_authtok to all pam_exec.so invocations
--exec-seteuid — adds seteuid to all pam_exec.so invocations
--exec-quiet — adds quiet to all pam_exec.so invocations
--exec-log=value — adds log=value option to pam_exec.so
--exec-option=value — adds option=value option to pam_exec.so

⏳ pam_faildelay

--faildelay — enable/disable pam_faildelay.so
--faildelay-debug — adds debug to all pam_faildelay.so invocations
--faildelay-delay=value — adds delay=value option to pam_faildelay.so

🫆 pam_fp

--fp — enable/disable pam_fp.so
--fp-debug — adds debug to all pam_fp.so invocations

🫆 pam_fprint

--fprint — enable/disable pam_fprint.so
--fprint-debug — adds debug to all pam_fprint.so invocations

🫆 pam_fprintd

--fprintd — enable/disable pam_fprintd.so
--fprintd-debug — adds debug to all pam_fprintd.so invocations

🔒 pam_fscrypt

--fscrypt — enable/disable pam_fscrypt.so

🔑 pam_gnome_keyring

--gnome_keyring — enable/disable pam_gnome_keyring.so
--gnome_keyring-auto_start — adds auto_start to all pam_gnome_keyring.so invocations
--gnome_keyring-only_if=value — adds only_if=value option to pam_gnome_keyring.so

👥 pam_group

--group — enable/disable pam_group.so

🌤️ pam_himmelblau

--himmelblau — enable/disable pam_himmelblau.so
--himmelblau-debug — adds debug to all pam_himmelblau.so invocations

🪪 pam_kanidm

--kanidm — enable/disable pam_kanidm.so
--kanidm-debug — adds debug to all pam_kanidm.so invocations

🎫 pam_krb5

--krb5 — enable/disable pam_krb5.so
--krb5-debug — adds debug to all pam_krb5.so invocations
--krb5-ignore_unknown_principals — adds ignore_unknown_principals to all pam_krb5.so invocations
--krb5-minimum_uid=value — adds minimum_uid=value option to pam_krb5.so

🗝️ pam_kwallet5

--kwallet5 — enable/disable pam_kwallet5.so

🕰️ pam_lastlog2

--lastlog2 — enable/disable pam_lastlog2.so
--lastlog2-debug — adds debug to all pam_lastlog2.so invocations
--lastlog2-silent — adds silent to all pam_lastlog2.so invocations
--lastlog2-database=value — adds database=value option to pam_lastlog2.so
--lastlog2-silent_if=value — adds silent_if=value option to pam_lastlog2.so

📇 pam_ldap

--ldap — enable/disable pam_ldap.so
--ldap-debug — adds debug to all pam_ldap.so invocations

📊 pam_limits

--limits — enable/disable pam_limits.so
--limits-debug — adds debug to all pam_limits.so invocations
--limits-change_uid — adds change_uid to all pam_limits.so invocations
--limits-utmp_early — adds utmp_early to all pam_limits.so invocations
--limits-conf=value — adds conf=value option to pam_limits.so

🏠 pam_localuser

--localuser — enable/disable pam_localuser.so
--localuser-debug — adds debug to all pam_localuser.so invocations
--localuser-file=value — adds file=value option to pam_localuser.so

📂 pam_mkhomedir

--mkhomedir — enable/disable pam_mkhomedir.so
--mkhomedir-debug — adds debug to all pam_mkhomedir.so invocations
--mkhomedir-silent — adds silent to all pam_mkhomedir.so invocations
--mkhomedir-umask=value — adds umask=value option to pam_mkhomedir.so
--mkhomedir-skel=value — adds skel=value option to pam_mkhomedir.so

🧪 pam_mktemp

--mktemp — enable/disable pam_mktemp.so
--mktemp-debug — adds debug to all pam_mktemp.so invocations

🏷️ pam_nam

--nam — enable/disable pam_nam.so

🔑 pam_passwdqc

--passwdqc — enable/disable pam_passwdqc.so
--passwdqc-ask_oldauthtok — adds ask_oldauthtok to all pam_passwdqc.so invocations
--passwdqc-check_oldauthtok — adds check_oldauthtok to all pam_passwdqc.so invocations
--passwdqc-use_first_pass — adds use_first_pass to all pam_passwdqc.so invocations
--passwdqc-use_authtok — adds use_authtok to all pam_passwdqc.so invocations
--passwdqc-min=value — adds min=value option to pam_passwdqc.so
--passwdqc-max=value — adds max=value option to pam_passwdqc.so
--passwdqc-passphrase=value — adds passphrase=value option to pam_passwdqc.so
--passwdqc-match=value — adds match=value option to pam_passwdqc.so
--passwdqc-similar=value — adds similar=value option to pam_passwdqc.so
--passwdqc-random=value — adds random=value option to pam_passwdqc.so
--passwdqc-enforce=value — adds enforce=value option to pam_passwdqc.so
--passwdqc-retry=value — adds retry=value option to pam_passwdqc.so

🪪 pam_pkcs11

--pkcs11 — enable/disable pam_pkcs11.so
--pkcs11-debug — adds debug to all pam_pkcs11.so invocations
--pkcs11-configfile=value — adds configfile=value option to pam_pkcs11.so

🔑 pam_pwcheck

--pwcheck — enable/disable pam_pwcheck.so module in the password section
--pwcheck-debug — adds debug to all pam_pwcheck.so invocations
--pwcheck-nullok — adds nullok to all pam_pwcheck.so invocations

okay so we're still deep in OPTIONS and honestly? there's a lot of them 💀 but every single one matters, so let's go, no skipping, we're eating this whole list 🍓

--pwcheck-cracklib — adds the cracklib option to pam_pwcheck.so ✨
--pwcheck-no_obscure_checks — adds no_obscure_checks to pam_pwcheck.so
--pwcheck-enforce_for_root — adds enforce_for_root to pam_pwcheck.so 🔥
--pwcheck-cracklib_path=path — adds cracklib_path=path to pam_pwcheck.so
--pwcheck-maxlen=N — adds maxlen=N to pam_pwcheck.so
--pwcheck-minlen=N — adds minlen=N to pam_pwcheck.so
--pwcheck-tries=N — adds tries=N to pam_pwcheck.so
--pwcheck-remember=N — adds remember=N to pam_pwcheck.so

--pwhistory — enables/disables pam_pwhistory.so 👑
--pwhistory-debug — adds debug to all pam_pwhistory.so invocations
--pwhistory-use_authtok — adds use_authtok to all pam_pwhistory.so invocations
--pwhistory-enforce_for_root — adds enforce_for_root to all pam_pwhistory.so invocations
--pwhistory-remember=value — adds remember=value to pam_pwhistory.so
--pwhistory-retry=value — adds retry=value to pam_pwhistory.so
--pwhistory-authtok_type=value — adds authtok_type=value to pam_pwhistory.so
--pwhistory-file=value — adds file=value to pam_pwhistory.so

--pwquality — enables/disables pam_pwquality.so 🦋
--pwquality-debug — adds debug to all pam_pwquality.so invocations
--pwquality-reject_username — adds reject_username to all pam_pwquality.so invocations
--pwquality-gecoscheck — adds gecoscheck to all pam_pwquality.so invocations
--pwquality-enforce_for_root — adds enforce_for_root to all pam_pwquality.so invocations
--pwquality-local_users_only — adds local_users_only to all pam_pwquality.so invocations
--pwquality-use_authtok — adds use_authtok to all pam_pwquality.so invocations
--pwquality-authtok_type=value — adds authtok_type=value to pam_pwquality.so
--pwquality-retry=value — adds retry=value to pam_pwquality.so
--pwquality-difok=value — adds difok=value to pam_pwquality.so
--pwquality-minlen=value — adds minlen=value to pam_pwquality.so
--pwquality-dcredit=value — adds dcredit=value to pam_pwquality.so
--pwquality-ucredit=value — adds ucredit=value to pam_pwquality.so
--pwquality-lcredit=value — adds lcredit=value to pam_pwquality.so
--pwquality-ocredit=value — adds ocredit=value to pam_pwquality.so
--pwquality-minclass=value — adds minclass=value to pam_pwquality.so
--pwquality-dictpath=value — adds dictpath=value to pam_pwquality.so
--pwquality-maxrepeat=value — adds maxrepeat=value to pam_pwquality.so
--pwquality-maxsequence=value — adds maxsequence=value to pam_pwquality.so
--pwquality-maxclassrepeat=value — adds maxclassrepeat=value to pam_pwquality.so
--pwquality-dictcheck=value — adds dictcheck=value to pam_pwquality.so
--pwquality-usercheck=value — adds usercheck=value to pam_pwquality.so
--pwquality-enforcing=value — adds enforcing=value to pam_pwquality.so
--pwquality-badwords=value — adds badwords=value to pam_pwquality.so

like, that's the whole password-quality buffet, we love a thorough queen 💅

--selinux — enables/disables pam_selinux.so
--selinux-debug — adds debug to all pam_selinux.so invocations
--ssh — enables/disables pam_ssh.so 🧚
--ssh-debug — adds debug to all pam_ssh.so invocations
--ssh-nullok — adds nullok to all pam_ssh.so invocations
--ssh-keyfiles=value — adds keyfiles=value to pam_ssh.so
--sss — enables/disables pam_sss.so
--sss-debug — adds debug to all pam_sss.so invocations

--systemd — enables/disables pam_systemd.so ⭐
--systemd-debug — adds debug to all pam_systemd.so invocations
--systemd-kill_session_processes=value — adds kill_session_processes=value to pam_systemd.so
--systemd-kill_only_users=value — adds kill_only_users=value to pam_systemd.so
--systemd-kill_exclude_users=value — adds kill_exclude_users=value to pam_systemd.so
--systemd-controllers=value — adds controllers=value to pam_systemd.so
--systemd-reset_controllers=value — adds reset_controllers=value to pam_systemd.so
--systemd_home — enables/disables pam_systemd_home.so 🌸
--systemd_home-debug — adds debug to all pam_systemd_home.so invocations
--systemd_home-suspend=value — adds suspend=value to pam_systemd_home.so

yeah the underscore in --systemd_home is not a typo bestie, that's literally how it's spelled, don't come for me 😭

--thinkfinger — enables/disables pam_thinkfinger.so
--thinkfinger-debug — adds debug to all pam_thinkfinger.so invocations

--umask — adds pam_umask.so as an optional session module 🎀
--umask-debug — adds debug to all pam_umask.so invocations in session management
--umask-silent — adds silent to all pam_umask.so invocations in session management
--umask-usergroups — adds usergroups to all pam_umask.so invocations in session management
--umask-umask=mode — adds umask=mode to pam_umask.so

note how the first three are session-management girlies specifically, and --umask-umask is just plain module-level 🫶

--unix — enables/disables pam_unix.so 👑
--unix-debug — adds debug to all pam_unix.so invocations
--unix-audit — adds audit to all pam_unix.so invocations
--unix-nodelay — adds nodelay to all pam_unix.so invocations
--unix-nullok — adds nullok to all pam_unix.so invocations
--unix-shadow — adds shadow to all pam_unix.so invocations
--unix-md5 — adds md5 to all pam_unix.so invocations
--unix-bigcrypt — adds bigcrypt to all pam_unix.so invocations
--unix-sha256 — adds sha256 to all pam_unix.so invocations
--unix-sha512 — adds sha512 to all pam_unix.so invocations
--unix-blowfish — adds blowfish to all pam_unix.so invocations
--unix-nis — adds nis to all pam_unix.so invocations
--unix-broken_shadow — adds broken_shadow to all pam_unix.so invocations
--unix-use_first_pass — adds use_first_pass to all pam_unix.so invocations
--unix-try_first_pass — adds try_first_pass to all pam_unix.so invocations
--unix-authtok_type=value — adds authtok_type=value to pam_unix.so
--unix-remember=value — adds remember=value to pam_unix.so
--unix-rounds=value — adds rounds=value to pam_unix.so
--unix-minlen=value — adds minlen=value to pam_unix.so

the way pam_unix.so has the most options… main character energy fr fr 💀

--unix2 — uses pam_unix2.so as the standard UNIX PAM module 🔥
--unix2-nullok — adds nullok to all pam_unix2.so invocations
--unix2-debug — adds debug to all pam_unix2.so invocations
--unix2-trace — adds trace to pam_unix2.so
--unix2-none — adds the option none to pam_unix2.so
--unix2-call_modules=modules,... — adds call_modules= plus the list of modules to pam_unix2.so
--unix2-nisdir=path — adds nisdir=path to pam_unix2.so

--winbind — enables/disables pam_winbind.so
--winbind-debug — adds debug to all pam_winbind.so invocations
--wtmpdb — enables/disables pam_wtmpdb.so ✨
--wtmpdb-debug — adds debug to all pam_wtmpdb.so invocations
--wtmpdb-silent — adds silent to all pam_wtmpdb.so invocations
--wtmpdb-database=value — adds database=value to pam_wtmpdb.so
--wtmpdb-skip_if=value — adds skip_if=value to pam_wtmpdb.so

🫶 SINGLE SERVICE MODULES 🫶

okay so these ones are special — they can only be added to single service files. also peep the section called “USAGE EXAMPLES” for the full picture, iykyk 💜

--ck_connector — enables/disables pam_ck_connector.so
--ck_connector-debug — adds debug to all pam_ck_connector.so invocations

--cryptpass — enables/disables pam_cryptpass.so
--csync — enables/disables pam_csync.so 🦋
--csync-use_first_pass — adds use_first_pass to all pam_csync.so invocations
--csync-try_first_pass — adds try_first_pass to all pam_csync.so invocations
--csync-soft_try_pass — adds soft_try_pass to all pam_csync.so invocations
--csync-nullok — adds nullok to all pam_csync.so invocations
--csync-debug — adds debug to all pam_csync.so invocations
--csync-silent — adds silent to all pam_csync.so invocations

--google_authenticator — enables/disables pam_google_authenticator.so 🔐✨
--google_authenticator-noskewadj — adds noskewadj to all pam_google_authenticator.so invocations
--google_authenticator-nullok — adds nullok to all pam_google_authenticator.so invocations
--google_authenticator-secret=value — adds secret=value to pam_google_authenticator.so

--keyinit — enables/disables pam_keyinit.so
--keyinit-debug — adds debug to all pam_keyinit.so invocations
--keyinit-force — adds force to all pam_keyinit.so invocations
--keyinit-revoke — adds revoke to all pam_keyinit.so invocations

--lastlog — enables/disables pam_lastlog.so 🌈
--lastlog-debug — adds debug to all pam_lastlog.so invocations
--lastlog-silent — adds silent to all pam_lastlog.so invocations
--lastlog-never — adds never to all pam_lastlog.so invocations
--lastlog-nodate — adds nodate to all pam_lastlog.so invocations
--lastlog-nohost — adds nohost to all pam_lastlog.so invocations
--lastlog-noterm — adds noterm to all pam_lastlog.so invocations
--lastlog-nowtmp — adds nowtmp to all pam_lastlog.so invocations

and that's where this part lands, but bestie we are not done, keep scrolling 👀

okay so we were mid-list, right? picking up exactly where we left off — the per-module option parade marches on 💅✨

--lastlog-noupdate — tacks the noupdate option onto every single pam_lastlog.so invocation. no cap, all of them.
--lastlog-showfailed — same deal but with showfailed, added to all pam_lastlog.so invocations.

--loginuid — turns pam_loginuid.so on or off. the light switch of the loginuid world 🎀
--loginuid-require_auditd — drops require_auditd into all pam_loginuid.so invocations.

--mount — turns pam_mount.so on or off 🔥

--u2f — turns pam_u2f.so on or off. yes bestie, hardware keys, we love secure 🦋
--u2f-debug — adds debug to all pam_u2f.so invocations.
--u2f-nouserok — adds nouserok to all pam_u2f.so invocations.
--u2f-openasuser — adds openasuser to all pam_u2f.so invocations.
--u2f-alwaysok — adds alwaysok to all pam_u2f.so invocations.
--u2f-interactive — adds interactive to all pam_u2f.so invocations.
--u2f-manual — adds manual to all pam_u2f.so invocations.
--u2f-cue — adds cue to all pam_u2f.so invocations.
--u2f-nodetect — adds nodetect to all pam_u2f.so invocations.
--u2f-sshformat — adds sshformat to all pam_u2f.so invocations.

and now the ones that take a value — these all go straight into pam_u2f.so with the =value glued on, so bring receipts 🧚

--u2f-debug_file=value — adds debug_file=value to pam_u2f.so.
--u2f-origin=value — adds origin=value to pam_u2f.so.
--u2f-appid=value — adds appid=value to pam_u2f.so.
--u2f-authfile=value — adds authfile=value to pam_u2f.so.
--u2f-authpending_file=value — adds authpending_file=value to pam_u2f.so.
--u2f-max_devices=value — adds max_devices=value to pam_u2f.so.
--u2f-prompt=value — adds prompt=value to pam_u2f.so.
--u2f-cue_prompt=value — adds cue_prompt=value to pam_u2f.so.
--u2f-userpresence=value — adds userpresence=value to pam_u2f.so.
--u2f-userverification=value — adds userverification=value to pam_u2f.so.
--u2f-pinverification=value — adds pinverification=value to pam_u2f.so.

🌸 NOTES 🌸

okk so this one's actually kind of important — pay attention bestie 👀

the configuration that pam-config writes for the global service modules gets ignored by the system if the common-{account,auth,password,session} symlinks don't point at the common-{account,auth,password,session}-pc files.

like, the vibe is: write all the config you want, but if those symlinks are pointing somewhere else, the system literally does not care. check your symlinks. iykyk 💀

✨ USAGE EXAMPLES ✨

real-world, copy-paste-able, chef's kiss 🫶

query the state of pam_unix.so:

pam-config -q --unix

enable ldap authentication:

pam-config -a --ldap

enable pam_mount.so for the service gdm:

pam-config --service gdm -a --mount

enable pam_umask.so whether installed or not, and print debug info during the process:

pam-config --debug -a --force --umask

🔍 SEE ALSO 🔍

the whole friend group, in order 💖

PAM(8), pam_unix(8), pam_cracklib(8), pam_mkhomedir(8), pam_limits(8), pam_env(8), pam_xauth(8), pam_make(8)

👑 AUTHOR 👑

pam-config was written by Thorsten Kukuk <kukuk@thkukuk.de>. iconic, honestly.

and that's a wrap, bestie 🎀 this whole page dropped as part of the Reference Manual, dated 07/15/2025, and it lives at PAM-CONFIG(8) — go forth and configure slayfully 💅✨

📦 where this page comes from

opensuse-leap 16.0: pam-config 2.13+git.20250715-160000.2.2 · GPL-2.0-only
opensuse-leap 16.0: pam-config 2.13+git.20250715-160000.2.2 · GPL-2.0-only
opensuse-leap 16.0: pam-config 2.13+git.20250715-160000.2.2 · GPL-2.0-only
opensuse-leap 16.0: pam-config 2.13+git.20250715-160000.2.2 · GPL-2.0-only
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms