PAM_ACCESS(8)

📦
version 1.7.3 · 18 versions
, in arch rolling

✨ PAM_ACCESS ✨

okay bestie, pull up a chair 🫶 this is pam_access, section 8 of the Linux-PAM Manual, and it's literally the bouncer at the club door of your login system. no cap.

🌸 NAME 🌸

pam_access — the PAM module for logdaemon style login access control 👑

🎀 SYNOPSIS 🎀

pam_access.so [debug] [noaudit] [nodefgroup] [nodns] [quiet_log]
              [accessfile=file] [fieldsep=sep] [listsep=sep]

💖 DESCRIPTION 💖

so pam_access is mainly for access management, periodt. it gives you that logdaemon style login access control, and it can decide based on:

  • login names
  • host or domain names
  • internet addresses or network numbers
  • terminal line names
  • X $DISPLAY values
  • or PAM service names, in the case of non-networked logins

by default, the rules for access management come from the config file /etc/security/access.conf — that's the default, you don't have to specify anything. but wait, there's more: then the individual *.conf files from the /etc/security/access.d/ directory get read too. 💅

and the way they're parsed? one after another, in the order of the system locale. the effect of the individual files is exactly the same as if all of them were concatenated together in the order of parsing. which means — and this is the important part — once a pattern is matched in some file, no further files are parsed. done. closed. slay.

⚠️ but if a config file is explicitly specified with the accessfile option, the files in that directory are not parsed. so pick a lane lol.

if Linux PAM is compiled with audit support, the module will report when it denies access based on origin (host, tty, etc.). very "not me snitching but also yes me snitching" energy. 😭

💅 OPTIONS 💅

  • accessfile=/path/to/access.conf — point at a different access.conf style configuration file to override the default. lowkey useful when different services need different access lists.
  • debug — a whole lot of debug info gets printed with syslog(3). it's giving verbose. 🔥
  • noaudit — do not report logins from disallowed hosts and ttys to the audit subsystem.
  • nodefgroup — user tokens that aren't enclosed in parentheses will not be matched against the group database. the backwards compatible default is to try the group database match even for tokens not enclosed in parentheses. (iykyk 🫶)
  • nodns — don't try to resolve tokens as hostnames, only IPv4 and IPv6 addresses will be resolved. which means: to allow login from a remote host, the IP addresses need to be specified in access.conf.
  • quiet_log — do not log denials with syslog(3). shhh. 🤫
  • fieldsep=separators — this one modifies the field separator character that pam_access recognizes when parsing the access configuration file. for example: fieldsep=| will cause the default : character to be treated as part of a field value and | becomes the field separator. doing this may be useful in conjunction with a system that wants to use pam_access with X based applications, since the PAM_TTY item is likely to be of the form "hostname:0" which includes a : character in its value. but honestly? you should not need this. 🙈
  • listsep=separators — this modifies the list separator character that pam_access recognizes when parsing the access configuration file. for example: listsep=, will cause the default (space) and \t (tab) characters to be treated as part of a list element value and , becomes the only list element separator. doing this may be useful on a system with group information obtained from a Windows domain, where the default built-in groups "Domain Users", "Domain Admins" contain a space. iconic problem, iconic fix. ✨

🌈 MODULE TYPES PROVIDED 🌈

all of them. every single one. auth, account, password and session — all provided. main character energy fr fr 👑

⭐ RETURN VALUES ⭐

  • PAM_SUCCESS — access was granted. we love to see it 🎉
  • PAM_PERM_DENIED — access was not granted. sorry bestie 💀
  • PAM_IGNORE — pam_setcred was called which does nothing.
  • PAM_ABORT — not all relevant data or options could be gotten.
  • PAM_USER_UNKNOWN — the user is not known to the system. who even are you 😭

🦋 FILES 🦋

  • /etc/security/access.conf — the default configuration file 💖

🌸 SEE ALSO 🌸

access.conf(5), pam.d(5), pam(8).

go read those too, bestie, they're all connected, it's a whole ecosystem 💜

🎀 AUTHORS 🎀

the logdaemon style login access control scheme was designed and implemented by Wietse Venema. the pam_access PAM module was developed by Alexei Nogin <alexei@nogin.dnttm.ru>. and the IPv6 support plus the network(address) / netmask feature was developed and provided by Mike Becher <mike.becher@lrz-muenchen.de>. legends, all of them, no cap 🫶

and that's the whole page!! this one shipped as part of Linux-PAM, dated 09/27/2026 — so like, go forth and control your access, babe. you've got this. 💅✨🌸💖

📦 where this page comes from