PAM_DEBUG(8)

💖 PAM_DEBUG — the pam_debug module, bestie edition 💖

okay so real talk, this one lives in the Linux-PAM Manual section 8, and it's literally the vibe-checker for your whole PAM stack. no cap. 🦋

---

✨ NAME ✨

pam_debug — the PAM module that's here to debug the PAM stack 🎀

---

✨ SYNOPSIS ✨

pam_debug.so [auth=value] [cred=value] [acct=value] [prechauthtok=value]
             [chauthtok=value] [auth=value] [open_session=value]
             [close_session=value]

(yes auth=value shows up twice in there, that's just how it is, i don't make the rules 💅)

---

✨ DESCRIPTION ✨

so like, the pam_debug PAM module is the debugging aide for figuring out how the PAM stack is actually operating. it's giving "let me tell you what's happening in here." 👑

here's the whole deal: this module returns exactly what its module arguments tell it to return. you say jump, it says how high. you say perm_denied, it returns perm_denied. no thoughts, just vibes and return codes. ✨

---

✨ OPTIONS ✨

every option is literally just something=value, and that value becomes the return code of the matching function. iconic behaviour, honestly.

• auth=value — the pam_sm_authenticate(3) function will return value.
• cred=value — the pam_sm_setcred(3) function will return value.
• acct=value — the pam_sm_acct_mgmt(3) function will return value.
• prechauthtok=value — the pam_sm_chauthtok(3) function will return value if the PAM_PRELIM_CHECK flag is set.
• chauthtok=value — the pam_sm_chauthtok(3) function will return value if the PAM_PRELIM_CHECK flag is not set.
• open_session=value — the pam_sm_open_session(3) function will return value.
• close_session=value — the pam_sm_close_session(3) function will return value.

and like, what can value even be?? glad you asked bestie, here's the whole menu, no skips, all of them 🍓:

• success
• open_err
• symbol_err
• service_err
• system_err
• buf_err
• perm_denied
• auth_err
• cred_insufficient
• authinfo_unavail
• user_unknown
• maxtries
• new_authtok_reqd
• acct_expired
• session_err
• cred_unavail
• cred_expired
• cred_err
• no_module_data
• conv_err
• authtok_err
• authtok_recover_err
• authtok_lock_busy
• authtok_disable_aging
• try_again
• ignore
• abort
• authtok_expired
• module_unknown
• bad_item
• conv_again
• incomplete

---

✨ MODULE TYPES PROVIDED ✨

ALL OF THEM. every single module type is provided — auth, account, password and session. main character energy across the board 👑💅

---

✨ RETURN VALUES ✨

• PAM_SUCCESS — this is the default return code if no other value was specified. otherwise? it's the specified return value. periodt.

---

✨ EXAMPLES ✨

here's some config inspo for you, copy-paste ready, literally do not touch the spacing 🫶:

auth    requisite       pam_permit.so
auth    [success=2 default=ok]  pam_debug.so auth=perm_denied cred=success
auth    [default=reset]         pam_debug.so auth=success cred=perm_denied
auth    [success=done default=die] pam_debug.so
auth    optional        pam_debug.so auth=perm_denied cred=perm_denied
auth    sufficient      pam_debug.so auth=success cred=success

---

✨ SEE ALSO ✨

go read these too, they're the supporting cast and they ate 💖:

• pam.conf(5)
• pam.d(5)
• pam(8)

---

✨ AUTHOR ✨

pam_debug was written by Andrew G. Morgan <morgan@kernel.org>. king behaviour fr fr 🌈

---

and that's the whole page bestie!! ✨ this beauty comes to you courtesy of Linux-PAM, dated 09/27/2026 — mwah, love that for us 💖🎀🦋 slay, go debug something, you've got this 🫶