PAM_DENY(8)

📦
version 1.7.3 · 18 versions
, in arch rolling

💅 PAM_DENY — the "no bestie, absolutely not" module

okay so real quick, the vibe: this is pam_deny from the Linux-PAM Manual, section 8 (that's the sysadmin commands section, iykyk). It's giving bouncer at the club energy. Nobody gets in. Ever. 🚫✨

✨ NAME ✨

pam_deny — the locking-out PAM module

like, literally its whole personality is saying no 🫶

✨ SYNOPSIS ✨

pam_deny.so

that's it. that's the whole synopsis. no arguments, no options, no drama. icon behaviour honestly.

🌸 DESCRIPTION 🌸

okay so here's the tea: this module can be used to deny access. It always indicates a failure to the application through the PAM framework. always. no exceptions. no negotiation. no "but what if—". it's a hard no in module form 💀

and the way that's actually useful?? you can use it for your default entries — the <pink>OTHER</pink> ones. So when some service shows up with no config entries of its own, it hits OTHER, and OTHER says nope. security girlies stay winning 👑

✨ OPTIONS ✨

This module does not recognise any options.

genuinely zero. it's not being mysterious, there just aren't any. don't try to pass it stuff, it won't know what you're talking about 🙈

🎀 MODULE TYPES PROVIDED 🎀

All module types are provided. that means:

  • account
  • auth
  • password
  • session

every single one. it will deny you in all four flavours 💅

🦋 RETURN VALUES 🦋

so when this module does its thing (which is, again, saying no), here's what comes back:

  • PAM_AUTH_ERR — This is returned by the account and auth services.
  • PAM_CRED_ERR — This is returned by the setcred function.
  • PAM_AUTHTOK_ERR — This is returned by the password service.
  • PAM_SESSION_ERR — This is returned by the session service.

every service type gets its own lil personalised rejection letter 💌 cute of it honestly

🌈 EXAMPLES 🌈

okay bestie here's the actual config, verbatim, don't @ me:

#%PAM-1.0
#
# If we don't have config entries for a service, the
# OTHER entries are used. To be secure, warn and deny
# access to everything.
other auth     required       pam_warn.so
other auth     required       pam_deny.so
other account  required       pam_warn.so
other account  required       pam_deny.so
other password required       pam_warn.so
other password required       pam_deny.so
other session  required       pam_warn.so
other session  required       pam_deny.so

see how it works?? pam_warn.so goes first to leave a lil note in the logs about what happened, and then pam_deny.so slams the door. warn, then deny. every. single. type. it's giving "we saw you, and the answer is still no" 🔥

💜 SEE ALSO 💜

go read these next, fr fr:

👑 AUTHOR 👑

pam_deny was written by Andrew G. Morgan <morgan@kernel.org>

thank you for your service king 🫡

and that's the whole page bestie!! this was the Linux-PAM manual, page PAM_DENY(8), dated 09/27/2026. mwah, go deny some access, stay safe, drink water 💖✨🎀🦋

📦 where this page comes from