PAM_EXTRAUSERS(8)

📦
version 1.7.0 · 5 versions
, in ubuntu stonking

✨ PAM_EXTRAUSERS(8) ✨

okay bestie, gather round, it's pam_extrausers, from the Linux-PAM Manual, and it's literally the extra-users bestie of pam_unix. let's get into it 💅

🌸 NAME 🌸

pam_extrausers — the module for libnss-extrausers authentication 🫶

🎀 SYNOPSIS 🎀

pam_extrausers.so [...]

🦋 DESCRIPTION 🦋

so this one is basically the standard Unix auth module pam_unix... but make it extra 💖 Instead of reading from /etc/passwd and /etc/shadow, it goes to /var/lib/extrausers/passwd and /var/lib/extrausers/shadow. she has her own little filing cabinet, no cap.

the account component is out here establishing the status of your account and password, based on these shadow elements: expire, last_change, max_change, min_change, warn_change. And for that last one? she might gently offer the user some advice about changing their password, or — via the PAM_AUTHTOKEN_REQD return — she'll delay giving service to the user until they've set up a new password. iconic behaviour tbh. all those entries are documented over in shadow(5). And if the user's record doesn't have one or more of these entries? then that corresponding shadow check just... doesn't happen. no check, no problem ✨

the authentication component checks the user's credentials (that's the password, bestie). Default vibe of this module: if the official password is blank, the user does not get access to a service. periodt.

the password component updates the user's password. The default encryption hash is taken from the ENCRYPT_METHOD variable in /etc/login.defs. yes she reads the config file, she's thorough 💅

the session component logs when a user logs in or leaves the system.

Remaining arguments that other functions of this module support? silently ignored 🙈 Other arguments get logged as errors through syslog(3).

✨ OPTIONS ✨

  • debug — turns on debugging via syslog(3). the gossip channel, basically.
  • audit — a little more extreme than debug. she's not just gossiping, she's investigating 💀
  • nullok — the default is "no access if the official password is blank", but nullok overrides that default and lets any user with a blank password access the service.
  • nullok_secure — same override as above, but only allows a user with a blank password to access the service as long as the value of PAM_TTY is set to one of the values found in /etc/securetty. picky, but valid 💅
  • try_first_pass — before prompting the user for their password, the module first tries the previous stacked module's password, in case that satisfies this module too. reusing, we love sustainability 🌱
  • use_first_pass — forces the module to use a previous stacked module's password and will never prompt the user. If no password is available, or the password isn't appropriate, the user gets denied access. no second chances, fr fr.
  • nodelay — use this to discourage the authentication component from requesting a delay if the authentication as a whole fails. The default action is for the module to request a delay-on-failure of the order of two second.
  • use_authtok — when password changing, this enforces that the module sets the new password to the one provided by a previously stacked password module. (this is what's used in the pam_cracklib stacking example documented below 👇)
  • not_set_pass — tells the module it's not to pay attention to / make available the old or new passwords from / to other (stacked) password modules. she's minding her business 🧚
  • nis — NIS RPC is used for setting new passwords.
  • remember=n — the last n passwords for each user are saved in /etc/security/opasswd in order to force password change history and keep the user from alternating between the same password too frequently. > Instead of this option the pam_pwhistory module should be used. (yes bestie, that's on the tin, don't come for me)
  • shadow — try to maintain a shadow based system.
  • md5 — when a user changes their password next, encrypt it with the MD5 algorithm.
  • bigcrypt — when a user changes their password next, encrypt it with the DEC C2 algorithm.
  • sha256 — when a user changes their password next, encrypt it with the SHA256 algorithm. If the SHA256 algorithm is not known to the crypt(3) function, fall back to MD5.
  • sha512 — when a user changes their password next, encrypt it with the SHA512 algorithm. If the SHA512 algorithm is not known to the crypt(3) function, fall back to MD5.
  • blowfish — when a user changes their password next, encrypt it with the blowfish algorithm. If the blowfish algorithm is not known to the crypt(3) function, fall back to MD5.
  • rounds=n — set the optional number of rounds of the SHA256, SHA512 and blowfish password hashing algorithms to n.
  • broken_shadow — ignore errors reading shadow information for users in the account management module. letting it slide 🙈
  • minlen=n — set a minimum password length of n characters. The default value is 6. The maximum for DES crypt-based passwords is 8 characters.
  • obscure — enable some extra checks on password strength. These checks are based on the "obscure" checks in the original shadow package. The behavior is similar to the pam_cracklib module, but for non-dictionary-based checks. The following checks are implemented:
    • Palindrome — verifies that the new password is not a palindrome of (i.e., the reverse of) the previous one.
    • Case Change Only — verifies that the new password isn't the same as the old one with a change of case.
    • Similar — verifies that the new password isn't too much like the previous one.
    • Simple — is the new password too simple? This is based on the length of the password and the number of different types of characters (alpha, numeric, etc.) used.
    • Rotated — is the new password a rotated version of the old password? (E.g., "billy" and "illyb")

Invalid arguments are logged with syslog(3). 📝

👑 MODULE TYPES PROVIDED 👑

All module types are provided: account, auth, password and session. she does it all, main character energy fr 💅

🌈 RETURN VALUES 🌈

  • PAM_IGNORE — ignore this module.

🍓 EXAMPLES 🍓

an example usage for /etc/pam.d/common-password might be:

password        [success=2 default=ignore]      pam_extrausers.so obscure sha512
password        [success=1 default=ignore]      pam_unix.so obscure sha512
# here's the fallback if no module succeeds
password        requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password        required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
password        optional        pam_gnome_keyring.so
password        optional        pam_ecryptfs.so

💜 SEE ALSO 💜

login.defs(5), pam.conf(5), pam.d(5), pam(7)

🌸 AUTHOR 🌸

pam_extrausers was written by various people. (a whole committee of icons, no cap 👑)

and that's the whole thing bestie!! this was from the Linux-PAM Manual, source version marked as [FIXME: source], dated 07/16/2026 🌸 go forth and authenticate, you absolute legend 🫶✨💖

📦 where this page comes from