PAM_LOCALUSER(8)

📦
version 1.7.3 · 17 versions
, in arch rolling

💖 PAM_LOCALUSER(8) 💖

okay bestie, welcome to the Linux-PAM Manual section on pam_localuser — the module whose whole entire job is requiring users to be listed in /etc/passwd. yes. that's it. that's the girl. 🎀

✨ NAME ✨

pam_localuser — require users to be listed in /etc/passwd 🫶

🌸 SYNOPSIS 🌸

pam_localuser.so [debug] [file=/path/passwd]

look at her. so simple. so iconic. 💅

🦋 DESCRIPTION 🦋

so pam_localuser is a PAM module that helps you implement site-wide login policies — the kind where you're like "okay so most of our users come from the network, but a handful of accounts are local to this specific workstation." 💻✨

using pam_localuser together with pam_wheel or pam_listfile is an effective way to restrict access to either local users and/or a subset of the network's users. pick your fighter, bestie. 🔥

ngl you could also pull this off using pam_listfile.so plus a very short awk script that gets invoked by cron — like, technically. 🙈 but this pattern is common enough that somebody was like "no, this deserves to be its own whole module" and honestly? they ate. 👑

💅 OPTIONS 💅

  • debug — print debug information. the receipts. the lore. the play-by-play. 🔍
  • file=/path/passwd — use a file other than /etc/passwd. swapping out the source file, main character behaviour fr fr. 📂

🌈 MODULE TYPES PROVIDED 🌈

All module types are provided! that's account, auth, password and session. every single one. she does it all, no cap. 👑✨

⭐ RETURN VALUES ⭐

  • PAM_SUCCESS — the new localuser was set successfully. slay! 💖
  • PAM_BUF_ERR — memory buffer error. the vibes were immaculate but the memory was not. 💀
  • PAM_CONV_ERR — the conversation method supplied by the application failed to obtain the username. couldn't even get a name out of them 😭
  • PAM_INCOMPLETE — the conversation method supplied by the application returned PAM_CONV_AGAIN. she said "ask me later" 🙈
  • PAM_SERVICE_ERR — the user name is not valid or the passwd file is unavailable. either the name is a no or the file is a no. 🚫
  • PAM_PERM_DENIED — the user is not listed in the passwd file. not on the list, not getting in. periodt. 🚪

🎀 EXAMPLES 🎀

say you wanna add the following lines to /etc/pam.d/su so that only local users or group wheel can use su. here's exactly what that looks like:

account sufficient pam_localuser.so
account required pam_wheel.so

write it down, bestie. this is the one. 🫶📝

🍓 FILES 🍓

  • /etc/passwd — local user account information. the origin story. the blueprint. 💖

🧚 SEE ALSO 🧚

pam.conf(5), pam.d(5), pam(8)

go read those too, iykyk. 📚✨

💜 AUTHOR 💜

pam_localuser was written by Nalin Dahyabhai <nalin@redhat.com>. thank you for your service, king. 🫡👑

ok that's the whole page bestie, every flag, every return value, every file — nothing skipped, nothing invented, we keep it 💯 around here.

and that's a wrap! this was the Linux-PAM Manual drop for PAM_LOCALUSER(8), dated 09/27/2026 — go forth and gatekeep your workstations responsibly. bye bestie, love u, mwah 💋💖✨

📦 where this page comes from