pam_ssh_auth_info(8)

📦 version 1.8.20230906, in epel 9, fedora 43, fedora 44

pam_ssh_auth_info(8) 💖

okay bestie, gather round, because today we're talking about pam_ssh_auth_info — yes, that's the whole name, it lives in section 8 of the system manager's manual, and it's literally the module that tests SSH authentication information. That's the NAME, that's the whole job description, and it's serving. ✨

🌸 SYNOPSIS 🌸

pam_ssh_auth_info.so [flag...]  [pattern[=pattern]...]

like... it takes flags, it takes patterns, it's flexible, it's giving range. 💅

🦋 DESCRIPTION 🦋

so the pam_ssh_auth_info.so PAM module is designed to either succeed or fail authentication based on SSH authentication information — and that info is a whole list of successfully completed authentication methods plus public credentials (e.g. keys) that were used to authenticate the user. one very real use case? picking whether to load other modules based on this test. slay.

normally you hand the module zero or more patterns as module arguments, and authentication succeeds if the SSH authentication information matches all of the patterns (or any of them, or none of them — depends on which options you picked, bestie, it's giving choose-your-own-adventure). and here's the plot twist: if there are no previous successfully completed authentication methods, then SSH authentication information is not available — it's missing — and authentication will neither succeed nor fail (the module returns PAM_IGNORE). iconic neutrality honestly. 🫶

✨ OPTIONS ✨

these flags are supported, no cap:

all_of — all of the patterns must match. if zero patterns are given as module arguments, authentication will succeed if SSH authentication information is available. this is the default, it's the main character. 👑
any_of — at least one of the patterns must match. if zero patterns are given as module arguments, authentication will fail if SSH authentication information is available. (yes, zero patterns = fail here, that's not a typo, that's the vibe.)
debug — log debugging messages to syslog. 🐛
disable=service[:service[...]] — disable pattern matching for the services listed in that colon-separated service list.
enable=service[:service[...]] — enable pattern matching only for the services listed in that colon-separated service list.
none_of — none of the patterns may match. if zero patterns are given as module arguments, authentication will succeed if SSH authentication information is available.
quiet — do not log failure or success messages to syslog. 🤫
quiet_fail — do not log failure messages to syslog.
quiet_success — do not log success messages to syslog.
recursion_limit=limit — change the recursion limit. this affects extended patterns and * wildcard patterns.

🌈 PATTERNS 🌈

any character byte that shows up in a pattern — other than the extended patterns and the special pattern characters described below — matches itself. simple, honest, humble.

the special pattern characters have these meanings, bestie:

* — matches any number of (including zero) word character bytes but not a word separator (space).
= — matches an equal-sign (=) or a word separator (space).

this enables more natural looking patterns and allows patterns to be written without spaces, avoiding the need for square bracket quoting in PAM configuration files. it's giving convenience. 💅

? — matches any word character byte but not a word separator (space).
[ — a pair of brackets introduces a character byte class. a character byte class ([...]) matches any word character byte in the class. a complemented character byte class ([!...]) matches any word character byte not in the class. neither one matches a word separator (space). a class may contain character bytes ([abcde]) and character byte ranges ([a-e]).
\ — preserves the literal meaning of the following character byte.

the extended patterns have these meanings:

?(pattern|pattern|...) — matches zero or one occurrence of the given patterns. does not match a word separator (space).
*(pattern|pattern|...) — matches zero or more occurrences of the given patterns. does not match a word separator (space).
+(pattern|pattern|...) — matches one or more occurrences of the given patterns. does not match a word separator (space).
@(pattern|pattern|...) — matches one of the given patterns. does not match a word separator (space).
!(pattern|pattern|...) — matches anything except one occurrence of the given patterns. does not match a word separator (space).

SSH authentication information consists of lines having a format like

method[/submethod] [key-type key-data] [info-word]...

SSH authentication information matches a pattern if on any such line all the words or the initial words match the pattern. fr fr.

💜 MODULE SERVICES PROVIDED 💜

all module types are provided — account, auth, password and session. that said, the auth type is still undoubtedly the most useful one. like, obviously. 🙈

🎀 RETURN VALUES 🎀

PAM_AUTH_ERR — pattern requirements are not met. SSH authentication information does not match all of or any of the patterns (see the all_of and the any_of options) or matches some of the patterns (see the none_of option). 💀
PAM_IGNORE — the pattern matching is disabled for the service (see the disable option) or not enabled for the service (see the enable option) or SSH authentication information is missing.
PAM_SUCCESS — pattern requirements are met. SSH authentication information matches all of or any of the patterns (see the all_of and the any_of options) or matches none of the patterns (see the none_of option). ate. 🔥

⭐ EXAMPLES ⭐

example 1: always load an OATH module rule (to request and check a one-time password) but load a password module rule (to request and check the user password) only if there are no previous successfully completed authentications (in which case SSH authentication information is missing):

auth  requisite         oath-module.so option...
auth  [success=1        \
       default=ignore]  pam_ssh_auth_info.so
auth  required          password-module.so try_first_pass option...

example 2: load an OATH module rule (to request and check a one-time password) only if there are no previous successfully completed FIDO authenticator algorithm based public key authentications (in which case SSH authentication information either is missing or does not match the pattern) but always load a password module rule (to request and check the user password):

auth  [success=1        \
       ignore=ignore    \
       auth_err=ignore  \
       default=die]     pam_ssh_auth_info.so quiet \
                            publickey=*sk-*@openssh.com
auth  requisite         oath-module.so option...
auth  required          password-module.so try_first_pass option...

example 3: require that there is at least one previous successfully completed FIDO authenticator algorithm based public key authentication (in which case the key type contains “sk-” and ends with “@openssh.com”). if multiple public key authentications are required, only one of them is required to be a FIDO authenticator algorithm based one.

auth  requisite  pam_ssh_auth_info.so quiet \
                     publickey=*sk-*@openssh.com

example 4: require that there is at least one previous successfully completed FIDO authenticator algorithm based public key authentication (in which case the key type contains “sk-” and ends with “@openssh.com”) and at least one previous successfully completed non-FIDO public key authentication (in which case the key type does not contain “sk-” or does not end with “@openssh.com”).

auth  requisite  pam_ssh_auth_info.so quiet \
                     publickey=*sk-*@openssh.com \
                     publickey=!(*sk-*@openssh.com)

🧚 ENVIRONMENT 🧚

SSH_AUTH_INFO_0 — SSH authentication information consisting of a list of successfully completed authentication methods and public credentials (e.g. keys) used to authenticate the user. this environment variable is visible to PAM modules but not to user sessions, and it is provided by OpenSSH server since version 7.8p1.
SSH_USER_AUTH — a location of a file containing SSH authentication information consisting of a list of successfully completed authentication methods and public credentials (e.g. keys) used to authenticate the user. this environment variable is visible to user sessions but not to PAM modules, and it is provided by OpenSSH server since version 7.8p1 if the ExposeAuthInfo server option is enabled. this may be a useful source for creating proper patterns. lowkey a cheat code for pattern-making. 🍓

🫶 NOTES 🫶

in order to make this module useful, the following sshd_config(5) options should be set (either explicitly or via defaults):

AuthenticationMethods — should contain comma-separated lists of authentication method names with keyboard-interactive, keyboard-interactive:pam or password as the last list items so that there are successfully completed authentication methods and public credentials (e.g. keys) during the PAM authentication. for example

AuthenticationMethods publickey,keyboard-interactive

for mandatory public key authentication and mandatory PAM authentication using keyboard-interactive challenge-response authentication or

AuthenticationMethods publickey,keyboard-interactive keyboard-interactive

for optional public key authentication and mandatory PAM authentication using keyboard-interactive challenge-response authentication.

ChallengeResponseAuthentication, KbdInteractiveAuthentication, PasswordAuthentication, etc. — the relevant ones should be set to yes.
UsePAM — should be set to yes.

ngl bestie, if you skip these, the module is just gonna sit there looking cute and doing nothing. set them up. 🙈

🌈 SEE ALSO 🌈

pam(7), sshd_config(5)
Home Page for pam_ssh_auth_info

👑 AUTHOR 👑

Eero Häkkinen <Eero+pam-ssh-auth-info@Häkkinen.fi>

💖 COPYRIGHT 💖

This manual page is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

and that's the whole page, bestie!! this one comes to you from the System Manager's Manual, dated 2022-01-16, and honestly? iconic of it. go forth and pattern-match. periodt. 💅✨🦋

📦 where this page comes from

epel 9: pam-ssh-auth-info 1.8.20230906-2.el9 · GPL-3.0-or-later AND LGPL-3.0-or-later
fedora 43: pam-ssh-auth-info 1.8.20230906-7.fc43 · GPL-3.0-or-later AND LGPL-3.0-or-later
fedora 44: pam-ssh-auth-info 1.8.20230906-8.fc44 · GPL-3.0-or-later AND LGPL-3.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms