PAM_STRESS(8)

📦
version 1.7.3 · 16 versions
, in arch rolling

✨ pam_stress(8) — the Linux-PAM Manual, but make it a group chat ✨

okay bestie, pull up a chair 💖 you found pam_stress(8), and it's literally the drama-kid of PAM modules. it's from the Linux-PAM Manual, it lives in section 8 (that's the sysadmin section, very main character energy 👑), and it is exactly what it sounds like: a module whose whole personality is pretending to work so you can test your PAM configs without actually breaking your login. iconic. let's get into it 🦋

🌸 NAME 🌸

pam_stress — the stress-testing PAM module 💅

✨ SYNOPSIS ✨

pam_stress.so [debug] [no_warn] [use_first_pass] [try_first_pass]
              [rootok] [expired] [fail_1] [fail_2] [prelim] [required]

no arguments required, but the optional ones are where the fun is. keep reading, bestie 🫶

💖 DESCRIPTION 💖

so here's the vibe: pam_stress is a PAM module whose entire job is to give the impression of failing as a fully functioning module might. that's it. that's the whole thing.

it's for testing. it cosplays a real module so you can see how your stack behaves when stuff goes sideways — without nuking an actual auth path. no cap. 🧚

🎀 OPTIONS 🎀

every flag, every one, here we go. don't skip, i'm watching 👀

  • debug — dumps a lot of info into syslog. and when we say a lot, we mean it.
🚨 IMPORTANT BESTIE: this option writes passwords to syslog. do not use anything sensitive while you're testing. like, at all. fr fr. 💀
  • no_warn — stops the module from giving warnings about things. (otherwise, warnings get issued through the conversation function) 🤫
  • use_first_pass — do not prompt for a password. for the pam_sm_authentication function, it just uses item PAM_AUTHTOK. no asking, just taking ✨
  • try_first_pass — do not prompt for a password unless there's been no previous authentication token (i.e. item PAM_AUTHTOK is NULL). so it tries first, and only asks if it has nothing to work with 🫡
  • rootok — this one is intended for the pam_sm_chauthtok function, and it tells that function to let root change a user's password without entering the old password. root privileges, no questions asked 👑
  • expired — an argument intended for the account and chauthtok module parts. it tells the module to act as if the user's password has expired. drama, but make it auth 😭
  • fail_1 — tells the module to make its first function fail. one job, done. 💀
  • fail_2 — tells the module to make its second function fail, if there even is one. two jobs, one of them optional 🍓
  • prelim — for pam_sm_chauthtok, this means fail on PAM_PRELIM_CHECK. 🚩
  • required — for pam_sm_chauthtok, this means fail if the user hasn't already been authenticated by this module. (peep the stress_new_pwd data string down in the NOTES section 👇)

🌈 MODULE TYPES PROVIDED 🌈

all of them, bestie. every single one. auth, account, password and session — all provided. a full set. a whole wardrobe. slay 💅

💜 RETURN VALUES 💜

the module can hand back any of these, so let's go through them one by one:

  • PAM_BUF_ERR — memory buffer error. the buffer said "not today" 😭
  • PAM_PERM_DENIED — permission denied. nope, not you 🚫
  • PAM_AUTH_ERR — access to the system was denied.
  • PAM_CONV_ERR — conversation failure. the conversation function fumbled it 🙈
  • PAM_SUCCESS — the function passes all checks. we love to see it ✨
  • PAM_USER_UNKNOWN — the user is not known to the system. who? never heard of her 💀
  • PAM_CRED_ERR — failure involving user credentials.
  • PAM_NEW_AUTHTOK_REQD — authentication token is no longer valid; a new one is required.
  • PAM_SESSION_ERR — session failure.
  • PAM_TRY_AGAIN — failed preliminary check by service.
  • PAM_AUTHTOK_LOCK_BUSY — authentication token lock busy. 🔒
  • PAM_AUTHTOK_ERR — authentication token manipulation error.
  • PAM_SYSTEM_ERR — system error. the vague one. the ominous one. 🌩️

🦋 NOTES 🦋

this module uses the stress_new_pwd data string, which tells pam_sm_chauthtok that pam_sm_acct_mgmt says we need a new password.

and the only possible value for this data string is 'yes'. one value. that's the whole menu. periodt. 👑

🌸 EXAMPLES 🌸

here's a little config moment for you, bestie. any of these lines will do the trick:

#%PAM-1.0
#
# Any of the following will suffice
account  required pam_stress.so
auth     required pam_stress.so
password required pam_stress.so
session  required pam_stress.so

look at that. clean. organized. a vibe. 🎀

👀 SEE ALSO 👀

go read these too, iykyk:

🫶 AUTHORS 🫶

the pam_stress PAM module was developed by Andrew Morgan <morgan@linux.kernel.org>.

the man page for pam_stress was written by Lucas Ramage <ramage.lucas@protonmail.com>.

thank you for your service, kings 💖

and that's the whole page, bestie!! 🌈✨ this one comes to you from Linux-PAM, dated 09/27/2026, and it's page PAM_STRESS(8) — go forth and stress-test responsibly, and remember: never put real passwords near debug. mwah 💅🎀

📦 where this page comes from