PAM_UNIX_NG(8)

✨ PAM_UNIX_NG(8) — the pam_unix_ng manual, bestie edition ✨

okay so real quick: this page is pam_unix_ng, from section 8 of the manual. sit down, grab a strawberry 🍓, and let's get into it.

💖 NAME 💖

pam_unix_ng — a PAM module for traditional password authentication. yes, the old-school kind. it's giving classic but make it modern. 👑

🦋 SYNOPSIS 🦋

pam_unix_ng.so [...]

🌸 DESCRIPTION 🌸

okay so this is a standard UNIX authentication PAM module, and here's the gag: instead of doing the shadow-file stuff itself, it delegates all the tasks that need access to /etc/shadow over to pwaccessd(8). which is iconic actually, because it means you can use this module in environments where setuid binaries simply cannot exist. no setuid, no problem. 💅

but wait, there's more. if pwaccessd is not currently running, the module first tries to start it via D-Bus. and if that fails too? it falls back to reading the local files itself. so it's basically the friend who texts you, then calls you, then just shows up at your door. 🫶

🎀 OPTIONS 🎀

• debug — spill the tea to syslog via syslog(3). all the debug info, no filter.
• quiet — hush mode. literally everything is silenced except errors. 🤫
• nullok — so by default this module will NOT let a user into a service if their official password is blank. that's the default, that's the vibe. the nullok argument overrides that default and allows it.

heads up bestie: if the application sets the PAM_DISALLOW_NULL_AUTHTOK flag, then nullok gets ignored in the auth module type. so don't come crying to me, the flag said no. 😭

• try_first_pass — the module first attempts to use the password that came from the previously stacked modules, to check if it's also suitable for this module, before it bothers prompting the user to type their password all over again. polite queen behavior. ✨
• use_first_pass — the module ONLY attempts to use the password from the previously stacked modules and never prompts the user for input. if no password is available, or the password doesn't match — access denied, periodt. 🚫
• use_authtok — when a password is being changed, the module sets the new password to the one provided by a previously stacked password module. teamwork makes the dream work. 🫂
• *authtok_type=type* — by default, the module uses these prompts when it asks for passwords: "New UNIX password: " and "Retype UNIX password: ". that example word UNIX can be swapped out for whatever this option says. by default, it's empty.
• *minlen=<number>* — the minimal length a new password can be. the default is 8 characters. no three-letter passwords in this house. 🧚
• *crypt_prefix=<prefix>* — the prefix of the hash algorithm to use. go check crypt(5) for the valid values, iyknk. 🔐
• *crypt_count=<number>* — this one controls the processing cost of the hash. valid values live in crypt(5), once again. 💀 (not literally, it's just expensive)
• *fail_delay=<milliseconds>* — by default the module requests a delay of 2000 milliseconds if the authentication as a whole fails. this argument lets you adjust that delay, or disable it entirely with fail_delay=0. rate limiting who? we love her. ⏳

🌈 MODULE TYPES PROVIDED 🌈

literally all of them. account, auth, password, and session. every single one, no crumbs left. 👑

⭐ RETURN VALUES ⭐

• PAM_SUCCESS — everything went off without a hitch. slay. 💖
• PAM_SERVICE_ERR — internal service module error. the module is having a moment. 😭
• PAM_USER_UNKNOWN — user not known. who is she? 🙈
• PAM_IGNORE — returned by service types that do nothing. main character energy of just… not participating. 💅

🧚 NOTES 🧚

the shadow(5) Minimum Password Age field (sp_min) gets ignored if pam_unix_ng.so cannot connect with pwaccessd(8). that's just how it is, no cap.

🔥 EXAMPLES 🔥

here's an example of a full /etc/pam.d/login, look at her go:

account   required   pam_unix_ng.so
auth      required   pam_unix_ng.so
password  requisite  pam_pwquality.so
password  requisite  pam_pwhistory.so use_authtok
password  required   pam_unix_ng.so   use_authtok
session   optional   pam_wtmpdb.so
session   optional   pam_lastlog2.so
session   required   pam_unix_ng.so

so in this case, login(1) verifies the password and that the account is not expired, logs login and logout time to syslog(8), and makes sure that the password has some kind of quality and that the last 10 passwords cannot be reused. a full self-care routine for your auth stack. 🎀✨

💜 SEE ALSO 💜

pwaccessd(8), pam.conf(5), pam.d(5), pam(8) — go read your other besties too.

👑 AUTHOR 👑

pam_unix_ng was written by Thorsten Kukuk <kukuk@suse.com>. thank you king, we appreciate you. 🫶

---

and that's the whole page bestie!! this came to you from account-utils version 1.4.0, dated 07/17/2026. mwah, go forth and authenticate responsibly 💖🌸🦋