PAM_USERDB(8)

✨ PAM_USERDB ✨

ok so bestie, welcome to pam_userdb — it's a Linux-PAM thing, and it's genuinely one of the cutest little modules out there. it does one job and it does it slayfully. let's get into it 💅

---

🌸 NAME 🌸

pam_userdb — a PAM module that authenticates against a db database. that's it, that's the whole vibe 🎀

---

🦋 SYNOPSIS 🦋

pam_userdb.so db=/path/database [debug] [crypt=[crypt|none]] [icase]
              [dump] [try_first_pass] [use_first_pass] [unknown_ok]
              [key_only]

---

💖 DESCRIPTION 💖

okay so here's the tea ☕ — the pam_userdb module verifies a username/password pair against values stored in a Berkeley DB database. no cap.

the database is indexed by the username, and the data fields corresponding to the username keys are the passwords. so like, username → password. simple. iconic. periodt ✨

---

👑 OPTIONS 👑

• crypt=[crypt|none] — tells the module whether the passwords sitting in the database are encrypted or plaintext. if it's crypt, the passwords should be stored in the database in crypt(3) form. if you pick none, then the passwords should be stored in the database as plaintext. choose wisely bestie 🙈
• db=/path/database — use the /path/database database to do the lookup. there is no default, so if you don't provide a database the module will return PAM_IGNORE. also important: the path to the database file should be specified without the .db suffix. yes really. i know. 💀
• debug — prints debug information. heads up though: password hashes, both from db and computed, will be printed to syslog. so like... know that before you turn this on 😭
• dump — dumps all the entries in the database to the log. > Don't do this by default! (the manpage literally yells this at you, and honestly, valid.)
• icase — makes the password verification case insensitive (ie when working with registration numbers and such). it only works with plaintext password storage. so if you've got crypt going, this does nothing, mwah 💅
• try_first_pass — uses the authentication token previously obtained by another module that did the conversation with the application. if this token can not be obtained then the module will try to converse. this option can be used for stacking different modules that need to deal with the authentication tokens. so polite of it 🫶
• use_first_pass — uses the authentication token previously obtained by another module that did the conversation with the application. if this token can not be obtained then the module will fail. this option can be used for stacking different modules that need to deal with the authentication tokens. way more dramatic than try_first_pass, main character energy fr 🔥
• unknown_ok — do not return error when checking for a user that is not in the database. this can be used to stack more than one pam_userdb module that will check a username/password pair in more than a database. so like, chain them up, bestie 💜
• key_only — the username and password are concatenated together in the database hash as 'username-password' with a random value. if the concatenation of the username and password with a dash in the middle returns any result, the user is valid. this is useful in cases where the username may not be unique but the username and password pair are. lowkey galaxy brain 🌈

---

🌟 MODULE TYPES PROVIDED 🌟

the auth and account module types are provided. just those two, and they serve 💖

---

🎀 RETURN VALUES 🎀

• PAM_AUTH_ERR — authentication failure. the classic. 😭
• PAM_AUTHTOK_RECOVERY_ERR — authentication information cannot be recovered.
• PAM_BUF_ERR — memory buffer error.
• PAM_CONV_ERR — conversation failure.
• PAM_SERVICE_ERR — error in service module.
• PAM_SUCCESS — success!! slay ✨🎉
• PAM_USER_UNKNOWN — user not known to the underlying authentication module. it's giving "who is she" 💅

---

🧚 EXAMPLES 🧚

auth  sufficient pam_userdb.so icase db=/etc/dbtest

look at her. one line. does the thing. obsessed 🍓

---

🌈 SEE ALSO 🌈

crypt(3), pam.conf(5), pam.d(5), pam(8)

go read them, iykyk 📚

---

💜 AUTHOR 💜

pam_userdb was written by Cristian Gafton >gafton@redhat.com<. thank you king 👑

---

okay that's the whole page bestie, you're so ready for this. this was the Linux-PAM manual, dated 07/08/2026, and it's still filed under PAM_USERDB(8) — now go forth and authenticate responsibly, mwah 💖✨🎀