OS version：Red Hat Enterprise Linux Server release 6.4
Kernel version：2.6.32-358.el6.x86_64


-------------------------------------------------------------------------


The syntax of files contained in the /etc/pam.d/ directory：
   type    control    module-path    module-arguments



valid type values are：

  • auth
       this module type provides two aspects of authenticating the user. Firstly, it establishes that the user is who they claim to be, by instructing the application to prompt the user for a password or other means of identification. Secondly, the module can grant group membership or other privileges through its credential granting properties.

  • account
       this module type performs non-authentication based account management. It is typically used to restrict/permit access to a service based on the time of day, currently available system resources (maximum number of users) or perhaps the location of the applicant user -- 'root' login only on the console.

  • password
       this module type is required for updating the authentication token associated with the user. Typically, there is one module for each 'challenge/response' based authentication (auth) type.

  • session
       this module type is associated with doing things that need to be done for the user before/after they can be given service. Such things include the logging of information concerning the opening/closing of some data exchange with a user, mounting directories, etc.



For the simple (historical) syntax valid control values are:

  • required
       表示即使某个模块验证失败，也要等所有的模块都执行完毕之后，PAM才返回错误信息

  • requisite
       如果这个模块验证失败，PAM马上返回一个错误信息，把控制权交回应用程序，不再执行其它模块进行验证

  • sufficient
       表示如果通过这个模块的验证，PAM结构就立刻返回验证成功信息，把控制权交会应用程序

  • optional
       表示即使本行指定的模块验证失败，也允许用户享受应用程序提供的服务。使用这个标志，PAM框架会忽略这这个模块产生的验证错误，继续顺执行下一个层叠模块

  • include
       调用一个新的配置文件进行验证

  • substack
       与include相同，也是调用一个新的配置文件进行验证。不同的是，include调用的文件在执行过程中如果有die或bad的返回值，则立即跳出，返回到调用的地方；而substack调用的文件执行过程中如果有die或bad的返回值，而不会立即跳出此文件，而是等此文件执行完毕之后才会返回到调用的地方



For the more complicated syntax valid control values have the following form：
   [value1=action1 value2=action2 ... default=actionN]


valid action values are：

  • ignore
       如果使用层叠模块，那么这个模块的返回值将被忽略，不会被应用程知道

  • bad
       告诉PAM这个模拟的返回值应该被看作是模块验证失败。如果这个模块是层叠模块的第一个验证失败的模块，那么它的状态值就是整个层叠模块的状态值

  • die
       与bad的区别在于，此值会终止层叠模块验证过程，立刻返回到应用程序

  • ok
       告诉PAM这个模块的返回值直接作为所有层叠模块的返回值。也就是说，如果这个模块前面的模块返回状态是PAM_SUCCESS，那这个返回值就会覆盖前面的返回状态。注意：如果前面的模块的返回状态表示模块验证失败，那么不能使用这个返回值覆盖

  • done
       与ok的区别是，此值终止后续层叠模块的验证，把控制权立刻交回应用程序

  • reset
       清除之前所有叠模块的返回状态，从下一个层叠模块重新开始



Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in terms of the [...] syntax. They are as follows：

   required
       [success=ok new_authtok_reqd=ok ignore=ignore default=bad]

   requisite
       [success=ok new_authtok_reqd=ok ignore=ignore default=die]

   sufficient
       [success=done new_authtok_reqd=done default=ignore]

   optional
       [success=ok new_authtok_reqd=ok default=ignore]



-------------------------------------------------------------------------


The detailed information：man pam.d