Pam

PAM, short for Pluggable Authentication Modules, is a framework used on many Unix-like operating systems to integrate multiple authentication and related services. It allows the system to delegate authentication, account management, session handling, and password management to modular components that can be added, removed, or reordered without changing applications.

The framework provides a modular approach to authentication, enabling administrators to compose authentication policies by stacking modules. Each module implements a specific function or method for verifying a user, enforcing account restrictions, creating sessions, or handling password changes. This modularity supports diverse methods such as local password databases, LDAP, Kerberos, or other external systems.

PAM supports four module types or service areas: authentication, account, session, and password. Applications link against the PAM library and request services through a corresponding service configuration. A service’s authentication policy is defined by a stack of modules in configuration files, typically under /etc/pam.d/ (with legacy systems using /etc/pam.conf on some platforms). Modules are loaded according to their control flags, which guide the outcome: required, requisite, sufficient, or optional.

Configuration lines specify the module path, type, and arguments. Common examples include pam_unix.so for traditional local authentication, pam_ldap.so for directory services, and pam_krb5.so for Kerberos-enabled environments. The design allows administrators to implement centralized and flexible policies across services such as login, sudo, su, and graphical login managers.

Security considerations include the risk of misconfiguration, which can lock users out or weaken protections. Proper testing, backup of PAM configurations, and secure module development practices are important. Linux-PAM is a widely used open-source implementation of the PAM framework for Linux systems.