Skip to content

PAM (Pluggable Authentication Modules) — Understanding Linux Authentication

PAM (Pluggable Authentication Modules) is the authentication framework used by Linux to control how users are authenticated and authorized. Instead of every application implementing its own authentication mechanism, applications such as SSH, sudo, login, and passwd rely on PAM to provide a centralized, flexible, and secure authentication system.

Learning Path

Linux Mastery → Module 5: Users and Groups → Lesson 9

Difficulty: Advanced

Reading Time: 60 Minutes

Course Progress

Course: Linux Mastery

Module: Users and Groups

Lesson: 9 of 10

What You'll Learn

After completing this lesson, you'll be able to:

  • Understand PAM
  • Learn how Linux authentication works
  • Understand PAM modules
  • Read PAM configuration files
  • Understand PAM control flags
  • Configure basic authentication policies
  • Integrate enterprise authentication
  • Apply PAM security best practices

Prerequisites

Complete:

  • Module 1 – Linux Fundamentals
  • Module 2 – Linux Command Line Essentials
  • Module 3 – Text Processing
  • Module 4 – File Management and Permissions
  • Module 5 Lessons 1–8

Why Learn PAM?

Imagine a company with:

  • SSH logins
  • sudo authentication
  • Console logins
  • FTP access
  • Database authentication
  • Multi-Factor Authentication (MFA)

Should every application implement its own password verification?

No.

Linux uses PAM to provide one centralized authentication framework.

What is PAM?

PAM stands for:

Pluggable Authentication Modules

PAM provides a common authentication interface between:

Applications

↓

PAM

↓

Authentication Modules

Applications simply ask PAM to authenticate users.

PAM decides how authentication should happen.

PAM Authentication Flow

User Login
      │
      ▼
Application
(ssh, sudo, login)
      │
      ▼
PAM
      │
      ▼
Authentication Module
      │
      ▼
Password / LDAP / MFA / Kerberos
      │
      ▼
Access Granted or Denied

Why PAM?

Benefits:

  • Centralized authentication
  • Consistent security
  • Flexible configuration
  • Easy integration
  • Enterprise authentication support

Without PAM, every application would require its own authentication implementation.

PAM Configuration Directory

Configuration files are stored in:

/etc/pam.d/

View:

ls /etc/pam.d

Example:

login

sshd

sudo

passwd

su

Each application has its own PAM configuration.

Example PAM File

Display:

cat /etc/pam.d/sshd

Example:

auth required pam_unix.so

account required pam_unix.so

password required pam_unix.so

session required pam_unix.so

Each line defines how authentication is processed.

PAM Components

Every PAM rule has four parts:

Type

Control Flag

Module

Arguments

Example:

auth required pam_unix.so

Breakdown:

Part Meaning
auth Authentication step
required Control flag
pam_unix.so Authentication module
(optional) Module arguments

PAM Module Types

Authentication

Verifies identity.

auth

Examples:

  • Password verification
  • SSH authentication
  • MFA

Account

Checks account status.

account

Examples:

  • Account expiration
  • Login restrictions
  • Time-based access

Password

Handles password changes.

password

Examples:

  • Password updates
  • Complexity rules
  • Password history

Session

Manages user sessions.

session

Examples:

  • Login
  • Logout
  • Resource limits
  • Session logging

PAM Control Flags

required

Authentication must succeed.

Failure is remembered, but PAM continues processing the remaining modules.

requisite

Authentication must succeed.

Failure immediately stops authentication.

sufficient

If successful, authentication succeeds immediately (provided no earlier required module has failed).

optional

Used when the module's result is not essential unless no other modules are configured for that type.

Common PAM Modules

Module Purpose
pam_unix.so Local password authentication
pam_env.so Load environment variables
pam_limits.so Resource limits
pam_access.so Access control
pam_pwquality.so Password complexity (commonly used on many distributions)
pam_faillock.so Account lockout after failed logins (common on RHEL-based systems)

Note

The available modules vary depending on the Linux distribution.

Password Complexity

Many Linux systems use:

pam_pwquality.so

to enforce:

  • Minimum length
  • Uppercase letters
  • Lowercase letters
  • Numbers
  • Special characters

Example configuration:

password requisite pam_pwquality.so retry=3

Account Lockout

Some distributions use:

pam_faillock.so

to lock accounts after repeated failed login attempts.

This helps mitigate brute-force attacks.

PAM and sudo

Display:

cat /etc/pam.d/sudo

Every time you execute:

sudo

PAM authenticates the user according to the configured policy.

PAM and SSH

Display:

cat /etc/pam.d/sshd

When a user connects through SSH:

SSH

↓

PAM

↓

Authentication

Enterprise Authentication

PAM supports:

  • LDAP
  • Active Directory
  • Kerberos
  • Multi-Factor Authentication (MFA)
  • Smart Cards
  • Biometric authentication (where supported)

Applications don't need to change—only the PAM configuration does.

Common Commands

View PAM directory.

ls /etc/pam.d

View SSH configuration.

cat /etc/pam.d/sshd

View sudo configuration.

cat /etc/pam.d/sudo

View login configuration.

cat /etc/pam.d/login

Real Production Examples

SSH authentication.

sshd

↓

PAM

↓

LDAP

sudo authentication.

sudo

↓

PAM

↓

Password

Password changes.

passwd

↓

PAM

↓

Password Policy

Production Perspective

PAM is used extensively for:

  • Linux servers
  • Enterprise authentication
  • Active Directory integration
  • LDAP authentication
  • SSH security
  • sudo authentication
  • Password policies
  • Multi-factor authentication (MFA)

Almost every Linux login passes through PAM.

Hands-on Lab

Task 1

List PAM configuration files.

ls /etc/pam.d

Task 2

View SSH PAM configuration.

cat /etc/pam.d/sshd

Task 3

View sudo PAM configuration.

cat /etc/pam.d/sudo

Task 4

View login PAM configuration.

cat /etc/pam.d/login

Task 5

Search for password quality modules.

grep -R "pam_pwquality" /etc/pam.d

Task 6

Search for account lockout modules.

grep -R "pam_faillock" /etc/pam.d

Task 7

Identify authentication modules.

grep "^auth" /etc/pam.d/*

Task 8

Identify session modules.

grep "^session" /etc/pam.d/*

Command Deep Dive

Command Purpose Production Example
ls /etc/pam.d View PAM services Administration
cat /etc/pam.d/sshd SSH authentication Troubleshooting
cat /etc/pam.d/sudo sudo authentication Security audits
grep "^auth" Find authentication rules Configuration review
grep "^session" Find session rules Session management

Production Troubleshooting Scenario

Scenario

Users suddenly cannot log in through SSH.

Investigation:

sudo cat /etc/pam.d/sshd

sudo journalctl -u ssh

The PAM configuration was modified incorrectly.

Solution:

Restore the correct PAM configuration from backup or reinstall the appropriate PAM package according to your distribution.

After restarting the SSH service (if required), authentication works again.

Best Practices

  • Avoid manually editing PAM configuration unless you understand the authentication flow.
  • Always back up PAM configuration files before making changes.
  • Test configuration changes in a non-production environment first.
  • Use PAM modules provided by your Linux distribution.
  • Document custom authentication policies.

Common Mistakes

❌ Editing PAM configuration on production systems without testing.

✅ Edit PAM configuration on production systems without testing only when appropriate and with a backup.

❌ Removing required authentication modules.

✅ This can prevent users—including administrators—from logging in.

❌ Assuming PAM configuration is identical across all Linux distributions.

✅ Module names and configuration files may differ.

Interview Questions

Beginner

  1. What does PAM stand for?
  2. Why is PAM used in Linux?
  3. Where are PAM configuration files stored?
  4. Which applications commonly use PAM?

Intermediate

  1. Explain the four PAM module types.
  2. What is the difference between required and requisite?
  3. How does PAM support password complexity?
  4. How does PAM integrate with SSH and sudo?

Architect Level

  1. How would you integrate Linux authentication with Active Directory?
  2. How would you enforce MFA across enterprise Linux servers?
  3. Why is PAM considered a flexible authentication framework?

Summary

In this lesson, you learned:

  • What PAM is
  • Linux authentication flow
  • PAM configuration files
  • PAM module types
  • Control flags
  • Password policies
  • Enterprise authentication
  • Production best practices

PAM is the foundation of authentication in Linux. It provides a centralized and flexible framework that allows applications such as SSH, sudo, and login to share a common authentication mechanism while supporting enterprise security requirements.

Key Takeaways

  • PAM stands for Pluggable Authentication Modules.
  • PAM centralizes authentication for Linux applications.
  • Configuration files are located in /etc/pam.d/.
  • PAM supports local passwords, LDAP, Kerberos, MFA, and more.
  • Test PAM changes carefully to avoid authentication failures.
  • PAM is a critical component of enterprise Linux security.

What's Next?

Multi-user Environment in Linux — Managing Multiple Users on a Single System

You'll explore:

  • Multiple concurrent users
  • User sessions
  • Process ownership
  • Session management
  • Resource sharing
  • User isolation
  • Monitoring logged-in users
  • Enterprise multi-user best practices

By the end of the module, you'll understand how Linux securely supports multiple users working on the same system simultaneously.