Introduction

PAM lets services share authentication, account, password, and session policy. A small stack error can lock out every administrator, so changes require a root recovery path and a separate test session.

What you should be able to do after this lesson:

Read a PAM rule and its four fields.
Distinguish module types and control flags.
Recognize common PAM modules.
Connect PAM with NSS and SSSD.
Test changes without losing administrative access.

Big Idea: Identity Lookup and Authentication Are Different Pipelines

Before a user can log in, the system normally answers two separate questions:

NSS: Who is this name and what UID/GID does it have?
PAM: May this identity authenticate and open this session?

SSSD can supply data to both pipelines, but success in one does not prove success in the other. getent passwd alice may work while SSH authentication fails because its PAM account or session stack denies access.

PAM Rule Structure

Files normally live under /etc/pam.d/; some systems also use /etc/pam.conf. A rule has:

type control module-path module-arguments

Module types:

auth verifies identity or obtains credentials
account checks whether access is allowed
password changes authentication tokens
session performs setup and cleanup around a login

Control Flags

required: failure is remembered, but later modules run
requisite: failure returns immediately
sufficient: success may finish the stack if no required module failed
optional: result usually matters only when it is the only module

Bracketed syntax provides more precise handling of return codes.

Common Modules

pam_unix uses local account data such as /etc/passwd and /etc/shadow
pam_pwquality or historical pam_cracklib applies password-quality checks
pam_limits applies limits from limits.conf and related files
pam_listfile accepts or denies based on a file
pam_sss delegates to SSSD

pam_unix reads local account information represented through /etc/passwd and protected password hashes or account aging data in /etc/shadow. Applications should use system interfaces rather than reading shadow data directly.

Example session rule:

session required pam_limits.so

PAM, NSS, and SSSD

PAM answers whether authentication or account policy succeeds. NSS answers how names such as users and groups are resolved, configured through /etc/nsswitch.conf.

SSSD can cache identities and connect systems to LDAP or other identity providers. Relevant files include /etc/sssd/sssd.conf, which should have restrictive permissions.

getent passwd alice
id alice
sssctl user-checks alice

Successful getent output proves name resolution, not necessarily successful PAM authentication.

Safe Change Procedure

Keep an existing root session open.
Validate included files and distribution tooling.
Make one change.
Test in a second local or SSH session.
Test both success and intended failure.
Revert through the preserved session if necessary.

Never assume console, sudo, SSH, and graphical login use identical PAM stacks.

Guided Practice: Trace One Login Service

Choose a lab service such as sshd or login and inspect only its includes at first:

sed -n '1,200p' /etc/pam.d/<service>
getent passwd <test-user>
id <test-user>

Draw the ordered stack for auth, account, password, and session. Mark every included file and predict what happens when a required module fails versus a requisite module.

If SSSD is used, inspect status without exposing secrets:

systemctl status sssd
sssctl user-checks <test-user>
stat -c '%a %U:%G' /etc/sssd/sssd.conf

Make configuration changes only with a local root recovery path and an existing session left open. Test allowed and denied behavior from a second session.

Troubleshooting Scenario

getent passwd alice and id alice return the correct LDAP identity, but SSH rejects the account after accepting credentials. PAM logs show an account-stage denial.

Identity lookup and authentication are working; inspect the service's account stack, access rules, expiration, and SSSD policy. Editing /etc/nsswitch.conf would not repair a PAM account decision when NSS already resolves the user.

Exam Focus

Know the four PAM module types and control-flag behavior.
Recognize /etc/pam.d/, pam.conf, /etc/passwd, /etc/shadow, and nsswitch.conf roles.
Know pam_unix, pam_cracklib or pam_pwquality, pam_limits, pam_listfile, and pam_sss.
Protect sssd.conf and test PAM changes with a recovery session.

Recap

PAM stacks are ordered policy pipelines.
Module type and control flag both affect the result.
PAM authentication and NSS identity lookup are related but distinct.
Preserve a recovery session while changing authentication.

210.2 PAM authentication