svcadm(8)을 검색하려면 섹션에서 8 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
pam_chauthtok(3pam)
pam_chauthtok(3PAM) PAM Library Functions pam_chauthtok(3PAM)
NAME
pam_chauthtok - perform password related functions within the PAM
framework
SYNOPSIS
cc [ flag ... ] file ... -lpam [ library ... ]
#include <security/pam_appl.h>
int pam_chauthtok(pam_handle_t *pamh, const int flags);
DESCRIPTION
The pam_chauthtok() function is called to change the authentication to‐
ken associated with a particular user referenced by the authentication
handle pamh.
The following flag may be passed in to pam_chauthtok():
PAM_SILENT The password service should not generate
any messages.
PAM_CHANGE_EXPIRED_AUTHTOK The password service should only update
those passwords that have aged. If this
flag is not passed, all password services
should update their passwords.
PAM_NO_AUTHTOK_CHECK The password service should not perform
conformance checks on the password en‐
tered.
Upon successful completion of the call, the authentication token of the
user will be changed in accordance with the password service configured
in the system through pam.conf(5).
RETURN VALUES
Upon successful completion, PAM_SUCCESS is returned. In addition to the
error return values described in pam(3PAM), the following values may be
returned:
PAM_PERM_DENIED No permission.
PAM_AUTHTOK_ERR Authentication token manipulation error.
PAM_AUTHTOK_RECOVERY_ERR Authentication information cannot be re‐
covered.
PAM_AUTHTOK_LOCK_BUSY Authentication token lock busy.
PAM_AUTHTOK_DISABLE_AGING Authentication token aging disabled.
PAM_USER_UNKNOWN User unknown to password service.
PAM_TRY_AGAIN Preliminary check by password service
failed.
ATTRIBUTES
See attributes(7) for descriptions of the following attributes:
tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) ATTRIBUTE TYPEAT‐
TRIBUTE VALUE _ Interface StabilityCommitted _ MT-LevelMT-Safe with ex‐
ceptions
The interfaces in libpam are MT-Safe only if each thread within the
multithreaded application uses its own PAM handle.
SEE ALSO
pam(3PAM), login(1), passwd(1), pam_start(3PAM), pam_authenti‐
cate(3PAM), attributes(7), pam_authtok_check(7)
NOTES
The flag PAM_CHANGE_EXPIRED_AUTHTOK is typically used by a login appli‐
cation which has determined that the user's password has aged or ex‐
pired. Before allowing the user to login, the login application may in‐
voke pam_chauthtok() with this flag to allow the user to update the
password. Typically, applications such as passwd(1) should not use this
flag.
The pam_chauthtok() function performs a preliminary check before at‐
tempting to update passwords. This check is performed for each password
module in the stack as listed in pam.conf(5). The check may include
pinging remote name services to determine if they are available. If
pam_chauthtok() returns PAM_TRY_AGAIN, then the check has failed, and
passwords are not updated.
The flag PAM_NO_AUTHTOK_CHECK is typically used by programs that allow
an administrator to bypass various password conformance checks when
setting a password for a user. The passwd(1) command only sets this
flag if the user has the solaris.passwd.nocheck authorization. The at‐
tributes(7) module ignores the PAM_NO_AUTHTOK_CHECK flag if the
force_check option is specified in the module entry in the PAM configu‐
ration.
For security reasons, pam_chauthtok() clears the PAM_AUTHTOK and
PAM_OLDAUTHTOK items in the PAM handle prior to returning to the call‐
ing application.
HISTORY
The PAM_NO_AUTHTOK_CHECK flag was added in the Oracle Solaris 11.0.0
release.
The pam_chauthtok() function was introduced in Solaris 2.6.
Oracle Solaris 11.4 15 Mar 2023 pam_chauthtok(3PAM)