svcadm(8)을 검색하려면 섹션에서 8 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
pam_unix_auth(7)
pa...h(7)Standards, Environments, Macros, Character Sets, and miscellanpya...h(7)
NAME
pam_unix_auth - PAM authentication module for UNIX
SYNOPSIS
pam_unix_auth.so.1 [debug] [nolock] [nosleeponfail] [nowarn] [server_policy]
DESCRIPTION
The pam_unix_auth module implements pam_sm_authenticate(3PAM), which
provides functionality to the PAM authentication stack. It provides
functions that use crypt(3C) to verify that the password contained in
the PAM item PAM_AUTHTOK is the correct password for the user specified
in the item PAM_USER.
If PAM_AUSER and PAM_USER are both specified and PAM_USER is a role,
the user_attr(5) keyword roleauth is checked to determine if the pass‐
word that is checked is for the role (PAM_USER) or the assuming user
(PAM_AUSER). If PAM_REPOSITORY is specified, the user's password is
fetched from that repository. Otherwise, the default nsswitch.conf(5)
repository is searched for that user.
For accounts in the name services which support automatic account lock‐
ing, the account can be configured to be automatically locked (see
user_attr(5) and policy.conf(5)) after multiple failed login attempts.
For accounts that are configured for automatic locking, if authentica‐
tion failure is to be returned, the failed login counter is incremented
upon each failure. If the number of successive failures equals or ex‐
ceeds the configured value, the account is locked and PAM_MAXTRIES is
returned. The files (see passwd(5) and shadow(5)) and ldap (when con‐
figured with enableShadowUpdate true, see ldapclient(8)), repositories
support automatic account locking. A successful authentication by this
module clears the failed login counter and reports the number of failed
attempts since the last successful authentication. Accounts that have
been locked may be configured to be automatically unlocked upon suc‐
cessful authentication by configuring an unlock time (see user_attr(5)
and policy.conf(5)).
Authentication service modules must implement both pam_sm_authenti‐
cate(3PAM) and pam_sm_setcred(3PAM). To allow the authentication por‐
tion of UNIX authentication to be replaced, pam_sm_setcred() in this
module always returns PAM_IGNORE. This module should be stacked with
pam_unix_cred(7) to ensure a successful return from pam_setcred(3PAM).
The following options can be passed to the module:
debug
syslog(3C) debugging information at the LOG_DEBUG level.
nolock
Regardless of the automatic account locking setting for the ac‐
count, do not lock the account, increment or clear the failed login
count. The nolock option allows for exempting account locking on a
per service basis.
nosleeponfail
Do not sleep after authentication failure.
nowarn
Turn off warning messages.
server_policy
If the account authority for the user, as specified by PAM_USER, is
a server, do not apply the UNIX policy from the passwd entry in the
name service switch.
FILES
SLEEPTIME
If present in /etc/default/login, sets the number of seconds to
wait before the login failure returned. Default is 4 seconds. Mini‐
mum is 0 seconds. Maximum is 30 seconds.
Previous releases performed the sleep directly in su(8), sulogin(8)
or login(8) are also affected by the value of SLEEPTIME.
RETURN VALUES
The following values are returned from pam_sm_authenticate():
PAM_AUTH_ERR
Authentication failure.
PAM_BUF_ERR
Memory buffer error.
PAM_IGNORE
Ignores module, not participating in result.
PAM_MAXTRIES
Maximum number of retries exceeded.
PAM_PERM_DENIED
Permission denied.
PAM_SUCCESS
Successfully obtains authentication token.
PAM_SYSTEM_ERR
System error.
PAM_USER_UNKNOWN
No account present for user.
The following value is returned from pam_sm_setcred():
PAM_IGNORE
Ignores this module regardless of the control flag.
ATTRIBUTES
See attributes(7) for descriptions of the following attributes:
tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) ATTRIBUTE TYPEAT‐
TRIBUTE VALUE _ Availabilitysystem/library/pam-core _ Interface Stabil‐
ityCommitted
SEE ALSO
login(1), passwd(1), crypt(3C), syslog(3C), libpam(3LIB), pam(3PAM),
pam_authenticate(3PAM), pam_setcred(3PAM), pam_sm_authenticate(3PAM),
pam_sm_setcred(3PAM), nsswitch.conf(5), pam.conf(5), passwd(5), pol‐
icy.conf(5), shadow(5), user_attr(5), attributes(7), pam_auth‐
tok_check(7), pam_authtok_get(7), pam_authtok_store(7), pam_dhkeys(7),
pam_passwd_auth(7), pam_unix_account(7), pam_unix_cred(7),
pam_unix_session(7), ldapclient(8), roleadd(8), rolemod(8), useradd(8),
usermod(8)
NOTES
If the PAM_REPOSITORY item_type is set and a service module does not
recognize the type, the service module does not process any informa‐
tion, and returns PAM_IGNORE. If the PAM_REPOSITORY item_type is not
set, a service module performs its default action.
HISTORY
The enforcement of SLEEPTIME was moved from login(1) and su(8) in Ora‐
cle Solaris 11.4.81.
Support for unlocking accounts when either the UNLOCK_AFTER property is
set in policy.conf(5), or the unlock_after attribute is set in
user_attr(5), was added in Oracle Solaris 11.4.0.
Support for checking the roleauth attribute from user_attr(5) to deter‐
mine if it should check for the role or user password was added in Ora‐
cle Solaris 11.0.0.
Support for the nolock option and for locking accounts upon multiple
failed authentication attempts was added in Solaris 10 3/05.
Support for the server_policy option was added in Solaris 10 3/05.
The pam_unix_account module was introduced in Solaris 9, and later
backported to patches for Solaris 8. This included support for the de‐
bug and nowarn options. Prior to that, these checks were performed in
the pam_unix module.
Oracle Solaris 11.4 18 Feb 2025 pa...h(7)