|Skip Navigation Links|
|Exit Print View|
|Developer's Guide to Oracle Solaris 11 Security Oracle Solaris 11.1 Information Library|
The PAM configuration, in /etc/pam.conf or per-service policy files in /etc/pam.d, is used to configure PAM service modules for system services, such as login, rlogin, su, and cron. The system administrator manages the PAM configuration. An incorrect order of entries in /etc/pam.conf or the per-service policy files in /etc/pam.d can cause unforeseen side effects. For example, a badly configured pam.conf can lock out users so that single-user mode becomes necessary for repair. For information on PAM configuration, see PAM Configuration (Reference) in Oracle Solaris 11.1 Administration: Security Services.
Starting with the Oracle Solaris 11.1 release, PAM can be also be configured via the per-service PAM policy files in the /etc/pam.d directory in addition to the pam.conf file.
The /etc/pam.d directory contains files named using the value of PAM_SERVICE. For example, /etc/pam.d/telnet is the file to read for the telnet service. The syntax of the /etc/pam.d files is identical to that of /etc/pam.conf except that the first column in the /etc/pam.conf file which is the service name, is omitted.
Configuring PAM with the /etc/pam.d files has following advantages:
A mistake in a per-service PAM policy file only affects that service.
Adding new PAM services is simple as it requires only creating a file in /etc/pam.d.
Improved interoperability with cross-platform PAM applications since many other PAM implementations such as Linux-PAM and OpenPAM support /etc/pam.d.
System administrators can also customize the security policy of their site by overlaying any vendor-supplied /etc/pam.d files.
The order given below is followed when searching for a configuration:
/etc/pam.conf, for a named service entry
/etc/pam.conf, for any other entry
This search order ensures that any customizations made to /etc/pam.conf file is preserved when the system is upgraded via pkg(5) and that the policy is still active.
See Privileges (Overview) in Oracle Solaris 11.1 Administration: Security Services for additional information.