pam_unix_account - PAM account management module for UNIX
pam_unix_account.so.1
The pam_unix_account module implements pam_sm_acct_mgmt(), which provides functionality to the PAM account management stack. This module provides functions to:
Validate that an authenticated user is allowed to log in to the local user account by checking that the account is not locked or expired
The user's password has not expired and does not need to be changed
Validate that the user is permitted to access the PAM service at the current time and day of the week.
The user's account has not been inactive for too long
The /etc/nologin file is not present for non-root users (see nologin(4))
The module retrieves account information from the configured databases in nsswitch.conf(4).
The following options can be passed to the module:
syslog(3C) debugging information at the LOG_DEBUG level
Turn off warning messages
If the account authority for the user, as specified by PAM_USER, is a server, do not apply the Unix policy from the passwd entry in the name service switch.
The following values are returned:
User account has expired
Password expired and no longer usable
Memory buffer error
Ignore module, not participating in result
Obtain new authentication token from the user
The account is locked or has been inactive for too long or is not permitted at the current time and day of the week
Error in underlying service module
The account is valid for use at this time
No account is present for the user
Logins for non-root users are disabled due to the presence of the /etc/nologin file. For more information, see nologin(4) man page.
See attributes(5) for descriptions of the following attributes:
|
pam(3PAM), pam_authenticate(3PAM), syslog(3C), libpam(3LIB), pam.conf(4), nsswitch.conf(4), attributes(5)
The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle.
Attempts to validate locked accounts are logged via syslog(3C) to the LOG_AUTH facility with a LOG_NOTICE severity.