1f61a81a2SBrad Bishop# 2f61a81a2SBrad Bishop# /etc/pam.d/common-password - password-related modules common to all services 3f61a81a2SBrad Bishop# 4f61a81a2SBrad Bishop# This file is included from other service-specific PAM config files, 5f61a81a2SBrad Bishop# and should contain a list of modules that define the services to be 6f61a81a2SBrad Bishop# used to change user passwords. The default is pam_unix. 7f61a81a2SBrad Bishop 8f61a81a2SBrad Bishop# Explanation of pam_unix options: 9f61a81a2SBrad Bishop# 10f61a81a2SBrad Bishop# The "sha512" option enables salted SHA512 passwords. Without this option, 11f61a81a2SBrad Bishop# the default is Unix crypt. Prior releases used the option "md5". 12f61a81a2SBrad Bishop# 13f61a81a2SBrad Bishop# See the pam_unix manpage for other options. 14f61a81a2SBrad Bishop 15f61a81a2SBrad Bishop# here are the per-package modules (the "Primary" block) 16fa324837SJoseph Reynoldspassword [success=ok default=die] pam_pwquality.so debug 17a64c49f8SJoseph Reynoldspassword [success=ok default=die] pam_ipmicheck.so spec_grp_name=ipmi use_authtok 18*a5585294SJason M. Billspassword [success=ok ignore=ignore default=die] pam_pwhistory.so debug use_authtok 19f61a81a2SBrad Bishoppassword [success=ok default=die] pam_unix.so sha512 use_authtok 20f61a81a2SBrad Bishoppassword [success=1 default=die] pam_ipmisave.so spec_grp_name=ipmi spec_pass_file=/etc/ipmi_pass key_file=/etc/key_file 21f61a81a2SBrad Bishop# here's the fallback if no module succeeds 22f61a81a2SBrad Bishoppassword requisite pam_deny.so 23f61a81a2SBrad Bishop# prime the stack with a positive return value if there isn't one already; 24f61a81a2SBrad Bishop# this avoids us returning an error just because nothing sets a success code 25f61a81a2SBrad Bishop# since the modules above will each just jump around 26f61a81a2SBrad Bishoppassword required pam_permit.so 27f61a81a2SBrad Bishop# and here are more per-package modules (the "Additional" block) 28