1*eb8dc403SDave Cobbley# 2*eb8dc403SDave Cobbley# /etc/pam.d/common-account - authorization settings common to all services 3*eb8dc403SDave Cobbley# 4*eb8dc403SDave Cobbley# This file is included from other service-specific PAM config files, 5*eb8dc403SDave Cobbley# and should contain a list of the authorization modules that define 6*eb8dc403SDave Cobbley# the central access policy for use on the system. The default is to 7*eb8dc403SDave Cobbley# only deny service to users whose accounts are expired in /etc/shadow. 8*eb8dc403SDave Cobbley# 9*eb8dc403SDave Cobbley# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. 10*eb8dc403SDave Cobbley# To take advantage of this, it is recommended that you configure any 11*eb8dc403SDave Cobbley# local modules either before or after the default block, and use 12*eb8dc403SDave Cobbley# pam-auth-update to manage selection of other modules. See 13*eb8dc403SDave Cobbley# pam-auth-update(8) for details. 14*eb8dc403SDave Cobbley# 15*eb8dc403SDave Cobbley 16*eb8dc403SDave Cobbley# here are the per-package modules (the "Primary" block) 17*eb8dc403SDave Cobbleyaccount [success=1 new_authtok_reqd=done default=ignore] pam_unix.so 18*eb8dc403SDave Cobbley# here's the fallback if no module succeeds 19*eb8dc403SDave Cobbleyaccount requisite pam_deny.so 20*eb8dc403SDave Cobbley# prime the stack with a positive return value if there isn't one already; 21*eb8dc403SDave Cobbley# this avoids us returning an error just because nothing sets a success code 22*eb8dc403SDave Cobbley# since the modules above will each just jump around 23*eb8dc403SDave Cobbleyaccount required pam_permit.so 24*eb8dc403SDave Cobbley# and here are more per-package modules (the "Additional" block) 25*eb8dc403SDave Cobbley# end of pam-auth-update config 26