.\" -*- nroff -*-
.\" Copyright (c) 2002, 2003, 2004, 2006 Thorsten Kukuk kukuk@suse.de
.\"
.TH pam_unix2 8 "August 2006" "pam_unix2" "Reference Manual"
.SH NAME
pam_unix2 - Standard PAM module for traditional password authentication
.SH DESCRIPTION
The
.B pam_unix2
PAM module is for traditional password authentication. It uses standard calls
from the glibc NSS libraries to retrieve and set account information
as well as authentication. Usually this is obtained from the the local
files
.B /etc/passwd
and
.BR /etc/shadow
or  from a NIS map.
.PP
The options can be added in the PAM configuration files for every
single service.
.B /etc/security/pam_unix2.default
defines, which password encryption algorithm should be used in case of a
password change.
.SH OPTIONS
The following options may be passed to all types of management groups
except
.BR session :
.TP
.B debug
A lot of debug information is printed with
.BR syslog (3).
.TP
.B nullok
Normally the account is disabled if no password is set or if the
length of the password is zero. With this option the user is allowed
to change the password for such accounts. This option does not
overwrite a hardcoded default by the calling process.
.TP
.B use_first_pass
The default is, that
.B pam_unix2
tries to get the authentication token from a previous module.
If no token is available, the user is asked for the old password.
With this option,
.B pam_unix2
aborts with an error if no authentication token from a previous
module is available.

.LP
The following additional options may be passed to the
.B passwd
rules of this modules:
.TP
.BR "nisdir=" "<path>"
This options specifies a path to the source files for NIS maps
on a NIS master server. If this option is given, the passwords
of NIS accounts will not be changed with
.BR yppasswd (1),
instead the local \fIpasswd\fR and \fIshadow\fR files below
\fI<path>\fR will be modified. In conjunction with
.BR rpasswdd (8)
and
.B pam_make
.BR rpc.yppasswdd (8)
can be replaced with a more secure solution on the NIS master server.
.TP
.B use_authtok
Set the new password to the one provided by the previously
stacked password module. If this option is not set,
.B pam_unix2
would ask the user for the new password.

.LP
One of the following options may be passed to the
.B session
rules of this modules:
.TP
.B debug
Some messages (login time, logout time) are logged to syslog
with priority LOG_DEBUG.
.TP
.B trace
Some messages (login time, logout time) are logged to syslog
with priority LOG_NOTICE.
.TP
.B none
No messages are logged. This is the default.

.LP
The
.B acct
management does not recognize any additional options. For root, password
and login expire are ignored, only on aging warning is printed. If no
shadow information exists, it always returns success.
.SH FILES
/etc/security/pam_unix2.default
.SH "SEE ALSO"
.BR login (1),
.BR passwd (1),
.BR pam.conf (8),
.BR pam.d (8),
.BR pam_pwcheck (8),
.BR pam (8),
.BR rpasswd (1),
.BR rpasswdd (8),
.BR rpc.yppasswdd (8),
.BR yppasswd (1)