NAME

       pam_unix2 - Standard PAM module for traditional password authentication

DESCRIPTION

       The  pam_unix2  PAM  module  is  for traditional password authentication. It uses standard
       calls from the glibc NSS libraries to retrieve and set  account  information  as  well  as
       authentication.  Usually  this  is  obtained  from  the  the  local  files /etc/passwd and
       /etc/shadow or  from a NIS map.

       The options can be added  in  the  PAM  configuration  files  for  every  single  service.
       /etc/security/pam_unix2.default  defines,  which  password  encryption algorithm should be
       used in case of a password change.

OPTIONS

       The following options may be passed to all types of management groups except session:

       debug  A lot of debug information is printed with syslog(3).

       nullok Normally the account is disabled if no password is set or  if  the  length  of  the
              password  is  zero. With this option the user is allowed to change the password for
              such accounts. This option does not overwrite a hardcoded default  by  the  calling
              process.

       use_first_pass
              The  default  is,  that  pam_unix2  tries  to  get  the authentication token from a
              previous module.  If no token is available, the user is asked for the old password.
              With  this option, pam_unix2 aborts with an error if no authentication token from a
              previous module is available.

       The following additional options may be passed to the passwd rules of this modules:

       nisdir=<path>
              This options specifies a path to the source files for NIS  maps  on  a  NIS  master
              server.  If this option is given, the passwords of NIS accounts will not be changed
              with yppasswd(1), instead the local passwd and shadow files below  <path>  will  be
              modified.  In  conjunction  with  rpasswdd(8)  and pam_make rpc.yppasswdd(8) can be
              replaced with a more secure solution on the NIS master server.

       use_authtok
              Set the new password to the one provided by the previously stacked password module.
              If this option is not set, pam_unix2 would ask the user for the new password.

       One of the following options may be passed to the session rules of this modules:

       debug  Some  messages  (login  time,  logout  time)  are  logged  to  syslog with priority
              LOG_DEBUG.

       trace  Some messages (login  time,  logout  time)  are  logged  to  syslog  with  priority
              LOG_NOTICE.

       none   No messages are logged. This is the default.

       The  acct  management  does  not  recognize any additional options. For root, password and
       login expire are ignored, only on aging warning  is  printed.  If  no  shadow  information
       exists, it always returns success.

FILES

       /etc/security/pam_unix2.default

SEE ALSO

       login(1),   passwd(1),   pam.conf(8),   pam.d(8),   pam_pwcheck(8),   pam(8),  rpasswd(1),
       rpasswdd(8), rpc.yppasswdd(8), yppasswd(1)