Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up a PAM module that lets one add a conditional password change scheme. The intended behavior is like this:

  1. passwd

  2. do you want to change authentication token for TestProgram?(s/n):

in case he decides he does (s)

  • 3.1.1 (s) > user:...
  • 3.1.2 >pass:...
  • 3.1.3 >newpass:...
  • 3.1.4 >repeat newpass:...

  • 3.1.5 >password successfully changed (or not)

In case he just wanted to use passwd regularly

  • 3.2.1 :user UNIX password:....


I have already managed to more or less make it work but i'm having trouble with the PAM flags. right now the module configuration (let's call it myauthschema) is like this:

auth sufficient /usr/lib/security/ ...

and in my /etc/pam.d/passwd file i added first the line

@include myauthschema

In the pam_sm_chauthtok interface i do this:

if(flags & PAM_PRELIM_CHECK) return PAM_IGNORE;

Else execute pam conversation to know if you want to change this program credentials. If you do, return PAM_SUCCESS or an error (this should -end stack execution always, for either success or failure-),

If you want to use the regular module,

return PAM_IGNORE*

My problem is this: whenever I run passwd it will run my module, but if I decide to PAM_IGNORE it's result, I won't be prompted for my user password next, for the regular usage of passwd command. Any ideas how it could be solved? it is very likely I'm failing to use the flags correctly, i.e., I always return PAM_IGNORE on the first time pam_sm_chauthok is called, but I'm not sure what I should return.

Maybe the correct behaviour is to ask first what I want to chauthtok, then checking if it's the prelim check or not. If my question isn't clear, I'd like to hear it.

For what I know, it is very similar to this question I found digging the inter-web:

share|improve this question

closed as off topic by this.josh, Rory Alsop Sep 29 '11 at 13:43

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

This question might fare better on serverfault or unix/linux as it is very technical. My hunch is this issue is tied to a "catch 22" of the passwd command itself calling the (now modified) PAM stack. – zedman9991 Sep 28 '11 at 18:35
For several reasons i've decided it is not possible to separate the two authentication schemes on the same stack, which is pretty reasonable considering it is not supposed to work that way. Thanks for anyone who checked out this question and gave it a thought. – Bruno Figares Sep 28 '11 at 22:51
Closed as per @Bruno's request. – Rory Alsop Sep 29 '11 at 13:44