---
name: "pam_debug"
section: "8"
platform: "linux"
package: "pam"
version: "1.7.3-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/pam_debug"
---

# pam\_debug(8)

PAM module to debug the PAM stack

## NAME

pam\_debug - PAM module to debug the PAM stack

## SYNOPSIS

**pam\_debug.so** \[auth=*value*\] \[cred=*value*\] \[acct=*value*\] \[prechauthtok=*value*\] \[chauthtok=*value*\] \[auth=*value*\] \[open\_session=*value*\] \[close\_session=*value*\]

## DESCRIPTION

The pam\_debug PAM module is intended as a debugging aide for determining how the PAM stack is operating. This module returns what its module arguments tell it to return.

## OPTIONS

auth=value

The [**pam\_sm\_authenticate**(3)](/pam_sm_authenticate/3.md) function will return *value*.

cred=value

The [**pam\_sm\_setcred**(3)](/pam_sm_setcred/3.md) function will return *value*.

acct=value

The [**pam\_sm\_acct\_mgmt**(3)](/pam_sm_acct_mgmt/3.md) function will return *value*.

prechauthtok=value

The [**pam\_sm\_chauthtok**(3)](/pam_sm_chauthtok/3.md) function will return *value* if the *PAM\_PRELIM\_CHECK* flag is set.

chauthtok=value

The [**pam\_sm\_chauthtok**(3)](/pam_sm_chauthtok/3.md) function will return *value* if the *PAM\_PRELIM\_CHECK* flag is **not** set.

open\_session=value

The [**pam\_sm\_open\_session**(3)](/pam_sm_open_session/3.md) function will return *value*.

close\_session=value

The [**pam\_sm\_close\_session**(3)](/pam_sm_close_session/3.md) function will return *value*.

Where *value* can be one of: success, open\_err, symbol\_err, service\_err, system\_err, buf\_err, perm\_denied, auth\_err, cred\_insufficient, authinfo\_unavail, user\_unknown, maxtries, new\_authtok\_reqd, acct\_expired, session\_err, cred\_unavail, cred\_expired, cred\_err, no\_module\_data, conv\_err, authtok\_err, authtok\_recover\_err, authtok\_lock\_busy, authtok\_disable\_aging, try\_again, ignore, abort, authtok\_expired, module\_unknown, bad\_item, conv\_again, incomplete.

## MODULE TYPES PROVIDED

All module types (**auth**, **account**, **password** and **session**) are provided.

## RETURN VALUES

PAM\_SUCCESS

Default return code if no other value was specified, else specified return value.

## EXAMPLES

```
auth    requisite       pam_permit.so
auth    [success=2 default=ok]  pam_debug.so auth=perm_denied cred=success
auth    [default=reset]         pam_debug.so auth=success cred=perm_denied
auth    [success=done default=die] pam_debug.so
auth    optional        pam_debug.so auth=perm_denied cred=perm_denied
auth    sufficient      pam_debug.so auth=success cred=success
```

## SEE ALSO

[**pam.conf**(5)](/pam.conf/5.md), [**pam.d**(5)](/pam.d/5.md), [**pam**(8)](/pam/8.md)

## AUTHOR

pam\_debug was written by Andrew G. Morgan \<morgan@kernel.org\>.