---
name: "pam_exec"
section: "8"
platform: "linux"
package: "pam"
version: "1.7.3-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/pam_exec"
---

# pam\_exec(8)

PAM module which calls an external command

## NAME

pam\_exec - PAM module which calls an external command

## SYNOPSIS

**pam\_exec.so** \[debug\] \[expose\_authtok\] \[seteuid\] \[quiet\] \[quiet\_log\] \[stdout\] \[log=*file*\] \[type=*type*\] *command* \[*...*\]

## DESCRIPTION

pam\_exec is a PAM module that can be used to run an external command.

The child's environment is set to the current PAM environment list, as returned by [**pam\_getenvlist**(3)](/pam_getenvlist/3.md) In addition, the following PAM items are exported as environment variables: *PAM\_RHOST*, *PAM\_RUSER*, *PAM\_SERVICE*, *PAM\_TTY*, *PAM\_USER* and *PAM\_TYPE*, which contains one of the module types: **account**, **auth**, **password**, **open\_session** and **close\_session**.

Commands called by pam\_exec need to be aware of that the user can have control over the environment.

## OPTIONS

debug

Print debug information.

expose\_authtok

During authentication and password change the calling command can read the password from [**stdin**(3)](/stdin/3.md). Only first *PAM\_MAX\_RESP\_SIZE* bytes of a password are provided to the command.

log=file

The output of the command is appended to file

type=type

Only run the command if the module type matches the given type.

stdout

Per default the output of the executed command is written to /dev/null. With this option, the stdout output of the executed command is redirected to the calling application. It's in the responsibility of this application what happens with the output. The **log** option is ignored.

quiet

Per default pam\_exec.so will echo the exit status of the external command if it fails. Specifying this option will suppress the message.

quiet\_log

Per default pam\_exec.so will log the exit status of the external command if it fails. Specifying this option will suppress the log message.

seteuid

Per default pam\_exec.so will execute the external command with the real user ID of the calling process. Specifying this option means the command is run with the effective user ID.

## MODULE TYPES PROVIDED

All module types (**auth**, **account**, **password** and **session**) are provided.

## RETURN VALUES

PAM\_SUCCESS

The external command was run successfully.

PAM\_BUF\_ERR

Memory buffer error.

PAM\_CONV\_ERR

The conversation method supplied by the application failed to obtain the username.

PAM\_INCOMPLETE

The conversation method supplied by the application returned PAM\_CONV\_AGAIN.

PAM\_SERVICE\_ERR

No argument or a wrong number of arguments were given.

PAM\_SYSTEM\_ERR

A system error occurred or the command to execute failed.

PAM\_IGNORE

**pam\_setcred** was called, which does not execute the command. Or, the value given for the type= parameter did not match the module type.

## EXAMPLES

Add the following line to /etc/pam.d/passwd to rebuild the NIS database after each local password change:

```
        password optional pam_exec.so seteuid /usr/bin/make -C /var/yp
```

This will execute the command

```
make -C /var/yp
```

with effective user ID.

## SEE ALSO

[**pam.conf**(5)](/pam.conf/5.md), [**pam.d**(5)](/pam.d/5.md), [**pam**(8)](/pam/8.md)

## AUTHOR

pam\_exec was written by Thorsten Kukuk \<kukuk@thkukuk.de\> and Josh Triplett \<josh@joshtriplett.org\>.