---
name: "pam_group"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd", "macos"]
url: "https://new.carta.tech/pam_group"
---

# pam\_group(8)

Group PAM module

## NAME

**pam\_group** – Group PAM module

## SYNOPSIS

\[*service-name*\] *module-type* *control-flag* *pam\_group* \[*arguments*\]

## DESCRIPTION

The group service module for PAM accepts or rejects users based on their membership in a particular file group. **pam\_group** provides functionality for two PAM categories: authentication and account management. In terms of the module-type parameter, they are the \`\`auth'' and \`\`account'' features.

The following options may be passed to the **pam\_group** module:

- **deny**

  Reverse the meaning of the test, i.e., reject the applicant if and only if he or she is a member of the specified group. This can be useful to exclude certain groups of users from certain services.

- **fail\_safe**

  If the specified group does not exist, or has no members, act as if it does exist and the applicant is a member.

- **group**=*groupname*

  Specify the name of the group to check. The default is “wheel”.

- **luser**

  Accept or reject based on the target user's group membership.

- **root\_only**

  Skip this module entirely if the target account is not the superuser account.

- **ruser**

  Accept or reject based on the supplicant's group membership. This is the default.

Note that the **luser** and **ruser** options are mutually exclusive, and that **pam\_group** will fail if both are specified.

## SEE ALSO

[pam(3)](/pam/3.md), [pam.conf(5)](/pam.conf/5.md)

## AUTHORS

The **pam\_group** module and this manual page were developed for the FreeBSD Project by ThinkSec AS and NAI Labs, the Security Research Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.