---
name: "pam_sshauth"
section: "8"
platform: "linux"
package: "libpam-sshauth"
version: "0.4.1-2+b1"
release: "Debian 9 (Stretch)"
platforms: ["linux"]
url: "https://new.carta.tech/pam_sshauth"
---

# pam\_sshauth(8)

PAM module which authenticates against an ssh server

## NAME

pam\_sshauth - PAM module which authenticates against an ssh server

## SYNOPSIS

**pam\_sshauth.so** \[debug\] \[nostrict\] \[shm\_askpass\] \[authtries=*tries*\] \[try\_first\_pass\] \[host=*host*\] \[port=*port*\]

## DESCRIPTION

pam\_sshauth is a PAM module that can be used to authenticate a user based on whether they can ssh into an external machine.  It is written using sshlib.

The following PAM environment list variables are set by the module: *PAM\_SSHAUTH\_HOST* and *PAM\_SSHAUTH\_PORT*. Both of these reflect what was passed on the PAM command line to the module.

The module will attempt to initiate an SSH session with the host specified.  It will support public-key, simple password, and keyboard-interactive authentication methods.  Note that, in order for keyboard-interactive methods to work, the SSH server must have enabled *ChallengeResponseAuthentication* in it's configuration.  This would be needed if you'd like the **pam\_sshauth** module to handle password expiry messages when talking to the SSH server.

## OPTIONS

**debug**

Log debug information to syslog.  The LOG\_AUTH facility is used.

**nostrict**

If contacting a host for which we don't have an entry in /etc/ssh/known\_hosts, ask, via the pam prompts, if you'd like to trust this host.  The default will be to fail the authentication.

**shm\_askpass**

Properly handle interaction with the ASKPASS helper shm\_askpass to allow you to spawn ssh sockets.

**host=***host*

Specifies the host we're to authenticate with.

**port=***port*

Specifies the port we're to contact the remote ssh server on (if not specified, it defaults to 22).

**authtries=***num*

Specifies the number of times we will try to authenticate.  Defaults to 3. Note that this is only the number of times **pam\_sshauth** will try.  If the SSH server has a smaller number specified via MaxAuthTries, **pam\_sshauth** will not override that.

**try\_first\_pass**

Use the authentication token previously obtained by another module in the pam stack.  If the token cannot be obtained, the **pam\_sshauth** will prompt for a password.

## MODULE TYPES PROVIDED

Only the **auth** module type is provided.

## RETURN VALUES

PAM\_SUCCESS

The user authenticated successfully.

PAM\_AUTH\_ERR

The user did not authenticate successfully.

PAM\_SYSTEM\_ERR

A system error occurred in establishing the ssh connection to the host specified.  Check the syslog for details.

## EXAMPLES

For an authentication line:

```
        auth required pam_sshauth.so debug nostrict host=192.168.0.254 port=22
```

## SEE ALSO

[**pam.conf**(5)](/pam.conf/5.md), [**pam.d**(5)](/pam.d/5.md), [**pam**(7)](/pam/7.md)

## FILES

/etc/ssh/ssh\_known\_hosts

Servers to be authenticated must have an entry present in this file. The format of this file is documented in the [**sshd**(8)](/sshd/8.md) man page.

## AUTHOR

pam\_sshauth was written by Scott Balneaves \<sbalneav@ltsp.org\>.