---
name: "pam_unix2"
section: "8"
platform: "linux"
package: "libpam-unix2"
version: "1:2.4.1-6"
release: "Debian 7 (Wheezy)"
platforms: ["linux"]
url: "https://new.carta.tech/pam_unix2"
---

# pam\_unix2(8)

Standard PAM module for traditional password authentication

## NAME

pam\_unix2 - Standard PAM module for traditional password authentication

## DESCRIPTION

The **pam\_unix2** PAM module is for traditional password authentication. It uses standard calls from the glibc NSS libraries to retrieve and set account information as well as authentication. Usually this is obtained from the the local files **/etc/passwd** and **/etc/shadow** or  from a NIS map.

The options can be added in the PAM configuration files for every single service. **/etc/security/pam\_unix2.default** defines, which password encryption algorithm should be used in case of a password change.

## OPTIONS

The following options may be passed to all types of management groups except **session**:

- **debug**

  A lot of debug information is printed with [**syslog**(3)](/syslog/3.md).

- **nullok**

  Normally the account is disabled if no password is set or if the length of the password is zero. With this option the user is allowed to change the password for such accounts. This option does not overwrite a hardcoded default by the calling process.

- **use\_first\_pass**

  The default is, that **pam\_unix2** tries to get the authentication token from a previous module. If no token is available, the user is asked for the old password. With this option, **pam\_unix2** aborts with an error if no authentication token from a previous module is available.

The following additional options may be passed to the **passwd** rules of this modules:

- **nisdir=**\<path\>

  This options specifies a path to the source files for NIS maps on a NIS master server. If this option is given, the passwords of NIS accounts will not be changed with [**yppasswd**(1)](/yppasswd/1.md), instead the local *passwd* and *shadow* files below *\<path\>* will be modified. In conjunction with **rpasswdd**(8) and **pam\_make** [**rpc.yppasswdd**(8)](/rpc.yppasswdd/8.md) can be replaced with a more secure solution on the NIS master server.

- **use\_authtok**

  Set the new password to the one provided by the previously stacked password module. If this option is not set, **pam\_unix2** would ask the user for the new password.

One of the following options may be passed to the **session** rules of this modules:

- **debug**

  Some messages (login time, logout time) are logged to syslog with priority LOG\_DEBUG.

- **trace**

  Some messages (login time, logout time) are logged to syslog with priority LOG\_NOTICE.

- **none**

  No messages are logged. This is the default.

The **acct** management does not recognize any additional options. For root, password and login expire are ignored, only on aging warning is printed. If no shadow information exists, it always returns success.

## FILES

/etc/security/pam\_unix2.default

## SEE ALSO

[**login**(1)](/login/1.md), [**passwd**(1)](/passwd/1.md), [**pam.conf**(8)](/pam.conf/8.md), [**pam.d**(8)](/pam.d/8.md), **pam\_pwcheck**(8), [**pam**(8)](/pam/8.md), **rpasswd**(1), **rpasswdd**(8), [**rpc.yppasswdd**(8)](/rpc.yppasswdd/8.md), [**yppasswd**(1)](/yppasswd/1.md)