Authentication through PAM
How does it work?
Writing applications to use the PAM APIs to delegate authentication offers the freedom to use any authentication method that you wish. For instance, if you currently use /etc/shadow and want to have a centralized LDAP server provide authentication instead, all you have to do is update PAM's configuration settings. Applications themselves are unaware of the change.
On a Linux system, PAM configuration files live either in /etc/pamd.conf, or in /etc/pamd./ . If the latter, each application must have a corresponding file in /etc/pam.d/, eg. ftp, imap, etc.
A PAM configuration file consists of a few lines, with the following format:
module-type control-flag module-path arguments
Module types
Description
auth
Prompts the user for identification
account
Checks account settings (aging, etc.)
session
Provides functions before and after session establishment
password
Used with the auth type to update the user authentication token. Possible values are nullok (lets the user change from a null password), use_authok (set the new password as received from the previous module), md5 or bigcrypt (uses stronger hashing than standard crypt), shadow or radius or unix (transfers passwords to another database)