PAM
also: Pluggable Authentication Modules
PAM (Pluggable Authentication Modules) is a flexible framework that allows Linux administrators to configure how users are authenticated, authorized, and managed across the system without modifying individual applications.
PAM acts as an intermediary between user applications and the actual authentication mechanisms. Instead of hardcoding authentication logic into each program, applications call PAM libraries, which then delegate to configured modules for tasks like password verification, account validation, and session management.
PAM is configured through files in /etc/pam.d/, where each service (like login, sudo, or sshd) has its own configuration file. These files specify which PAM modules to use and in what order. For example, you might stack modules for password strength checking, two-factor authentication, LDAP directory lookup, and system logging all for a single login attempt.
Common PAM modules include pam_unix.so for traditional Unix password authentication, pam_ldap.so for directory services, and pam_limits.so for resource restrictions. This modularity means you can enable fingerprint authentication system-wide by installing one module, without touching application code.