PAM-AUTH-UPDATE(8)        (08/23/2008)         PAM-AUTH-UPDATE(8)

          pam-auth-update - manage PAM configuration using packaged

          pam-auth-update [--package [--remove profile [profile...]]]

          pam-auth-update is a utility that permits configuring the
          central authentication policy for the system using pre-
          defined profiles as supplied by PAM module packages.  Pro-
          files shipped in the /usr/share/pam-configs/ directory spec-
          ify the modules, with options, to enable; the preferred
          ordering with respect to other profiles; and whether a pro-
          file should be enabled by default.  Packages providing PAM
          modules register their profiles at install time by calling
          pam-auth-update --package.  Selection of profiles is done
          using the standard debconf interface.  The profile selection
          question will be asked at `medium' priority when packages
          are added or removed, so no user interaction is required by
          default.  Users may invoke pam-auth-update directly to
          change their authentication configuration.

          The script makes every effort to respect local changes to
          /etc/pam.d/common-*. Local modifications to the list of mod-
          ule options will be preserved, and additions of modules
          within the managed portion of the stack will cause
          pam-auth-update to treat the config files as locally modi-
          fied and not make further changes to the config files unless
          given the --force option.

          If the user specifies that pam-auth-update should override
          local configuration changes, the locally-modified files will
          be saved in /etc/pam.d/ with a suffix of .pam-old.

               Indicate that the caller is a package maintainer
               script; lowers the priority of debconf questions to
               `medium' so that the user is not prompted by default.

          --enable profile [profile...]
               Enable the specified profiles in system configuration.
               This is used to enable profiles that are not on by

          --remove profile [profile...]
               Remove the specified profiles from the system configu-
               ration.  pam-auth-update --remove should be used to

     Page 1                       Debian             (printed 5/25/22)

     PAM-AUTH-UPDATE(8)        (08/23/2008)         PAM-AUTH-UPDATE(8)

               remove profiles from the configuration before the mod-
               ules they reference are removed from disk, to ensure
               that PAM is in a consistent and usable state at all
               times during package upgrades or removals.

               Overwrite the current PAM configuration, without
               prompting.  This option must not be used by package
               maintainer scripts; it is intended for use by adminis-
               trators only.

              Global configuration of PAM, affecting all installed

              Package-supplied authentication profiles.

          Steve Langasek <>

          Copyright (C) 2008 Canonical Ltd.

          PAM(7), pam.d(5), debconf(7)

     Page 2                       Debian             (printed 5/25/22)