{
    "mode": "man",
    "parameter": "pam-auth-update",
    "section": "8",
    "url": "https://www.chedong.com/phpMan.php/man/pam-auth-update/8/json",
    "generated": "2026-06-02T21:27:37Z",
    "synopsis": "pam-auth-update [--package [--remove profile [profile...]]]  [--force]",
    "sections": {
        "NAME": {
            "content": "pam-auth-update - manage PAM configuration using packaged profiles\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "pam-auth-update [--package [--remove profile [profile...]]]  [--force]\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "pam-auth-update  is  a utility that permits configuring the central authentication policy for\nthe system using pre-defined profiles as supplied by PAM module packages.   Profiles  shipped\nin  the  /usr/share/pam-configs/  directory specify the modules, with options, to enable; the\npreferred ordering with respect to other profiles; and whether a profile should be enabled by\ndefault.   Packages  providing PAM modules register their profiles at install time by calling\npam-auth-update --package.  Selection of profiles is done using the standard  debconf  inter‐\nface.   The  profile  selection question will be asked at `medium' priority when packages are\nadded or removed,  so  no  user  interaction  is  required  by  default.   Users  may  invoke\npam-auth-update directly to change their authentication configuration.\n\nThe script makes every effort to respect local changes to /etc/pam.d/common-*.  Local modifi‐\ncations to the list of module options will be preserved, and additions of modules within  the\nmanaged  portion of the stack will cause pam-auth-update to treat the config files as locally\nmodified and not make further changes to the config files unless given the --force option.\n\nIf the user specifies that pam-auth-update should override local configuration  changes,  the\nlocally-modified files will be saved in /etc/pam.d/ with a suffix of .pam-old.\n",
            "subsections": []
        },
        "OPTIONS": {
            "content": "",
            "subsections": [
                {
                    "name": "--package",
                    "content": "Indicate  that  the caller is a package maintainer script; lowers the priority of deb‐\nconf questions to `medium' so that the user is not prompted by default.\n\n--enable profile [profile...]\nEnable the specified profiles in system configuration. This is used to enable profiles\nthat are not on by default.\n\n--remove profile [profile...]\nRemove the specified profiles from the system configuration.  pam-auth-update --remove\nshould be used to remove profiles from the configuration before the modules they  ref‐\nerence  are  removed from disk, to ensure that PAM is in a consistent and usable state\nat all times during package upgrades or removals.\n",
                    "long": "--package"
                },
                {
                    "name": "--force",
                    "content": "Overwrite the current PAM configuration, without prompting.  This option must  not  be\nused by package maintainer scripts; it is intended for use by administrators only.\n",
                    "long": "--force"
                }
            ]
        },
        "FILES": {
            "content": "/etc/pam.d/common-*\nGlobal configuration of PAM, affecting all installed services.\n\n/usr/share/pam-configs/\nPackage-supplied authentication profiles.\n",
            "subsections": []
        },
        "AUTHOR": {
            "content": "Steve Langasek <steve.langasek@canonical.com>\n",
            "subsections": []
        },
        "COPYRIGHT": {
            "content": "Copyright (C) 2008 Canonical Ltd.\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "PAM(7), pam.d(5), debconf(7)\n\n\n\nDebian                                       08/23/2008                           PAM-AUTH-UPDATE(8)",
            "subsections": []
        }
    },
    "summary": "pam-auth-update - manage PAM configuration using packaged profiles",
    "flags": [
        {
            "flag": "",
            "long": "--package",
            "arg": null,
            "description": "Indicate that the caller is a package maintainer script; lowers the priority of deb‐ conf questions to `medium' so that the user is not prompted by default. --enable profile [profile...] Enable the specified profiles in system configuration. This is used to enable profiles that are not on by default. --remove profile [profile...] Remove the specified profiles from the system configuration. pam-auth-update --remove should be used to remove profiles from the configuration before the modules they ref‐ erence are removed from disk, to ensure that PAM is in a consistent and usable state at all times during package upgrades or removals."
        },
        {
            "flag": "",
            "long": "--force",
            "arg": null,
            "description": "Overwrite the current PAM configuration, without prompting. This option must not be used by package maintainer scripts; it is intended for use by administrators only."
        }
    ],
    "examples": [],
    "see_also": [
        {
            "name": "PAM",
            "section": "7",
            "url": "https://www.chedong.com/phpMan.php/man/PAM/7/json"
        },
        {
            "name": "pam.d",
            "section": "5",
            "url": "https://www.chedong.com/phpMan.php/man/pam.d/5/json"
        },
        {
            "name": "debconf",
            "section": "7",
            "url": "https://www.chedong.com/phpMan.php/man/debconf/7/json"
        },
        {
            "name": "PAM-AUTH-UPDATE",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/PAM-AUTH-UPDATE/8/json"
        }
    ]
}