# pam-auth-update - manage PAM configuration using packaged profiles - man(8) - [phpMan]

[_PAM-AUTH-UPDATE_(8)](https://www.chedong.com/phpMan.php/man/PAM-AUTH-UPDATE/8/markdown)                     System Manager's Manual                    [_PAM-AUTH-UPDATE_(8)](https://www.chedong.com/phpMan.php/man/PAM-AUTH-UPDATE/8/markdown)

## NAME
       pam-auth-update - manage PAM configuration using packaged profiles

## SYNOPSIS
       **pam-auth-update  **[**--package  **[**--remove  _**profile_  [_profile_...]]]   [**--force**] [**--enable _**profile_
       [_profile_...]]  [**--disable _**profile_ [_profile_...]]

## DESCRIPTION
       _pam-auth-update_ is a utility that permits configuring the central authentication  policy  for
       the  system  using pre-defined profiles as supplied by PAM module packages.  Profiles shipped
       in the _/usr/share/pam-configs/_ directory specify the modules, with options,  to  enable;  the
       preferred ordering with respect to other profiles; and whether a profile should be enabled by
       default.   Packages  providing PAM modules register their profiles at install time by calling
       **pam-auth-update --package**.  Selection of profiles is done using the standard  debconf  inter‐
       face.   The  profile  selection question will be asked at `medium' priority when packages are
       added or removed,  so  no  user  interaction  is  required  by  default.   Users  may  invoke
       **pam-auth-update **directly to change their authentication configuration.

       The script makes every effort to respect local changes to _/etc/pam.d/common-*_.  Local modifi‐
       cations  to the list of module options will be preserved, and additions of modules within the
       managed portion of the stack will cause **pam-auth-update **to treat the config files as  locally
       modified and not make further changes to the config files unless given the **--force **option.

       If  the  user specifies that **pam-auth-update **should override local configuration changes, the
       locally-modified files will be saved in _/etc/pam.d/_ with a suffix of _.pam-old_.

## OPTIONS
### --package
              Indicate that the caller is a package maintainer script; lowers the priority  of  deb‐
              conf questions to `medium' so that the user is not prompted by default.

       **--disable _**profile_ [_profile_...]
              Disable  the specified profiles in system configuration.  This can be used from system
              administration scripts to disable profiles.

       **--enable _**profile_ [_profile_...]
              Enable the specified profiles in system configuration. This is used to enable profiles
              that are not on by default.

       **--remove _**profile_ [_profile_...]
              Remove the specified profiles from the system configuration.  **pam-auth-update --remove**
              should be used to remove profiles from the configuration before the modules they  ref‐
              erence  are  removed from disk, to ensure that PAM is in a consistent and usable state
              at all times during package upgrades or removals.

### --force
              Overwrite the current PAM configuration, without prompting.  This option **must  not  **be
              used by package maintainer scripts; it is intended for use by administrators only.

## FILES
       _/etc/pam.d/common-*_
           Global configuration of PAM, affecting all installed services.

       _/usr/share/pam-configs/_
           Package-supplied authentication profiles.

## AUTHOR
       Steve Langasek <<steve.langasek@canonical.com>>

## COPYRIGHT
       Copyright (C) 2008 Canonical Ltd.

## SEE ALSO
       [PAM(7)](https://www.chedong.com/phpMan.php/man/PAM/7/markdown), [pam.d(5)](https://www.chedong.com/phpMan.php/man/pam.d/5/markdown), [debconf(7)](https://www.chedong.com/phpMan.php/man/debconf/7/markdown)

Debian                                       08/23/2008                           [_PAM-AUTH-UPDATE_(8)](https://www.chedong.com/phpMan.php/man/PAM-AUTH-UPDATE/8/markdown)