pam: Index | Examples | Files

package pam

import ""

Package pam provides a wrapper for the PAM application API.

This example uses whatever default PAM service configuration is available on the system, and tries to authenticate any user. This should cause PAM to ask its conversation handler for a username and password, in sequence.

This application will handle those requests by displaying the PAM-provided prompt and sending back the first line of stdin input it can read for each.

Keep in mind that unless run as root (or setuid root), the only user's authentication that can succeed is that of the process owner.


t, err := pam.StartFunc("", "", func(s pam.Style, msg string) (string, error) {
    switch s {
    case pam.PromptEchoOff:
        return speakeasy.Ask(msg)
    case pam.PromptEchoOn:
        fmt.Print(msg + " ")
        input, err := bufio.NewReader(os.Stdin).ReadString('\n')
        if err != nil {
            return "", err
        return input[:len(input)-1], nil
    case pam.ErrorMsg:
        return "", nil
    case pam.TextInfo:
        return "", nil
    return "", errors.New("Unrecognized message style")
if err != nil {
    log.Fatalf("Start: %s", err.Error())
err = t.Authenticate(0)
if err != nil {
    log.Fatalf("Authenticate: %s", err.Error())
fmt.Println("Authentication succeeded!")



Package Files

callback.go transaction.go


const (
    // PromptEchoOff indicates the conversation handler should obtain a
    // string without echoing any text.
    PromptEchoOff Style = C.PAM_PROMPT_ECHO_OFF
    // PromptEchoOn indicates the conversation handler should obtain a
    // string while echoing text.
    PromptEchoOn = C.PAM_PROMPT_ECHO_ON
    // ErrorMsg indicates the conversation handler should display an
    // error message.
    ErrorMsg = C.PAM_ERROR_MSG
    // TextInfo indicates the conversation handler should display some
    // text.
    TextInfo = C.PAM_TEXT_INFO

Coversation handler style types.

const (
    // Service is the name which identifies the PAM stack.
    Service Item = C.PAM_SERVICE
    // User identifies the username identity used by a service.
    User = C.PAM_USER
    // Tty is the terminal name.
    Tty = C.PAM_TTY
    // Rhost is the requesting host name.
    Rhost = C.PAM_RHOST
    // Authtok is the currently active authentication token.
    Authtok = C.PAM_AUTHTOK
    // Oldauthtok is the old authentication token.
    Oldauthtok = C.PAM_OLDAUTHTOK
    // Ruser is the requesting user name.
    Ruser = C.PAM_RUSER
    // UserPrompt is the string use to prompt for a username.
    UserPrompt = C.PAM_USER_PROMPT

PAM Item types.

const (
    // Silent indicates that no messages should be emitted.
    Silent Flags = C.PAM_SILENT
    // DisallowNullAuthtok indicates that authorization should fail
    // if the user does not have a registered authentication token.
    DisallowNullAuthtok = C.PAM_DISALLOW_NULL_AUTHTOK
    // EstablishCred indicates that credentials should be established
    // for the user.
    EstablishCred = C.PAM_ESTABLISH_CRED
    // DeleteCred inidicates that credentials should be deleted.
    DeleteCred = C.PAM_DELETE_CRED
    // ReinitializeCred indicates that credentials should be fully
    // reinitialized.
    ReinitializeCred = C.PAM_REINITIALIZE_CRED
    // RefreshCred indicates that the lifetime of existing credentials
    // should be extended.
    RefreshCred = C.PAM_REFRESH_CRED
    // ChangeExpiredAuthtok indicates that the authentication token
    // should be changed if it has expired.
    ChangeExpiredAuthtok = C.PAM_CHANGE_EXPIRED_AUTHTOK

PAM Flag types.

type ConversationFunc Uses

type ConversationFunc func(Style, string) (string, error)

ConversationFunc is an adapter to allow the use of ordinary functions as conversation callbacks.

func (ConversationFunc) RespondPAM Uses

func (f ConversationFunc) RespondPAM(s Style, msg string) (string, error)

RespondPAM is a conversation callback adapter.

type ConversationHandler Uses

type ConversationHandler interface {
    // RespondPAM receives a message style and a message string. If the
    // message Style is PromptEchoOff or PromptEchoOn then the function
    // should return a response string.
    RespondPAM(Style, string) (string, error)

ConversationHandler is an interface for objects that can be used as conversation callbacks during PAM authentication.

type Flags Uses

type Flags int

Flags are inputs to various PAM functions than be combined with a bitwise or. Refer to the official PAM documentation for which flags are accepted by which functions.

type Item Uses

type Item int

Item is a an PAM information type.

type Style Uses

type Style int

Style is the type of message that the conversation handler should display.

type Transaction Uses

type Transaction struct {
    // contains filtered or unexported fields

Transaction is the application's handle for a PAM transaction.

func Start Uses

func Start(service, user string, handler ConversationHandler) (*Transaction, error)

Start initiates a new PAM transaction. Service is treated identically to how pam_start treats it internally.

All application calls to PAM begin with Start (or StartFunc). The returned transaction provides an interface to the remainder of the API.

func StartFunc Uses

func StartFunc(service, user string, handler func(Style, string) (string, error)) (*Transaction, error)

StartFunc registers the handler func as a conversation handler.

func (*Transaction) AcctMgmt Uses

func (t *Transaction) AcctMgmt(f Flags) error

AcctMgmt is used to determine if the user's account is valid.

Valid flags: Silent, DisallowNullAuthtok

func (*Transaction) Authenticate Uses

func (t *Transaction) Authenticate(f Flags) error

Authenticate is used to authenticate the user.

Valid flags: Silent, DisallowNullAuthtok

func (*Transaction) ChangeAuthTok Uses

func (t *Transaction) ChangeAuthTok(f Flags) error

ChangeAuthTok is used to change the authentication token.

Valid flags: Silent, ChangeExpiredAuthtok

func (*Transaction) CloseSession Uses

func (t *Transaction) CloseSession(f Flags) error

CloseSession closes a previously opened session.

Valid flags: Silent

func (*Transaction) Error Uses

func (t *Transaction) Error() string

func (*Transaction) GetEnv Uses

func (t *Transaction) GetEnv(name string) string

GetEnv is used to retrieve a PAM environment variable.

func (*Transaction) GetEnvList Uses

func (t *Transaction) GetEnvList() (map[string]string, error)

GetEnvList returns a copy of the PAM environment as a map.

func (*Transaction) GetItem Uses

func (t *Transaction) GetItem(i Item) (string, error)

GetItem retrieves a PAM information item.

func (*Transaction) OpenSession Uses

func (t *Transaction) OpenSession(f Flags) error

OpenSession sets up a user session for an authenticated user.

Valid flags: Slient

func (*Transaction) PutEnv Uses

func (t *Transaction) PutEnv(nameval string) error

PutEnv adds or changes the value of PAM environment variables.

NAME=value will set a variable to a value. NAME= will set a variable to an empty value. NAME (without an "=") will delete a variable.

func (*Transaction) SetCred Uses

func (t *Transaction) SetCred(f Flags) error

SetCred is used to establish, maintain and delete the credentials of a user.

Valid flags: EstablishCred, DeleteCred, ReinitializeCred, RefreshCred

func (*Transaction) SetItem Uses

func (t *Transaction) SetItem(i Item, item string) error

SetItem sets a PAM information item.

Package pam imports 5 packages (graph) and is imported by 11 packages. Updated 2020-12-01. Refresh now. Tools for package owners.