pam_dotfile

Pam_dotfile is a PAM module that provides users the option to have multiple passwords for a single account for different services. This is particularly useful for users who are uncomfortable using the same password for SSH access and an IMAP4 mailbox, for instance. In this scenario, the user may prefer having distinct passwords for different purposes. For example, users may choose to save their IMAP4 password in their mail agent configuration but not their SSH password. The same goes for services like FTP and POP3 mailboxes.

The software is equipped with different PAM parameters that offer several functionalities. The debug parameter ensures that the module is verbose and records everything in syslogs(3). The use_first_pass parameter uses the password supplied by a previous module and doesn't prompt for the same. The try_first_pass parameter is similar to use_first_pass, except that it doesn't fail if there is no password supplied. Instead, it queries the user. The use_authtok parameter is synonymous with use_first_pass.

Pam_dotfile's rootok parameter doesn't deny access to users with uid == 0, while nullok enables access for null passwords. The fork parameter always forks for opening password files via the helper tool, whereas nofork never forks. The no_warn parameter suppresses warnings to syslogs(3).

Finally, the stat_only_home parameter verifies group/world readability inside the home directory. If the configuration file is /home/waldo/.pam/service, only /home/waldo/.pam and /home/waldo are tested. This is particularly useful if the home directories contain symbolic links. The nocompat05 parameter disables compatibility with pam_dotfile.

Overall, Pam_dotfile is a great tool for users who want greater flexibility in setting multiple passwords for different services. Its different PAM parameters ensure that users can personalize their accounts while maintaining optimum security.