Free tools Windows power users keep installed
One-click scans. No signup required.
Configure PAM on a Linux VPS by identifying the service stack in /etc/pam.d/ (or /etc/pam.conf), making the smallest possible change, and testing it from a second SSH connection before closing your existing session. For SSH, the service file is normally /etc/pam.d/sshd; UsePAM yes in /etc/ssh/sshd_config enables PAM authentication methods and PAM account and session processing.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
PAM changes can lock out every administrator if a file is deleted, malformed, or ordered incorrectly. Keep an active administrative session, make a backup, use your distribution’s supported profile tool where available, validate sshd, reload rather than stop it, and have the VPS provider’s console or rescue environment ready.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What PAM does on a Linux VPS
Linux-PAM is a local framework that lets applications delegate authentication and related policy to a common set of modules. The application supplies a service name, and PAM loads the corresponding rules and modules. An SSH login is therefore not controlled by one universal PAM file: sshd normally reads /etc/pam.d/sshd, which may in turn include other distribution-managed files.
There are two configuration layouts:
/etc/pam.conf: one file containing rules for multiple services./etc/pam.d/: one file per service, with the filename matching the service name. A file namedsshdsupplies the SSH stack.
Distributions can use either layout and can arrange included files differently. Inspect the files on the VPS instead of copying a stack from another distribution. A syntactically valid stack for one release can have the wrong module names, include paths, or account policy on another.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The four PAM management groups
Every PAM rule belongs to one management group. A module can implement one group or several; the group determines when PAM calls it.
| Group | Purpose | Typical SSH effect |
|---|---|---|
auth |
Establishes the user’s identity by checking a password, key-related challenge, token, or another factor. | Prompts for and verifies a password or interactive factor when the selected SSH method invokes PAM. |
account |
Determines whether an already identified account is permitted to use the service. | Applies expiry, access restrictions, time limits, or directory-account policy. |
password |
Changes authentication tokens and enforces password-change rules. | Runs when a password is set or changed, including complexity or history checks supplied by modules. |
session |
Performs setup when a session opens and cleanup when it closes. | Applies limits, logging, environment setup, mounts, or other open/close actions. |
These stacks are independent. A key-only SSH login can still invoke PAM account and session processing when PAM is enabled, even if no PAM password prompt appears.
How to read a PAM rule
A traditional rule has four parts:
module_type control_flag module_name module_argumentsFor example:
auth required pam_unix.soThis invokes the Unix password module as a required authentication step. Arguments follow the module name and are specific to that module.
Control flags and stack order
PAM evaluates rules as a stack. The control flag determines how each result affects the rest of the stack and the final result.
| Control | General behavior | Why order matters |
|---|---|---|
required |
The rule must succeed, but PAM normally continues through later rules before returning the failure. | A later module may run even after this rule fails; the overall request still fails if the required error remains. |
requisite |
The rule must succeed; a failure normally stops evaluation immediately. | It can prevent later prompts or modules from running. |
sufficient |
A success can finish the stack early when no earlier required rule has failed. A failure is usually non-fatal by itself. | Moving it can change whether another factor is reached. |
optional |
The result matters only when no other decisive result determines the stack. | It should not be mistaken for a required security check. |
| Bracketed mappings | A result map such as [success=1 default=ignore] assigns actions to individual module results. |
Small changes can skip or execute subsequent rules, so preserve the distribution’s tested syntax. |
Do not infer a module’s behavior from its name alone. Read the module’s documentation for the installed release and preserve comments and include directives. On systems using generated profiles, manually replacing the stack can be overwritten or can remove distribution-specific safeguards.
How OpenSSH connects to PAM
In /etc/ssh/sshd_config, UsePAM yes tells OpenSSH to use PAM. With it enabled, sshd can use PAM through password and keyboard-interactive authentication, and it runs PAM account and session processing for all authentication types.
UsePAM does not by itself force a password prompt. The available methods are also controlled by SSH settings such as:
PasswordAuthenticationcontrols the SSH password method.KbdInteractiveAuthenticationcontrols keyboard-interactive exchanges, which commonly carry PAM prompts for passwords or additional factors.
Keyboard-interactive PAM authentication often serves the same purpose as password authentication. Offering both can produce two equivalent prompts or confuse users. Enable the method required by your policy and disable the redundant one; do not assume that changing UsePAM alone changes every prompt.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Prepare the VPS before editing
1. Identify the operating system and keep recovery access
Record the distribution and release before touching PAM. A simple check is:
cat /etc/os-releaseKeep your current root or administrative SSH connection open. Open a second terminal only for testing, and confirm that the VPS provider’s web console, serial console, or rescue environment is available. If the new stack rejects every login, those are the paths that let you restore the files.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →2. Back up all relevant files
Back up the PAM configuration and SSH daemon configuration, preserving ownership and permissions. For example:
sudo cp -a /etc/pam.d /root/pam.d.backup
sudo cp -a /etc/ssh/sshd_config /root/sshd_config.backup
if [ -e /etc/pam.conf ]; then sudo cp -a /etc/pam.conf /root/pam.conf.backup; fiUse a timestamped archive as an additional copy if your normal backup process permits it. Store the backup somewhere reachable from the open administrative session, not only inside a directory that a failed policy might make inaccessible.
Locate and map the SSH PAM stack
Inspect service files
List the directory and inspect the SSH file:
sudo ls -la /etc/pam.d/
sudo sed -n '1,240p' /etc/pam.d/sshdIf /etc/pam.d/sshd does not exist, inspect /etc/pam.conf and check how the installed SSH package is configured. Do not create a new file merely because another distribution uses one.
Follow includes
Look for lines such as include, @include, or stack directives that refer to common files. Typical names include files for shared authentication, account, password, and session policy, but names and locations vary by release. Read every referenced file before changing a rule; the effective SSH policy is the combination of the service file and the included stacks.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCheck ownership and permissions
Confirm that configuration files are owned by root and are not writable by ordinary users:
sudo stat -c '%A %U:%G %n' /etc/pam.d/sshd /etc/ssh/sshd_configThe exact permission baseline can differ by distribution, but a PAM file writable by an unprivileged account is a direct way to undermine authentication.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Choose an authentication design
Before editing syntax, decide where identities come from and what happens when an external dependency is unavailable. Common designs differ in more than the login prompt.
| Design | Identity source | PAM groups commonly involved | Decisions to make |
|---|---|---|---|
| Local Unix accounts | Local password and account databases. | auth, account, password, and often session. |
How password changes, expiry, lockout, and local recovery are handled. |
| Directory-backed modules | A network directory or other external identity service. | Usually auth and account; some modules also provide password or session. |
Whether logins fail closed or use a cached/local fallback when the directory is unreachable, and how directory groups map to access. |
| MFA modules | A local account or directory plus a second-factor provider. | Usually an additional auth rule, with existing account and session rules retained. |
Prompt order, enrollment and recovery, emergency access, and behavior if the factor service is down. |
For each design, evaluate identity source, the groups implemented, stack order and failure behavior, compatibility with the distribution’s profile manager, recovery when an external service is unavailable, and whether key-based users still receive the intended account and session checks.
Distribution-aware editing
Use the supported profile manager when one exists
Some enterprise distributions manage PAM through authselect. The supported profiles encode tested combinations of modules and include files. Use the tool’s documented profile workflow rather than hand-editing generated files, and verify which profile is active before changing it.
Red Hat documentation warns: “Manual editing of PAM configuration files might lead to authentication and access issues. Configure PAMs using the authselect tool.” Treat that warning literally: a hand edit can be overwritten during a profile change, or can leave the profile internally inconsistent.
Do not transplant a generic stack
The pam_unix.so module can provide all four management groups, but that does not mean every line belongs in every stack. Its placement, control flag, and interaction with other modules determine whether a password is checked, whether a second factor is reached, and whether account or session processing continues. Preserve the distribution’s existing order and add one tested rule at a time.
Configure SSH to use the intended PAM methods
Edit only the relevant directives
Open /etc/ssh/sshd_config with a root-capable editor and set the policy explicitly. A common pattern for PAM-backed password or keyboard-interactive authentication is:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
UsePAM yes
PasswordAuthentication yes
KbdInteractiveAuthentication yesThose values are an example of how the settings relate, not a universal security recommendation. If you want only keyboard-interactive prompts for an MFA flow, disable the redundant password method. If you want key-only SSH while retaining PAM account and session checks, leave password methods disabled but keep UsePAM yes; verify the behavior on the actual release.
Check for conflicting settings
SSH reads the effective configuration after applying its file and any included fragments. Search for repeated directives and conditional blocks so that a later value does not silently override the one you changed:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo grep -RInE '^[[:space:]]*(UsePAM|PasswordAuthentication|KbdInteractiveAuthentication|Match|Include)' /etc/ssh/sshd_config /etc/ssh/sshd_config.d 2>/dev/nullA Match block can give a user, group, address, or host-specific result. Test the policy for the same connection context your users will have.
Apply changes without cutting off the only session
- Make one small change. Avoid replacing an entire PAM file. Save the original and record exactly which line or profile changed.
- Validate the SSH configuration. Run the local daemon check before reloading:
sudo sshd -t -f /etc/ssh/sshd_configIf your distribution uses a different path or wrapper, use its installed validation command. A successful syntax check does not prove that a PAM module exists or that the policy will accept a user.
- Reload, do not stop, the daemon. Use the service name supplied by your distribution, commonly
sshdorssh:sudo systemctl reload sshdA reload lets existing sessions continue while new connections use the revised configuration. If the unit is named
ssh, substitute that name. - Keep the original session open. Do not close it, log out, or reboot until a separate client has completed the intended login and session setup.
- Test from a second client. Use a new terminal, network path, or account so you are not accidentally reusing an authenticated connection.
Verify success, failure, and session behavior
Test the positive path
Confirm the exact method you intend to support: a key, a password, keyboard-interactive prompts, or a combination. Check that the expected account is accepted, that the shell or command session starts, and that session limits or environment setup supplied by PAM still occur.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchTest a controlled negative path
Use an invalid password or a test account that should be denied. For an account-policy change, test an expired or otherwise restricted account only in a controlled environment. A policy is not verified if it has been tested only with an administrator who bypasses the new rule.
Read the authentication logs
Review the service journal or the distribution’s authentication log while testing:
sudo journalctl -u sshd -u ssh -bDepending on the distribution and release, relevant records may instead be in /var/log/auth.log or /var/log/secure. Look for the SSH service name, PAM module name, account result, and whether the failure occurred during authentication, account checks, or session setup. Exact log wording differs by module.
Check key-based logins separately
When UsePAM yes is active, key authentication can still trigger PAM account and session modules. Verify that a key user is neither unexpectedly prompted for a password nor incorrectly admitted after an account restriction should have denied access.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Recovery when a PAM change breaks access
Use the open session first
Restore the last known-good copy from the still-open administrative connection, then validate and reload SSH again. For example:
sudo cp -a /root/pam.d.backup /etc/pam.d
sudo cp -a /root/sshd_config.backup /etc/ssh/sshd_config
sudo sshd -t -f /etc/ssh/sshd_config
sudo systemctl reload sshdRestore /etc/pam.conf from its backup as well if your system uses that layout. Do not overwrite a working file with an archive whose contents you have not checked.
Use the provider console or rescue system
If every SSH session is rejected, connect through the VPS provider’s out-of-band console or boot a rescue environment. Mount the system filesystem if necessary, restore the backed-up PAM and SSH files, correct ownership and permissions, then reboot or restart the SSH service according to the rescue environment’s procedure.
Understand the worst case
Linux-PAM configuration errors can disable access partially or completely. Deleting files under /etc/pam.d/ or deleting /etc/pam.conf can lock out the administrator. That is why an independent console or rescue path is a prerequisite, not an optional convenience.
Common failure modes and fixes
The new module is never called
Check that the rule is in the service stack actually used by SSH, not an unrelated file. Follow every include and verify that the relevant SSH authentication method is enabled. A module placed only in password will not run during a normal login, and a module placed only in auth will not enforce a password-change policy.
A second factor is bypassed
Inspect control flags and order. A preceding sufficient success can short-circuit the stack, while an optional rule may not be decisive. Confirm that the selected SSH method reaches the MFA rule and that no conditional Match block changes the result.
Users receive duplicate password prompts
Review PasswordAuthentication and KbdInteractiveAuthentication. If both expose equivalent PAM password prompts, disable the method your policy does not need and test again from a fresh connection.
Configuration works until a system update
The file may be generated or replaced by a distribution profile manager. Identify whether the system uses authselect or another supported mechanism, make the change in that profile, and keep a record of the selected profile and local customizations.
SSH syntax passes but login fails
sshd -t checks SSH configuration syntax, not PAM module availability, arguments, permissions, directory reachability, or account policy. Use the authentication journal or log files to identify the failing management group and module, then revert the smallest recent change before trying another edit.
Quick Recap
Operational checklist
- Identify the distribution and release.
- Keep an administrative SSH session open.
- Confirm console or rescue access.
- Back up
/etc/pam.confor/etc/pam.d/and/etc/ssh/sshd_config. - Inspect
/etc/pam.d/sshdand all included files. - Understand the
auth,account,password, andsessionstacks. - Preserve distribution-specific order and use the supported profile tool where available.
- Set
UsePAM yesonly with the SSH methods your policy requires. - Validate with the installed SSH daemon check.
- Reload instead of stopping SSH.
- Test a successful login, a denied case, key-based behavior, account restrictions, and session setup from a second client.
- Keep the original session until all tests pass and the recovery copy is confirmed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
