iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Configure PAM on a Linux VPS by editing the service stack in /etc/pam.d/ (or the legacy /etc/pam.conf), enabling the service to call PAM, and testing from a second connection before closing your current session. For SSH, the usual stack is /etc/pam.d/sshd, while UsePAM yes in /etc/ssh/sshd_config allows OpenSSH to run PAM authentication, account checks, and session modules.
PAM changes can lock out every administrator if a file is deleted, a control flag is wrong, or a generated profile is overwritten. Keep an existing privileged session open, back up the configuration, use your distribution’s supported profile tool when available, and arrange console or rescue access before changing anything.
What PAM does on a Linux VPS
Linux-PAM (Pluggable Authentication Modules) is a local framework that lets applications delegate authentication and related policy to a stack of modules. An application such as OpenSSH asks the PAM library to process a named service. PAM then reads either the single /etc/pam.conf file or a set of service files below /etc/pam.d/. The service filename connects the application to its stack: SSH normally uses /etc/pam.d/sshd.
The Linux-PAM System Administrators’ Guide describes the arrangement this way: “This PAM library is configured locally with a system file, /etc/pam.conf (or a series of configuration files located in /etc/pam.d/) to authenticate a user request via the locally available authentication modules.” PAM is therefore not an internet service by itself. It is a local policy layer that may call local password databases, directory clients, hardware-token modules, or other mechanisms installed on the VPS.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
PAM versus the SSH daemon
sshd still controls transport encryption, host keys, and which authentication methods are offered. PAM controls the checks that the SSH daemon delegates to it. A key-only login can therefore use no PAM credential prompt while still passing through PAM account and session processing when PAM is enabled. This distinction matters when you add expiry rules, access restrictions, resource limits, logging, or MFA.
Where PAM configuration lives
Most current distributions use one file per service in /etc/pam.d/. A system can also use /etc/pam.conf; when both models are present, follow the distribution’s documented precedence and include rules rather than guessing. Do not assume that a file copied from another distribution has the same includes, module paths, or control syntax.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Identify the operating system and release
Record the distribution and release before editing because package names, service names, generated profiles, and log locations differ. Typical identification commands are:
cat /etc/os-release
uname -a
Keep the output with your change record. On enterprise distributions that manage PAM profiles, the supported profile manager may regenerate files during updates. Red Hat documentation specifically warns: “Manual editing of PAM configuration files might lead to authentication and access issues. Configure PAMs using the authselect tool.” On such systems, make profile changes through authselect when the desired policy is supported instead of hand-editing generated files.
Back up all related files
Save the complete PAM directory, the optional monolithic file, and the SSH daemon configuration. A root shell can create a dated archive like this:
install -d -m 700 /root/pam-backup
tar -czf /root/pam-backup/pam-ssh-$(date +%Y%m%d-%H%M%S).tar.gz
/etc/pam.conf /etc/pam.d /etc/ssh/sshd_config 2>/root/pam-backup/backup-errors.log
If your system reports that /etc/pam.conf does not exist, that is normal on many installations; verify that the /etc/pam.d directory was included and that the archive is readable. Keep a copy outside the VPS as well as on it.
The four PAM management groups
Every PAM rule belongs to one management group. A module can implement one or several groups, but the groups are processed independently for a service request.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
| Group | Purpose | Typical SSH implication |
|---|---|---|
auth |
Establishes the user’s identity, commonly by prompting for a password or another challenge. | Checks a password, token, certificate-backed assertion, or MFA challenge. |
account |
Decides whether an already identified account is allowed to use the service. | Enforces expiry, access policy, login restrictions, or account state. |
password |
Changes authentication tokens and applies password-change policy. | Controls password updates and quality or history checks when a password is changed. |
session |
Performs work when a session opens or closes. | Applies logging, limits, environment setup, mounts, or cleanup. |
A module appearing in auth is not automatically an account or session check. Read the actual lines in every relevant stack, including files reached through include or @include.
How to read a PAM rule
The basic form is:
module_type control_flag module_name module_argumentsFor example:
auth required pam_unix.soThis invokes the local Unix authentication module as a required authentication step. Arguments, if present, follow the module name and are interpreted by that module. A stack is evaluated in order, so moving a line can change both security and user experience.
Common control flags
| Control | Effect in a stack | Why placement matters |
|---|---|---|
required |
The module must succeed, but PAM normally continues through the remaining lines before returning the failure. | A later prompt or cleanup action may still run even though the request will ultimately fail. |
requisite |
A failure stops processing immediately and returns failure. | It can prevent later modules from running, which may alter prompts and side effects. |
sufficient |
A success can satisfy the stack when no earlier required module has failed; processing may short-circuit. | Putting it before a stronger factor can accidentally bypass that factor. |
| Bracketed mapping | Maps individual module return codes to actions such as ignore, continue, or die. | It is powerful but distribution-specific stacks can become unsafe if mappings are copied without understanding every return value. |
Do not replace a distribution’s entire stack with a short example from a blog. The supported stack may contain account, password, and session lines that are not obvious from a password-login example. Red Hat’s module documentation notes that pam_unix.so can provide all four module types and that order matters.
Find the SSH PAM stack
-
List the service files and inspect the SSH file:
ls -la /etc/pam.d/ sed -n '1,240p' /etc/pam.d/sshdIf
/etc/pam.d/sshdis absent, inspect/etc/pam.conffor an entry whose service name issshd, and check the distribution’s OpenSSH package documentation. -
Follow every
includeand@includedirective. Common files may contain the realauth,account,password, orsessionrules. Read those files before deciding where a change belongs:grep -RInE '^(include|@include|auth|account|password|session)' /etc/pam.d /etc/pam.conf 2>/dev/null -
Check ownership and permissions. PAM files should be owned by root and should not be writable by ordinary users:
stat -c '%A %U:%G %n' /etc/pam.conf /etc/pam.d/* 2>/dev/null
Generated files can be overwritten by package updates or profile changes. Put persistent policy in the mechanism your distribution documents, and keep a record of the profile or feature selection used.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Enable PAM in OpenSSH
Edit /etc/ssh/sshd_config and set:
UsePAM yesOpenSSH’s UsePAM yes enables PAM authentication through password or keyboard-interactive methods and runs PAM account and session processing for all authentication types. It does not, by itself, force every user to enter a password; the methods also depend on PasswordAuthentication, KbdInteractiveAuthentication, public-key settings, and the PAM stack.
Avoid duplicate password prompts
Keyboard-interactive PAM authentication commonly serves the same role as password authentication. If both are enabled, a client may offer two equivalent ways to reach the same prompt or present confusing fallback behavior. Decide which method your policy intends to expose and disable the other in sshd_config:
PasswordAuthentication no
KbdInteractiveAuthentication yes
That example is appropriate only when keyboard-interactive is the intended path; reverse the choices if ordinary SSH password authentication is required. Test with the actual client and policy rather than assuming a directive has the same behavior across OpenSSH versions.
Safe configuration procedure
1. Preserve a recovery path
Leave one root or administrative SSH session connected and do not use it for testing. Confirm that you can reach the VPS provider’s web console, serial console, rescue system, or equivalent out-of-band route. A second independent administrator is useful when available.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match2. Make one small change
Change a single PAM line, include, profile selection, or SSH directive at a time. Avoid deleting a line merely because it appears redundant. If you are adding a module, install and verify its package first, then add it to the narrowest appropriate stack.
3. Validate syntax before reloading
Use OpenSSH’s local configuration test:
sshd -t
Some distributions require an explicit path such as /usr/sbin/sshd -t, and a service may be named ssh rather than sshd. A successful SSH syntax test does not prove that every PAM module will load or that a user will pass the policy; it only catches errors visible to that validator.
4. Reload, do not terminate, the daemon
Reload the service so existing connections remain available:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
systemctl reload sshd
If your distribution uses the alternate unit name, use systemctl reload ssh. Check the service status and recent log entries immediately after the reload.
5. Test from a separate client
Open a new connection while the original session remains untouched. Test each method you intend to support: an SSH key, a password or keyboard-interactive challenge, and any additional factor. Then perform a controlled negative test with an invalid password or a user who should be denied. Never test lockout behavior with your only administrator account.
6. Confirm account and session behavior
Authentication success alone is insufficient. Verify that expired or disallowed accounts are rejected, that the expected environment and resource limits appear after login, and that session-close actions occur. Check the system authentication journal or log files for the service name and module result. Log locations and commands differ by distribution and release.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing an authentication implementation
PAM can front several identity sources. Compare an implementation across all of these dimensions before installing it:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute| Decision axis | Questions to answer |
|---|---|
| Identity source | Are users verified against local Unix accounts, a directory, a token service, a hardware factor, or a combination? |
| Management groups | Does the module participate in auth, account, password, session, or several groups? |
| Stack order and failure | Which control flag is used, what happens on an unavailable backend, and can a success short-circuit a required factor? |
| Distribution integration | Is the module supported by the distribution’s profile manager, such as authselect, or must its configuration be maintained separately? |
| Outage recovery | Can administrators use a cached credential, a local break-glass account, console access, or another method if the external service is unavailable? |
| Key-user behavior | Will public-key users still receive the intended PAM account and session checks even when they do not receive an auth prompt? |
Local Unix passwords
Local authentication normally uses the distribution’s Unix password module and local account databases. It has no external identity dependency, but every VPS must then maintain users, password aging, and recovery policy locally. Keep the module’s existing distribution order unless you have a documented reason to change it.
Directory-backed authentication
A directory module can centralize identities, but availability and name-resolution failures become login risks. Define what should happen when the directory cannot be reached, retain a tested local break-glass account, and ensure account and session rules still run for directory users and SSH-key users.
Multi-factor modules
MFA modules generally add an auth step, but their enrollment, recovery, and failure semantics vary. Place the factor where the intended control flags require it; putting a module after a sufficient success can unintentionally bypass it. Test lost-device recovery through the console path before enforcing MFA for all administrators.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Troubleshooting common failures
Every new SSH login is rejected
- Use the still-open session to restore the last known-good PAM archive.
- Check for a misspelled module name, missing shared object, malformed argument, or an include file that no longer exists.
- Review authentication logs immediately after one test attempt; the service name usually identifies which stack was called.
- Run
sshd -tand verify that the daemon was reloaded after the restoration.
The password prompt appears twice
Check whether both PasswordAuthentication and KbdInteractiveAuthentication are enabled. Select the one your policy needs, then retest with the client used by your administrators. A PAM stack that contains multiple password-capable modules can also prompt more than once when the controls require each module.
Recommended Free Tools
SSH keys work, but account policy is ignored
Confirm UsePAM yes and inspect the account and session portions of the SSH stack. PAM account and session processing is distinct from the interactive credential prompt; a key login should still be tested against expiry, access rules, and session setup.
A profile change disappears after an update
The file may be generated by a distribution profile manager. Record the active profile, use the supported tool to apply the policy, and check the files again after package or profile changes. Do not repeatedly edit a generated file without understanding what will recreate it.
Only one user fails
Compare that user’s account state, group membership, shell, password aging, directory status, and MFA enrollment with a known-good account. An account module can deny a user after successful identity verification, so a password failure is not the only possible explanation.
Recovery when PAM locks you out
Linux-PAM warns that configuration errors can disable access partially or completely. Deleting /etc/pam.d/* or /etc/pam.conf can lock out the administrator. If the test connection fails, do not close the working session.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Stop further edits and use the open session, provider console, or rescue environment.
- Restore the backed-up
/etc/pam.d,/etc/pam.conf, and/etc/ssh/sshd_configfiles, preserving ownership and permissions. - Run the SSH configuration test and inspect the authentication logs.
- Reload the correct SSH service unit.
- Open and verify a new connection before ending the recovery session.
If no out-of-band route exists, VPS recovery may require booting a rescue image and mounting the system disk. Arrange that capability before enforcing a new authentication factor or external identity dependency.
Operational checklist
- Distribution and release recorded.
- Existing privileged session and independent recovery path confirmed.
/etc/pam.conf,/etc/pam.d/, and/etc/ssh/sshd_configbacked up.- SSH service file and every included stack inspected.
- All four PAM management groups considered.
- Control flags and line order reviewed rather than copied blindly.
- Distribution profile tooling used where required.
UsePAM yesset only when PAM authentication or account/session processing is intended.- Duplicate password methods avoided.
- SSH syntax validated before a reload.
- Success and controlled failure tests performed from a second client.
- Authentication logs, account checks, and session behavior verified.
- Rollback archive and console procedure documented for the next administrator.
Final guidance
PAM configuration is a policy program, not a single password switch. The service file selects the stack, each line selects a management group and module, and controls plus order determine how results propagate. On a remote VPS, the safest implementation is incremental: preserve access, use supported distribution tooling, change one rule, validate, reload, test both outcomes, and keep a working rollback route until the new policy has been exercised with every intended login method.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
