What it means
Pluggable Authentication Modules centralize Linux authentication decisions through ordered policy stacks that can combine passwords, lockouts, multifactor methods, directories, and session controls.
Why it matters
Because many Linux services rely on PAM, a small policy mistake can either lock out administrators or silently weaken authentication across the host.
Practical focus
- Define the services and authentication paths governed by PAM and the identities, roles, and resources it covers
- Implement tested module ordering, control flags, and centrally managed policy through least-privilege, reviewable policy
- Use authentication outcomes, lockouts, fallback behavior, and policy changes to confirm that effective access matches intended access
- Plan for a malformed stack denying all access or bypassing an intended check, including safe recovery and break-glass handling
Common mistakes
- Granting broad access because it is easier to administer
- Changing policy without testing the effective identity context
- Allowing exceptions to persist without an owner or expiration
- Treating a malformed stack denying all access or bypassing an intended check as a user problem instead of a control failure
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: