Recommended Free Tools
Configure Linux-PAM by editing the service stack in /etc/pam.d/ (or the legacy /etc/pam.conf), then connect OpenSSH to that stack with UsePAM yes. Because a malformed PAM rule can remove every remote login path, make a backup, keep an existing administrative session open, validate sshd, and test a second connection before closing your first one.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What PAM does on a Linux VPS
Linux-PAM (Pluggable Authentication Modules) is a local framework that lets applications delegate authentication and account policy to a stack of modules. The application supplies a service name, and PAM loads the matching configuration. For SSH, that service is normally named sshd, so the primary file is /etc/pam.d/sshd.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
The other configuration model is a single /etc/pam.conf file. If /etc/pam.d/ exists, distributions generally place one file per service there. The exact files and included profiles differ by distribution and release; do not assume that a stack copied from another operating system is safe.
The four PAM management groups
| Group | When it runs | What it controls |
|---|---|---|
auth |
During identity verification | Passwords, one-time challenges, keys or other authentication prompts implemented by the selected modules |
account |
After or alongside authentication | Whether the account may use the service, including expiry, access restrictions and policy checks |
password |
When an authentication token is created or changed | Password changes, token quality rules and related updates |
session |
When a login session opens and closes | Logging, resource limits, environment setup and cleanup |
A module can implement one or several groups. For example, the distribution’s Unix-password module can provide all four module types, while a second-factor module may only participate in auth and possibly account or session.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
How a PAM rule is read
Each rule follows this shape:
module_type control_flag module_name module_argumentsA simple Unix-password authentication rule is:
auth required pam_unix.soIt invokes pam_unix.so for the auth group and marks the result as required. Several rules form a stack. PAM evaluates them in order, so inserting a module before or after another module can change which prompts appear and which failures are fatal.
Control flags and failure propagation
| Control | Typical behavior | Why order matters |
|---|---|---|
required |
The module must succeed, but PAM normally continues through the rest of that group before returning the failure. | A later module can still run, but an earlier required failure remains significant. |
requisite |
A failure stops evaluation of the group immediately. | Useful when continuing would reveal unnecessary information or issue more prompts. |
sufficient |
A success can finish the group early when no earlier required module has failed; a failure usually does not by itself make the whole stack fail. | Putting it in the wrong position can bypass a later challenge or make a fallback behave unexpectedly. |
optional |
The result normally matters only when no other module in that group provides a decisive result. | It should not be used for a control that must be enforced. |
| Bracketed mappings | Mappings such as [success=1 default=ignore] assign an action to individual module return codes. |
A small mapping change can skip a line or turn a recoverable result into a denial. |
Read every existing line, including include, @include and distribution-specific profile directives. The visible sshd file may only be a gateway to common files containing the actual password, account and session rules.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesPrepare a safe change on a remote VPS
PAM is not a good place for an untested, all-at-once edit. Before changing anything, complete this safety sequence:
- Identify the operating system and release. Record the output of
cat /etc/os-release. Package names, service names and profile managers vary between Debian-based and Red Hat-based systems. - Keep an existing administrative connection open. Do not close the SSH window that currently works. Use a second terminal for edits and testing.
- Confirm out-of-band recovery. Verify that the VPS provider’s web console, serial console or rescue environment is available and that you know how to start it.
- Back up all three locations. Save
/etc/pam.conf, the complete/etc/pam.d/directory and/etc/ssh/sshd_configbefore editing.
sudo cp -a /etc/pam.conf /etc/pam.conf.before-pam-change 2>/dev/null || true
sudo cp -a /etc/pam.d /etc/pam.d.before-pam-change
sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.before-pam-changeThe first command tolerates systems that do not have /etc/pam.conf. Keep the backups readable only by administrators and copy them somewhere outside the VPS if your recovery policy requires it.
Step-by-step: configure SSH to use PAM
1. Locate the SSH service stack
List the PAM service files and inspect the SSH entry:
sudo ls -la /etc/pam.d/
sudo sed -n '1,240p' /etc/pam.d/sshdIf that file is absent, inspect /etc/pam.conf for lines whose first field is sshd. Follow every included file. Common files have names such as common-auth, common-account, common-password and common-session on Debian-derived systems, but the names are distribution choices rather than PAM requirements.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo grep -RInE '^(include|@include|substack|sshd[[:space:]])' /etc/pam.conf /etc/pam.d 2>/dev/nullDo not delete an apparently redundant line until you know which group it belongs to and which included stack depends on it.
2. Read the existing groups before adding a module
Separate the lines mentally into auth, account, password and session. A login can pass auth and still be denied by account; a successful login can also fail to receive limits or environment setup if the session stack is damaged. This is why testing only a password prompt is insufficient.
Record the current behavior for each class of user that matters: a local password user, a key-only administrator, a service account that should not log in, and any directory or second-factor user. You will use the same cases after the change.
3. Choose an authentication design
| Design | Identity source | PAM groups commonly involved | Important decision |
|---|---|---|---|
| Local Unix passwords | Local users and password hashes on the VPS | auth, account, password, session |
Retain the distribution’s existing Unix-password and account checks; do not replace the whole generated stack with a minimal example. |
| Directory-backed login | An external directory reached through a PAM module | Usually auth and account; password may be used for changes |
Define what happens when the directory is unavailable and keep a local recovery administrator. |
| Multi-factor authentication | A local or external primary identity plus a second challenge | Usually auth, with possible account or session hooks |
Decide whether the second factor is required for every user, only for passwords, or only for selected groups; test lost-factor recovery before enforcement. |
The module’s documentation should state which management groups it implements, what return codes mean, and whether it prompts interactively. A module that works for a console login may not work for an SSH key login unless the SSH authentication method and PAM conversation are configured accordingly.
4. Use the distribution’s profile manager when one exists
Some distributions generate PAM files from a supported policy profile. On Red Hat Enterprise Linux, the supported workflow is to use authselect rather than manually rewriting generated files. Red Hat warns that manual edits can create authentication and access problems. If a profile manager reports that a file is generated, make the change through that tool and retain its profile-selection output in your change record.
On other distributions, the package manager may own common PAM files or install prompts when a package is configured. Preserve package headers and local comments, and expect an update to replace files that are marked as managed.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
5. Enable PAM in OpenSSH
Open /etc/ssh/sshd_config and set:
UsePAM yesWith UsePAM yes, OpenSSH can use PAM through password and keyboard-interactive authentication, and it runs PAM account and session processing for every authentication type, including public-key authentication. Therefore a key-based administrator can still be denied by an expired account or affected by session modules.
SSH’s two interactive password paths can otherwise produce duplicate prompts. Keyboard-interactive PAM authentication usually serves the same purpose as password authentication, so choose a deliberate policy. For example, if you want only keyboard-interactive prompts for a PAM challenge, set:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →UsePAM yes
PasswordAuthentication no
KbdInteractiveAuthentication yesIf your policy is ordinary SSH password authentication and does not need keyboard-interactive prompts, make the opposite choice. The correct setting depends on the module and client behavior; test from the actual clients your users employ. Do not change both methods casually and assume that disabling one disables PAM account or session checks—those checks remain tied to UsePAM.
6. Check ownership, permissions and syntax
PAM files are security-sensitive. Verify that files are owned by root and are not writable by ordinary users. Compare permissions with the distribution’s defaults rather than applying a permissive mode. Then validate the effective SSH configuration before reloading:
sudo sshd -tA successful check produces no output and an exit status of zero. This validates sshd_config syntax; it does not prove that every PAM module will accept a real login. If your distribution installs sshd under a different path, use that packaged binary’s test option.
7. Reload, never terminate, the working daemon
Use the service name supplied by your operating system. Typical commands are:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
sudo systemctl reload ssh
sudo systemctl reload sshdRun only the command that matches your system. A reload asks the running daemon to read its configuration while preserving existing connections; stopping the service removes a valuable recovery channel.
8. Test from a second client
Leave the original session untouched and open a new connection with the exact method your policy is intended to support. Test both successful and unsuccessful paths:
- Use a valid local or directory password, key, or second-factor response.
- Use an intentionally invalid password or response and confirm that it is rejected.
- Test a user who should be denied by account policy, such as an expired or restricted account.
- Test a key-only administrator to confirm that PAM account and session checks still run.
- Confirm that the expected session setup, limits and environment are present after login.
Never use a production administrator’s only account as the negative test. Create or select a controlled test user and record which prompts and log messages are expected.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
9. Review the authentication logs
Log locations differ by distribution and release. On systems using systemd, start with the SSH unit that exists on your VPS:
sudo journalctl -u ssh -b
sudo journalctl -u sshd -bTraditional syslog systems may write authentication events to files such as /var/log/auth.log or /var/log/secure. Search for the service name, username and module result. A PAM error often identifies the failing group or module, but avoid pasting secrets or one-time codes into tickets or public reports.
Designing a stack that fails safely
Preserve the existing distribution order
Order is part of the policy. A password module placed before a second-factor module can change which prompt appears; a sufficient line in front of a required challenge can allow an early success to bypass that challenge; a requisite line can stop a fallback path immediately. Start with the vendor stack and make one narrowly scoped insertion or profile change.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Keep a local recovery path for external identity
If a directory, network service or second-factor provider is unreachable, decide whether logins should fail closed, fall back to a local emergency account, or remain possible only through the VPS console. A recovery administrator should have a tested credential or key and should not depend on the same external service whose outage you are planning for.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRemember that SSH keys do not bypass PAM account and session checks
Public-key authentication can skip a password prompt, but with UsePAM yes OpenSSH still invokes PAM account and session processing. This lets you enforce expiry, access restrictions, logging or limits consistently across key and password users. It also means a change to an account module can lock out an administrator who never types a password.
Common failure modes and recovery
| Symptom | Likely cause | Recovery action |
|---|---|---|
| Every new SSH login is rejected | A required or requisite PAM rule fails, an included file is missing, or the wrong control mapping was added. | Keep the original session open; inspect the journal, restore the backed-up PAM files, reload SSH and retest. |
| The SSH daemon will not reload | Syntax error in sshd_config, invalid directive, or a service-name mismatch. |
Run sudo sshd -t, correct the reported line, then reload the correct unit. |
| Users receive two password prompts | Both password and keyboard-interactive authentication are offering equivalent PAM prompts. | Disable one method in sshd_config according to the intended policy and test the real client. |
| Keys work for one user but not another | PAM account policy, expiry, group restrictions or a conditional rule differs between users. |
Compare the account and session log entries, not only the key configuration. |
| Login succeeds but limits or environment are wrong | A session line or included session file was removed or skipped. |
Restore the distribution session stack and verify open and close events in the logs. |
| Console login also fails after an edit | A shared common stack was changed, affecting more than SSH. | Use the provider console or rescue system to restore /etc/pam.d/ and /etc/pam.conf from the backup. |
| The external identity service is down | The selected module cannot contact its directory or challenge service. | Use the prearranged local recovery account or out-of-band console; do not weaken the production stack blindly while locked out. |
Linux-PAM configuration errors can disable access partially or completely. Deleting files under /etc/pam.d/ or deleting /etc/pam.conf can lock out the administrator, so restore the complete known-good set rather than recreating only the line that appears to have failed.
Distribution-aware checks
Debian and Ubuntu families
SSH commonly includes shared files such as common-auth, common-account and common-session. Inspect those files and any package-managed snippets before editing. The SSH service may be controlled as ssh, and authentication logs are often available through the journal or /var/log/auth.log. Names can differ on derivatives, so use the unit and files present on the VPS.
Red Hat Enterprise Linux and compatible systems
Red Hat systems commonly use authselect to manage PAM profiles and may log authentication events in the journal or /var/log/secure. Use the selected profile’s supported customization mechanism. Manually overwriting generated files can be undone by profile changes or package updates and can create an unusable stack.
Other distributions and minimal images
Minimal VPS images may omit a console login manager, common PAM packages or a separate sshd service file. Install only the modules required by the chosen policy, verify that the module’s shared object exists, and check the image documentation for the service unit and log facility. Do not infer a missing file is safe to create without first confirming how the distribution starts PAM.
Operational checklist
- Record the OS release, SSH unit name and current authentication methods.
- Keep one working administrative session and verify console or rescue access.
- Back up
/etc/pam.conf,/etc/pam.d/and/etc/ssh/sshd_config. - Inspect
/etc/pam.d/sshdand every included file. - Identify the
auth,account,passwordandsessionpaths before editing. - Use the distribution’s profile manager, such as
authselectwhere supported. - Change one rule or setting at a time and preserve vendor ordering.
- Set
UsePAM yesonly when the intended SSH policy requires PAM. - Choose deliberately between
PasswordAuthenticationandKbdInteractiveAuthentication. - Run
sshd -t, verify permissions, reload rather than stop, and test a second connection. - Test valid, invalid, expired or restricted, key-based and session-setup cases.
- Keep the rollback commands and backup locations with the change record.
Bottom line
PAM authentication on a Linux VPS is a combination of a service-specific module stack and OpenSSH’s PAM integration. Find the existing sshd stack, understand all four management groups, use the distribution’s supported profile tooling, enable UsePAM yes when required, and treat every edit as a remote-access change. The safe test is not merely “does my password work?”; it is whether successful, failed, restricted, key-based and session behaviors all match the policy while a known-good rollback path remains available.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
