PAMTEST(1)

NAME
pamtest - PAM policy tester

SYNOPSIS
pamtest [-dkMPsv] [-H rhost] [-h host] [-T timeout] [-t tty] [-U ruser] [-u user] service [command ...]

DESCRIPTION
The pamtest utility offers an easy way to test PAM modules and policies from the command line.

The pamtest utility loads the PAM policy specified by the service argument, starts a PAM transaction by calling pam_start(3), then executes the primitives specified by the remaining command-line arguments. Finally, it ends the transaction by calling pam_end(3).

The commands are:

authenticate, auth
    Call pam_authenticate(3).

acct_mgmt, account
    Call pam_acct_mgmt(3).

chauthtok, change
    Call pam_chauthtok(3) with the PAM_CHANGE_EXPIRED_AUTHTOK flag set.

forcechauthtok, forcechange
    Call pam_chauthtok(3) with no flags set.

setcred, establish_cred
    Call pam_setcred(3) with the PAM_ESTABLISH_CRED flag set.

open_session, open
    Call pam_open_session(3).

close_session, close
    Call pam_close_session(3).

unsetcred, delete_cred
    Call pam_setcred(3) with the PAM_DELETE_CRED flag set.

listenv, env
    Call pam_getenvlist(3) and print the contents of the list it returns.

The following options are available:

-d  Enables debug messages within the OpenPAM library. See openpam_log(3) for details.

-H rhost
    Specify the name of the fictitious remote host. The default is to use the name of the local host.

-h host
    Specify the name of the local host. The default is to use the result of calling gethostname(3).

-k  Keep going even if one of the commands fails.

-M  Disable path, ownership and permission checks on module files.

-P  Disable service name validation and path, ownership and permission checks on policy files.

-s  Set the PAM_SILENT flag when calling the pam_authenticate(3), pam_acct_mgmt(3), pam_chauthok(3), pam_setcred(3), pam_open_session(3) and pam_close_session(3) primitives.

-T timeout
    Set the conversation timeout (in seconds) for openpam_ttyconv(3).

-t tty
    Specify the name of the tty. The default is to use the result of calling ttyname(3).

-U ruser
    Specify the name of the supplicant (remote user).

-u user
    Specify the name of the principal (local user).

-v  Enables debug messages from pamtest itself.

EXAMPLES
Simulate a typical PAM transaction using the “system” policy:

    pamtest -v system auth account change setcred open close unsetcred

SEE ALSO
openpam(3), pam(3), pam.conf(5)

AUTHORS
The pamtest utility and this manual page were written by Dag-Erling Smørgrav <des@des.dev>.

BUGS
The pamtest utility does not (yet) support setting and getting individual PAM items or environment variables.

The pamtest utility does not afford the user complete control over the flags passed to the pam_authenticate(3), pam_acct_mgmt(3), pam_chauthok(3), pam_setcred(3), pam_open_session(3) and pam_close_session(3) primitives.