Test the Whole Login Path¶
PAM changes are the easiest way to lock yourself out of an image. Before you move on, prove that a correct password still works, that a wrong one is counted, and that the policies actually bite.
Keep a root shell open¶
Before editing any PAM file, open a second terminal and run sudo -i. Leave it there. If a mistake breaks authentication, that shell still works and can fix the file. Close it only after the tests below pass.
The test account¶
sudo adduser --disabled-password --gecos "" pamtest
sudo passwd pamtest
Give it a password that meets the quality rules. If passwd refuses a weak one, quality is working.
Run the tests¶
| Test | Command | Expected |
|---|---|---|
| Correct password works | su - pamtest (type the password) |
A shell as pamtest; exit |
| Wrong passwords are counted | su - pamtest with a wrong password, three times |
sudo faillock --user pamtest shows three entries |
| Lockout triggers | Two more wrong attempts, then one correct | The correct one is refused; faillock shows V (valid) entries |
| Unlock works | sudo faillock --user pamtest --reset, then correct password |
Shell as pamtest |
| History works | sudo passwd pamtest, set a new one, then set the old one again |
Second change refused |
| Aging applied | sudo chage -l pamtest |
Max 90, Min 10, Warn 14 if login.defs was set before the account was made |
| Blank refused | sudo passwd -d pamtest, then su - pamtest and press Enter |
Refused (no nullok). Set the password back afterward. |
Clean up¶
sudo userdel -r pamtest
Leaving a test account behind is an unauthorized account.
What to do when a test fails¶
| Symptom | Likely cause |
|---|---|
| Every login fails, even correct passwords | authfail line placed before pam_unix, or [success=1 default=ignore] skip count wrong |
| Wrong passwords never counted | preauth and authfail lines missing, or faillock.conf values still commented |
| Weak passwords accepted | pam_pwquality line missing, or minlen still commented |
| Old password accepted again | remember= missing, history line after pam_unix, or /etc/security/opasswd missing |
sudo stopped working |
common-auth broken; use the root shell you kept open and fix it, or boot to recovery |
Try it¶
- Run every test in the table on a practice image and record which passed.
- Deliberately break one thing (remove
preauth), rerun the tests, and see which one catches it.
Build it¶
A pamtest.sh that creates the test user, runs the checks that can be automated (faillock, chage -l, grep on the PAM files), prints results, and deletes the user. Run it after every PAM change.