pam_chauthtok (3pam) manual page

Table of Contents


pam_chauthtok - perform password related functions within the PAM framework


cc [ flag ... ] file ... -lpam [ library ... ] #include <security/pam_appl.h>

int pam_chauthtok(pam_handle_t *pamh, const intflags);


The pam_chauthtok() function is called to change the authentication token associated with a particular user referenced by the authentication handle pamh.

The following flag may be passed in to pam_chauthtok():

The password service should not generate any messages.

The password service should only update those passwords that have aged. If this flag is not passed, all password services should update their passwords.

Upon successful completion of the call, the authentication token of the user will be changed in accordance with the password service configured in the system through pam.conf(4) .

Return Values

Upon successful completion, PAM_SUCCESS is returned. In addition to the error return values described in pam(3PAM) , the following values may be returned:

No permission.

Authentication token manipulation error.

Authentication information cannot be recovered.

Authentication token lock busy.

Authentication token aging disabled.

User unknown to password service.

Preliminary check by password service failed.


See attributes(5) for description of the following attributes:

tab() allbox; cw(2.750000i)| cw(2.750000i) lw(2.750000i) lw(2.750000i). ATTRIBUTE TYPEATTRIBUTE VALUE Interface Stability Stable MT-LevelMT-Safe with exceptions

See Also

login(1) , passwd(1) , pam(3PAM) , pam_authenticate(3PAM) , pam_start(3PAM) , attributes


The flag PAM_CHANGE_EXPIRED_AUTHTOK is typically used by a login application which has determined that the user’s password has aged or expired. Before allowing the user to login, the login application may invoke pam_chauthtok() with this flag to allow the user to update the password. Typically, applications such as passwd(1) should not use this flag.

The pam_chauthtok() functions performs a preliminary check before attempting to update passwords. This check is performed for each password module in the stack as listed in pam.conf(4) . The check may include pinging remote name services to determine if they are available. If pam_chauthtok() returns PAM_TRY_AGAIN, then the check has failed, and passwords are not updated.

The interfaces in libpam are MT-Safe only if each thread within the multithreaded application uses its own PAM handle.

Table of Contents