1. Manuals
  2. Tumbleweed
  3. account-utils
  4. pwaccessd.conf(5)

Scroll to navigation

PWACCESSD.CONF(5) pwaccessd.conf PWACCESSD.CONF(5)

NAME

pwaccessd.conf - configuration file for pwaccessd

SYNOPSIS

/etc/account-utils/pwaccessd.conf

/etc/account-utils/pwaccessd.conf.d/*.conf

/usr/share/account-utils/pwaccessd.conf

/usr/share/account-utils/pwaccessd.conf.d/*.conf

DESCRIPTION

pwaccessd.conf configures pwaccessd(8), the service which provides passwd and shadow information and which verifies passwords and checks account expiration.

CONFIGURATION DIRECTORIES AND PRECEDENCE

The configuration is read following the UAPI Configuration Files Specification[1]. The main configuration file pwaccessd.conf is looked up in the account-utils namespace below the following directories, listed here from lowest to highest precedence:

/usr/share/account-utils/

Vendor defaults shipped by the distribution package. Files here should not be edited by the administrator, as they may be overwritten on package updates.

/etc/account-utils/

Local administrator configuration. Settings here take precedence over the vendor defaults and are the recommended place for local changes.

In addition to the main configuration file, drop-in files with a .conf suffix are read from a pwaccessd.conf.d/ directory located next to the main file in each of the directories above (for example /etc/account-utils/pwaccessd.conf.d/ and /usr/share/account-utils/pwaccessd.conf.d/).

All files are merged into a single configuration.

FILE FORMAT

The file uses a simple INI-style syntax. It is organized into sections (groups) and key=value assignments. Everything following a # character is treated as a comment and ignored. Leading and trailing whitespace around values are stripped.

For each setting pwaccessd first looks in the section that matches the affected operation. If the key is not present there, it falls back to the [global] section. This allows one to set a default in [global] and override it per operation.

SECTIONS

The following sections are recognized. The per-operation sections correspond to the Varlink methods of the same name provided by pwaccessd(8).

[global]

Default values used as a fallback for all operations when a key is not set in the operation specific section.

[ExpiredCheck]

Applies to requests which check whether the password or account of a user has expired.

[GetUserRecord]

Applies to requests which return the passwd and shadow record of an account.

[VerifyPassword]

Applies to requests which verify the password of an account.

VARIABLES

allow

A comma-separated list of users who are granted access to the operation of the enclosing section beyond their own account, in addition to root. Each entry is either a user name or a numeric UID. Whitespace around the entries is ignored.

Account names which cannot be resolved to a valid UID are skipped. The UID 0 (root) is always allowed and is therefore ignored if listed explicitly.

This key is honored in the [GetUserRecord], [VerifyPassword] and [ExpiredCheck] sections. If it is not set in the relevant section, the value from the [global] section is used. If it is set in neither, only the account owner and root have access.

SpMin

A boolean value which controls whether the minimum password age (the sp_min field of the shadow(5) entry) is taken into account during the expiration check. When enabled, a password that is younger than sp_min days is reported as not yet changeable.

This key is read from the [ExpiredCheck] section and, if not set there, from the [global] section. If it is set in neither, the built-in default false is used.

EXAMPLE

Example 1. /etc/account-utils/pwaccessd.conf

[global]
# For mariadb:user mysql/mariadb needs to authenticate as database
# user so that the database user can get access to the database.
allow = mysql
[VerifyPassword]
# Only 'auth-service', the user with the UID 471 and may verify
# passwords, this overrides the value from [global] for this
# operation
allow = auth-service, 471
[ExpiredCheck]
# Use the minimum password age for the expiration check
SpMin = true

SEE ALSO

pwaccessd(8), pam_unix_ng(8), passwd(5), shadow(5)

UAPI Configuration Files Specification[1]

NOTES

1.
UAPI Configuration Files Specification
https://uapi-group.org/specifications/specs/configuration_files_specification/
07/17/2026 account-utils 1.4.0