PWACCESSD(8)

NAME
pwaccessd, pwaccessd.service, pwaccessd.socket - manage passwd and shadow information

SYNOPSIS

pwaccessd.service

pwaccessd.socket

/usr/libexec/pwaccessd [OPTIONS]

DESCRIPTION

pwaccessd is a systemd(1) socket-activated service which provides account information in struct passwd and struct shadow format. It is capable of checking if a password or account has expired and verifies passwords.

By default, normal users only have access to their own passwd and shadow entries. The root user has access to all accounts. Specific users can be granted extended access via configuration.

OPTIONS

-s, --socket
    Activation through socket. This is the standard mode when running under systemd.

-d, --debug
    Enable debug mode.

-v, --verbose
    Enable verbose logging.

-?, --help
    Give the help list.

--version
    Print program version.

VARLINK INTERFACES

The pwaccessd daemon exposes the following functionality via Varlink interfaces:

GetAccountName
    Provides the user name corresponding to a given UID.

GetUserRecord
    Provides the passwd and shadow entry for a given UID or account name.

GetGroupRecord
    Provides the group entry for a given GID or group name.

VerifyPassword
    Validates a password for a specific user.

ExpiredCheck
    Checks if a user account or password is expired.

CONFIGURATION

pwaccessd reads its configuration from pwaccessd.conf. It follows the UAPI Configuration Files Specification, meaning it searches for configuration files in directories such as /usr/share/account-utils/, /run/account-utils/, and /etc/account-utils/. Files in /etc/account-utils/ take precedence.

The configuration format is INI-style. The primary configuration key is allow. This key accepts a list of user accounts that are allowed to read all passwd and shadow entries, in addition to root.

The allow key can be defined within specific sections (groups) corresponding to the Varlink interface methods:

    • [GetUserRecord]

    • [VerifyPassword]

    • [ExpiredCheck]

If the key is not found in the specific section, pwaccessd will fall back to looking in the [global] section.

Example 1. Example pwaccessd.conf

    [global]
    # Allow user 'admin' to perform all actions
    allow = admin

    [VerifyPassword]
    # Allow 'auth-service' to verify passwords, overriding global
    allow = auth-service

FILES

/usr/libexec/pwaccessd
    The daemon binary.

/etc/account-utils/pwaccessd.conf
    The main configuration file.

SEE ALSO

systemd(1), expiry(1), passwd(1), passwd(5), shadow(5), pam_unix_ng(8)