I have a Linux system with a user named service. I'm using the pam_succeed_if.so module to match this username. For example:auth      required      pam_succeed_if.so user = serviceBut it won't match a username of service, apparently because it is also a field accepted by pam_succeed_if.so. From the man page (edited for emphasis):Available fields are user, uid, gid, shell, home, ruser, rhost, tty and serviceHow do you escape values that match field names?Further Troubleshooting:I turned the debug option on for pam_succeed_if.so, and it's converting the username service to login:login: pam_succeed_if(login:auth): 'user' resolves to 'login'And this just so happens to be the PAM config for login, /etc/pam.d/login.
How do you get `pam_succeed_if.so` to recognize `service` user?
pam
pam_succeed_if.so converts the passed-in user to the field value, if that value exists. For example, using the user shell:login: pam_succeed_if(login:auth): 'user' resolves to '/bin/bash'I don't know how to keep it from doing this clearly undesired resolve. But there is a workaround that will work for almost everyone.Just check for the resolved value, instead of the actual value.ExamplesTo match the service user in the login PAM config:auth      required      pam_succeed_if.so user = loginTo match the service user in the sshd PAM config:auth      required      pam_succeed_if.so user = sshdTo match the shell user, whose configured shell is /bin/bash:auth      required      pam_succeed_if.so user = /bin/bash