{"Entry":{"collection":"auth","key":"pam","name":"pam","aliases":[],"metadata":{"aliases":[],"category":"Authentication and access control","content_hash":"fc4ee79fad90c2894ddaa032799b7c487c9aa9c6c4cc6468635da2ba85f2f652","derived_content_hash":"a23a55e61e9fab896a00379e1f2da7b63fff2ed99f3793f188a25bbdc5b08373","imported_at":"2026-09-30T00:40:33.317699+08:00","name":"pam","name_zh":"","slug":"pam","summary":"Authenticate using the Pluggable Authentication Modules (PAM) service provided by the operating system. See Section 20.12 for details."}},"Definition":{"Collection":"auth","Key":"pam","SourceDatabase":"center","Version":"18","SourceTable":"authentication_method","SourceKey":"pam","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","Facts":{"aliases":[],"attributes":{"configuration":"pg_hba.conf","inventory":"User-visible source authentication method","method":"pam"},"comparison_data":{"documented_option_names":["pam_use_hostname","pamservice"],"method":"pam"},"comparison_hash":"e720d3348388b2db8e8cd0a06e3817320e147ff161d803b608628c9973d28741","description":["Authenticate using the Pluggable Authentication Modules (PAM) service provided by the operating system. See Section 20.13 for details."],"description_zh":"认证方法 pam。","description_zh_html":"\u003cp\u003e认证方法 pam。\u003c/p\u003e\u003cdl\u003e\u003cdt\u003e索引访问方法\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003epam\u003c/code\u003e\u003c/dd\u003e\u003cdt\u003e配置\u003c/dt\u003e\u003cdd\u003e\u003ccode\u003epg_hba.conf\u003c/code\u003e\u003c/dd\u003e\u003c/dl\u003e\u003ch3\u003e同版本中文手册节选\u003c/h3\u003e\u003cp\u003e\n    这种认证方法的工作方式与 \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e 类似，只不过它使用 PAM（可插拔认证模块）作为认证机制。默认的 PAM 服务名是 \u003ccode class=\"literal\"\u003epostgresql\u003c/code\u003e。PAM 只用于验证用户名/密码对，以及可选地验证已连接远程主机的主机名或 IP 地址。因此，在使用 PAM 进行认证之前，用户必须已经存在于数据库中。关于 PAM 的更多信息，请阅读 \u003ca class=\"ulink\" href=\"https://www.kernel.org/pub/linux/libs/pam/\"\u003e\u003cspan class=\"productname\"\u003eLinux-PAM\u003c/span\u003e 页面\u003c/a\u003e。\n   \u003c/p\u003e\u003cp\u003e\n    PAM 支持下列配置选项：\n    \u003c/p\u003e\u003cp\u003e\u003ca href=\"/zh/docs/18/auth-pam.html\"\u003e查看完整中文手册与上下文\u003c/a\u003e。\u003c/p\u003e","facts":[{"label":"Method","value":"pam"},{"label":"Configuration","value":"pg_hba.conf"},{"label":"Inventory","value":"User-visible source authentication method"}],"facts_zh":[{"label":"方法","value":"pam"},{"label":"配置","value":"pg_hba.conf"},{"label":"清单","value":"用户可见的源码认证方法"}],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-PAM\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.13. PAM Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method operates similarly to \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e except that it uses PAM (Pluggable Authentication Modules) as the authentication mechanism. The default PAM service name is \u003ccode class=\"literal\"\u003epostgresql\u003c/code\u003e. PAM is used only to validate user name/password pairs and optionally the connected remote host name or IP address. Therefore the user must already exist in the database before PAM can be used for authentication. For more information about PAM, please read the \u003ca class=\"ulink\" href=\"https://www.kernel.org/pub/linux/libs/pam/\"\u003e\u003cspan class=\"productname\"\u003eLinux-PAM\u003c/span\u003e Page\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for PAM:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003epamservice\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003ePAM service name.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003epam_use_hostname\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eDetermines whether the remote IP address or the host name is provided to PAM modules through the \u003ccode class=\"symbol\"\u003ePAM_RHOST\u003c/code\u003e item. By default, the IP address is used. Set this option to 1 to use the resolved host name instead. Host name resolution can lead to login delays. (Most PAM configurations don't use this information, so it is only necessary to consider this setting if a PAM configuration was specifically created to make use of it.)\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cdiv class=\"note\"\u003e\n\u003ch3 class=\"title\"\u003eNote\u003c/h3\u003e\n\u003cp\u003eIf PAM is set up to read \u003ccode class=\"filename\"\u003e/etc/shadow\u003c/code\u003e, authentication will fail because the PostgreSQL server is started by a non-root user. However, this is not an issue when PAM is configured to use LDAP or other authentication methods.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/div\u003e","manual_path":"/docs/18/auth-pam.html","related":[],"release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sections":[],"sections_zh":[],"signature":"","sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-pam.html","sha256":"e3d0a0d5ecb652f5534d7f62574b323d77436acd258b10a17a359873c1edf8d8","url":"/docs/18/auth-pam.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"PAM service name.","name":"pamservice"},{"description":"Determines whether the remote IP address or the host name is provided to PAM modules through the PAM_RHOST item. By default, the IP address is used. Set this option to 1 to use the resolved host name instead. Host name resolution can lead to login delays. (Most PAM configurations don't use this information, so it is only necessary to consider this setting if a PAM configuration was specifically created to make use of it.)","name":"pam_use_hostname"}],"title":"Documented method options and alternatives"}],"tables_zh":[{"columns":[{"key":"name","label":"选项或术语"},{"key":"description","label":"含义"}],"key":"method-options","rows":[{"description":"PAM 服务名称。","name":"pamservice"},{"description":"决定是通过 PAM_RHOST 项向 PAM 模块提供远程 IP 地址还是主机名。默认情况下使用 IP 地址。将此选项设为 1 可改为使用解析出的主机名。主机名解析可能导致登录延迟。（大多数 PAM 配置并不会使用这项信息，因此只有在 PAM 配置被专门设计为利用该信息时，才需要考虑这个设置。）","name":"pam_use_hostname"}],"title":"手册中的方法选项与替代方式"}],"zh_from":{"authored_translation":"source-derived-structured-summary","body_sha256":"87ea5c277208ce2b4d05cffb8f790cde289696489712576dc84432205120e71d","kind":"same-version-chinese-manual-with-source-derived-structured-summary","manual":{"anchor":"","build_id":107,"extraction":"concept-introduction","fragment_sha256":"92cd83480e1b93cc76a2afb136a052b0079494b7cf83823aedd784fbee12c92b","locale":"zh-Hans","page_key":"auth-pam.html","source_hash":"a67135fa1c67bcc34628b79caf26a79473d295df26211382e3506bdc9c9edbad","source_revision":"unknown:rendered-translation-baseline","translated_from_revision":null,"translation_revision":"git:b1b500221dbe5437cfca004d6b04d3f6e422765d;html-sha256:08e987a66af27b98444a8057c256314eafa13611a3fb9e888214fc436824244b","url":"/zh/docs/18/auth-pam.html","version":"18"},"runtime_rerun":false,"source_facts_revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"}},"ManualEvidence":{"manual_path":"/docs/18/auth-pam.html","release":{"catalog_fingerprint":"65c93d6048ef30e61023a84f9680fa6a92b1c383b7eb226741170077eb078502","channel":"stable","label":"18.6","major":"18","ref":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2","revision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","source_sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f"},"sources":[{"label":"Matching PostgreSQL source archive","sha256":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","url":"https://ftp.postgresql.org/pub/source/v18.6/postgresql-18.6.tar.bz2"},{"label":"PostgreSQL 18 English manual","path":"auth-pam.html","sha256":"e3d0a0d5ecb652f5534d7f62574b323d77436acd258b10a17a359873c1edf8d8","url":"/docs/18/auth-pam.html"},{"label":"PostgreSQL 18 English manual","path":"auth-pg-hba-conf.html","sha256":"6340d4abea2e0a3482afc31bcd1599a0fa10dc28a6f1e05d79ba831e2dd0b4c9","url":"/docs/18/auth-pg-hba-conf.html"}]},"MeasuredEvidence":{}},"Text":{"Collection":"auth","Key":"pam","SourceDatabase":"center","Version":"18","Locale":"en","Title":"pam","Summary":"Authenticate using the Pluggable Authentication Modules (PAM) service provided by the operating system. See Section 20.13 for details.","BodyHTML":"\u003cdiv id=\"AUTH-PAM\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2\u003e20.13. PAM Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method operates similarly to \u003ccode\u003epassword\u003c/code\u003e except that it uses PAM (Pluggable Authentication Modules) as the authentication mechanism. The default PAM service name is \u003ccode\u003epostgresql\u003c/code\u003e. PAM is used only to validate user name/password pairs and optionally the connected remote host name or IP address. Therefore the user must already exist in the database before PAM can be used for authentication. For more information about PAM, please read the \u003ca href=\"https://www.kernel.org/pub/linux/libs/pam/\" rel=\"nofollow\"\u003e\u003cspan\u003eLinux-PAM\u003c/span\u003e Page\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for PAM:\u003c/p\u003e\n\u003cdiv\u003e\n\u003cdl\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003epamservice\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003ePAM service name.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan\u003e\u003ccode\u003epam_use_hostname\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eDetermines whether the remote IP address or the host name is provided to PAM modules through the \u003ccode\u003ePAM_RHOST\u003c/code\u003e item. By default, the IP address is used. Set this option to 1 to use the resolved host name instead. Host name resolution can lead to login delays. (Most PAM configurations don\u0026#39;t use this information, so it is only necessary to consider this setting if a PAM configuration was specifically created to make use of it.)\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cdiv\u003e\n\u003ch3\u003eNote\u003c/h3\u003e\n\u003cp\u003eIf PAM is set up to read \u003ccode\u003e/etc/shadow\u003c/code\u003e, authentication will fail because the PostgreSQL server is started by a non-root user. However, this is not an issue when PAM is configured to use LDAP or other authentication methods.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/div\u003e","SourceRevision":"555610c24d53e4316da5b7d3fc25c279d96856d5e0e23ee308c328c5fa881d9f","ContentHash":"7041c581b58f98b0f4eb49886feb7937872e618b147305a0c2f4f28e12b752cd","Payload":{"description":["Authenticate using the Pluggable Authentication Modules (PAM) service provided by the operating system. See Section 20.13 for details."],"manual_html":"\u003cdiv class=\"sect1\" id=\"AUTH-PAM\"\u003e\n\u003cdiv class=\"titlepage\"\u003e\n\u003cdiv\u003e\n\u003cdiv\u003e\n\u003ch2 class=\"title\"\u003e20.13. PAM Authentication \u003c/h2\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003c/div\u003e\n\u003cp\u003eThis authentication method operates similarly to \u003ccode class=\"literal\"\u003epassword\u003c/code\u003e except that it uses PAM (Pluggable Authentication Modules) as the authentication mechanism. The default PAM service name is \u003ccode class=\"literal\"\u003epostgresql\u003c/code\u003e. PAM is used only to validate user name/password pairs and optionally the connected remote host name or IP address. Therefore the user must already exist in the database before PAM can be used for authentication. For more information about PAM, please read the \u003ca class=\"ulink\" href=\"https://www.kernel.org/pub/linux/libs/pam/\"\u003e\u003cspan class=\"productname\"\u003eLinux-PAM\u003c/span\u003e Page\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eThe following configuration options are supported for PAM:\u003c/p\u003e\n\u003cdiv class=\"variablelist\"\u003e\n\u003cdl class=\"variablelist\"\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003epamservice\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003ePAM service name.\u003c/p\u003e\n\u003c/dd\u003e\n\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003epam_use_hostname\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\n\u003cdd\u003e\n\u003cp\u003eDetermines whether the remote IP address or the host name is provided to PAM modules through the \u003ccode class=\"symbol\"\u003ePAM_RHOST\u003c/code\u003e item. By default, the IP address is used. Set this option to 1 to use the resolved host name instead. Host name resolution can lead to login delays. (Most PAM configurations don't use this information, so it is only necessary to consider this setting if a PAM configuration was specifically created to make use of it.)\u003c/p\u003e\n\u003c/dd\u003e\n\u003c/dl\u003e\n\u003c/div\u003e\n\u003cdiv class=\"note\"\u003e\n\u003ch3 class=\"title\"\u003eNote\u003c/h3\u003e\n\u003cp\u003eIf PAM is set up to read \u003ccode class=\"filename\"\u003e/etc/shadow\u003c/code\u003e, authentication will fail because the PostgreSQL server is started by a non-root user. However, this is not an issue when PAM is configured to use LDAP or other authentication methods.\u003c/p\u003e\n\u003c/div\u003e\n\u003c/div\u003e","related":[],"sections":[],"tables":[{"columns":[{"key":"name","label":"Option or term"},{"key":"description","label":"Meaning"}],"key":"method-options","rows":[{"description":"PAM service name.","name":"pamservice"},{"description":"Determines whether the remote IP address or the host name is provided to PAM modules through the PAM_RHOST item. By default, the IP address is used. Set this option to 1 to use the resolved host name instead. Host name resolution can lead to login delays. (Most PAM configurations don't use this information, so it is only necessary to consider this setting if a PAM configuration was specifically created to make use of it.)","name":"pam_use_hostname"}],"title":"Documented method options and alternatives"}]}},"RequestedLocale":"en","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}