While inheriting a system that needs to be hardened, I ran into this line:
account required pam_unix.so broken_shadow

According to the pam website:

broken_shadow
Ignore errors reading shadow information for users in the account management module.

However beyond that I am not sure what/why broken_shadow is required. It sounds like it loosens the check to /etc/shadow getting around having to write specific shadow services for certain things?

anyone know the best practices around when it is/should be used and when not to use it?


Thanks

Isn't "broken_shadow" used only like if you authenticate against a remote like say LDAP beforehand (preceding PAM stack lines)?

Its referenced in the configs, but there are no detailed comments on what and why it's there.

Could you please post the complete PAM stack file contents and its /etc/pam.d/.* name?