is a modular framework that separates authentication tasks from the applications that use them. Instead of hardcoding authentication methods into every program (like login , sshd , or sudo ), developers call the PAM library, which executes shared modules to verify user identities. Core Architecture and Purpose

: Multiple modules can be combined (stacked) to require multiple forms of authentication, such as a traditional password followed by a One-Time Password (OTP). Configuration File Anatomy

: New authentication technologies (like biometrics or MFA) can be added without recompiling applications.

: Administrators can define complex authentication policies for different services in a single set of configuration files.