How PAM Processes The File

Each line is scanned in succession.

A 'required' line means that if the matching module denies access, then the whole authentication process fails (but only after all modules have been processed).

A 'requisite' line means that if the matching module denies access, the whole authentication process fails immediately, and no further modules are consulted.

A 'sufficient' line means that if the matching module grants access, no further modules of this type will be checked.

An 'optional' line means that the success or failure of this module won't affect the success of this module type, unless no other module for this type returned a positive or negative reply.