Fix PAM 'Module is unknown' error on Linux

You're staring at PAM: Module is unknown in logs or when running su or logging in via SSH. It's frustrating, but the fix is usually one typo or wrong path. Let's get it working.

The fix (works 90% of the time)

Most times the problem is a missing or wrong .so file name in a PAM config file. Here's what to check:

Open the PAM file causing the error. Common ones: /etc/pam.d/sshd, /etc/pam.d/su, /etc/pam.d/login, or /etc/pam.d/system-auth (on CentOS/RHEL) or /etc/pam.d/common-auth (on Ubuntu/Debian).
Look for a line like auth required pam_unix.s or auth sufficient something.so. The mistake is often a typo — pam_unix.so spelled pam_unix.s (missing the 'o'), or pam_ldap.so written as pam_ldap (no extension).
After editing, save the file. Then test with sudo -i or su -. The error should be gone. If not, check /var/log/auth.log or /var/log/secure for new errors.
If the module name looks correct, check that the module file actually exists. Run: ls /lib64/security/pam_unix.so (on 64-bit) or ls /lib/security/pam_unix.so (on 32-bit).
If the file is missing, you need to reinstall PAM. Example on Ubuntu: sudo apt-get install --reinstall libpam-modules. On CentOS: sudo yum reinstall pam.

After reinstalling, test again. It should work.

Why this error happens

PAM (Pluggable Authentication Modules) loads a shared library file for each module you specify in config files. If the file name is typed wrong — like pam_unix.s instead of pam_unix.so — Linux can't find it, so it says "Module is unknown". The same happens if the module isn't installed or the path isn't correct.

The real fix is always: make sure the module path and name match an actual file on disk. PAM doesn't guess — it fails hard.

Less common variations of the same issue

Sometimes the error isn't a typo. Here are other cases I've seen:

Wrong architecture

If you're on a 64-bit system but the PAM config tries to load a module from /lib/security/ (32-bit path), you'll get this error. Fix: change the path to /lib64/security/ in the config file.

Module depends on a missing library

Some PAM modules depend on other libraries. For example, pam_ldap.so needs libldap. If that's missing, PAM can't load the module. Check with ldd /lib64/security/pam_ldap.so — any line that says "not found" is your culprit. Install the missing library.

Incorrect permissions on the .so file

Rare, but if the module file isn't readable or executable by root, PAM won't load it. Run chmod 755 /lib64/security/pam_*.so to fix.

Duplicate or conflicting entries

Sometimes you have two PAM configs that both try to load the same module in different ways. For instance, /etc/pam.d/su and /etc/pam.d/system-auth might both reference the same module with different arguments. Merge them or remove duplicates.

How to prevent this from happening again

Always double-check spelling when editing PAM files. One missing letter breaks everything.
Test changes in a safe environment first. Use a test VM or container before applying to production.
Keep PAM packages up to date. Old modules get removed or renamed. Run sudo apt update && sudo apt upgrade regularly.
Use a syntax checker if available. On some distros, pam_unix.so can be tested with pamtester. Install it: sudo apt install pamtester. Then run pamtester -i to validate configs.

That's it. The error is almost always a stupid typo. Fix the text file, and you're back in business.