1322 2. Set up PAM to authenticate MySQL connections using traditional Unix passwords by creating a mysql-unix  PAM service file named  /etc/pam.d/mysql-unix . The file contents are system dependent, so check existing login-related files in the  /etc/pam.d  directory to see what they look like. On Linux, the  mysql-unix  file might look like this: 1. Verify that Unix authentication permits logins to the operating system with the user name  antonio  and password  antonio_password . Authentication Plugins •Proxy users only, with PAM group mapping. For this scenario, create one or more MySQL accounts that define different sets of privileges. (Ideally, nobody should connect using those accounts directly.) Then define a default user authenticating through PAM that uses some mapping scheme (usually based on the external PAM groups the users are members of) to map all the external user names to the few MySQL accounts holding the privilege sets. Any client who connects and specifies an external user name as the client user name is mapped to one of the MySQL accounts and uses its privileges. The discussion shows how to set this up using traditional Unix passwords, but other PAM methods such as LDAP could be used instead. Variations on these scenarios are possible: •You can permit some users to log in directly (without proxying) but require others to connect through proxy accounts. •You can use one PAM authentication method for some users, and another method for other users, by using differing PAM service names among your PAM-authenticated accounts. For example, you can use the  mysql-unix  PAM service for some users, and  mysql-ldap  for others. •The login name and password are  antonio  and  antonio_password , respectively. Change these to correspond to the user you want to authenticate. •The PAM configuration directory is  /etc/pam.d . •The PAM service name corresponds to the authentication method ( mysql-unix  or  mysql-ldap  in this discussion). To use a given PAM service, you must set up a PAM file with the same name in the PAM configuration directory (creating the file if it does not exist). In addition, you must name the PAM service in the authentication string of the  CREATE USER  statement for any account that authenticates using that PAM service. The PAM authentication plugin checks at initialization time whether the  AUTHENTICATION_PAM_LOG environment value is set in the server’s startup environment. If so, the plugin enables logging of diagnostic messages to the standard output. Depending on how your server is started, the message might appear on the console or in the error log. These messages can be helpful for debugging PAM-related issues that occur when the plugin performs authentication. For more information, see PAM Authentication Debugging. This authentication scenario uses PAM to check external users defined in terms of operating system user names and Unix passwords, without proxying. Every such external user permitted to connect to MySQL Server should have a matching MySQL account that is defined to use PAM authentication through traditional Unix password store. Traditional Unix passwords are checked using the  /etc/shadow  file. For information regarding possible issues related to this file, see PAM Authentication Access to Unix Password Store. Note PAM Unix Password Authentication without Proxy Users The examples make the following assumptions. You might need to make some adjustments if your system is set up differently.