PyPI · #3033 most downloaded on PyPI

python-pam

2.1.01.8M downloads/moFirefighterBlu3/python-pam ↗New releases in your daily digest, changelog included.

Last release 18 days ago
17 Sep 2026
Release timing varies
gaps range from 3 months to 4.5 years
Most releases are documented
notes for 7 of 8 stable releases
Nothing withdrawn
no release was ever pulled
12 years old
8 releases · first in 2014

Release timeline

8 releases since 2014

2014201620182020

Releases

2.1.017 Sept 2026Security
Bump pip to 26.2.1 ( CVE-2026-13346 / GHSA-qwm4-qh6w-59xr )
python-pam 2.1.0 — Poetry packaging, thread-safe authenticate, and refreshed tooling.

Features & changes

Switch to Poetry; drop Python 2 support

Make PAM handle checks more robust

Update documentation with a better example

CI tox suite covers Python 3.11–3.14

pam.authenticate() no longer reuses a process-global PamAuthenticator (thread-safe concurrent auth); libpam ctypes bindings are loaded once and shared (#40)

Document the threading model (do not share one PamAuthenticator across threads)

Document when to use resetcreds=True vs False (#52)

Tooling

Bump pip to 26.2.1 (CVE-2026-13346 / GHSA-qwm4-qh6w-59xr)

Refresh tox, pylint, mypy, pytest-env, and pip-tools pins
Open source →
Additional notes
September 16, 2026

switch to poetry

merge outstanding PRs

make handle checks and make them more robust

update documentation with better example

remove py2 support

tox test suite set to py312 and py313

fix #40: pam.authenticate() no longer reuses a process-global PamAuthenticator (thread-safe concurrent auth); libpam ctypes bindings are loaded once and shared for performance

document threading model (do not share one PamAuthenticator across threads)

document when to use resetcreds=True vs False (#52)

bump pip to 26.2.1 (CVE-2026-13346 / GHSA-qwm4-qh6w-59xr)

refresh tox, pylint, mypy, pytest-env, and pip-tools pins

add GitHub Actions trusted publishing for PyPI

2.0.218 Mar 20222 sources agree

Fixed #31 whereby I changed the boolean response in 2.0.0 to a PAM constant. This reverts to the boolean response as existed in v1.8.5. The _result co

Surface fixes

Fixed #31 whereby I changed the boolean response in 2.0.0 to a PAM constant. This reverts to the boolean response as existed in v1.8.5. The result code is still stored in the obj.code attribute
Added the PamAuthenticate.authenticate() method signature and docstring to both of the new and legacy interfaces
Changed the PamAuthenticate.authenticate() type hinting so it didn't interfere with the docstring
update the version to 2.0.2

Under the hood changes

Start mocking the libpam methods so we can wholly disassociate ourselves from the underlying system. This lets us test more of the actual python code and lets us start injecting errors to test for

Open source →

2.0.014 Mar 20222 sources agree

The surface functionality hasn't changed much but a few bugs have been fixed. Under the hood, a lot has changed. Functionality has now been moved into

Release 2.0.0

The surface functionality hasn't changed much but a few bugs have been fixed. Under the hood, a lot has changed. Functionality has now been moved into a class that helped with value tracking. I planned on removing Python 2 support but was convinced to leave it in for now as apparently there are still a lot of python2 users. :confused: :man_shrugging:

Most testing has moved to occur underneath tox, this is superior as it provides for testing in a clean environment and an installed environment.

Merges

#22, #24, #25 by @abompard
#21 by @spaceone and @lauriereeves
#16 by @okin
#14 by @codypiersall
#11 by @e4r7hbug and @hugovk
#5 by @willmo
#4 by @skylize
#3 by @fatlotus

Bugs fixed

Documentation in the README.md is updated, the new method of authentication is pam.authenticate(...) vs. pam.pam(...) (but it's still supported). Thank you @gkmcd. Some by-hand pam_unix.so and unix_chkpwd examples provided for testing
@leewi9 pointed out that TTY handling was less than optimal in some situations in #18
#12 resolved by @okin and #8 was also solved by this patch

Features & Changes

Unit testing and code coverage is 100% for all automated methods. Some methods require a valid TEST_USERNAME and TEST_PASSWORD to function and those are marked SKIP if not found in the environment. Sorry :-} -- mocking the internals of libc and libpam are far too hairy for the trivial bit of testing that can be verified by hand <details><summary>Testing summary</summary>

Name Stmts Miss Excluded Branch BrPart Cover

pam/__init__.py 59 0 2 2 0 100%

pam/__internals.py 281 0 14 76 0 100%

TOTAL 340 0 16 78 0 100%

Name	Stmts	Excluded	Branch	Cover
`pam/__init__.py`	59	2	2	100%
`pam/__internals.py`	281	14	76	100%
TOTAL	340	16	78	100%

</details>

bandit added for security checks
flake8 added for linting
mypy for type hinting
coverage added (generated reports go in htmlcov/
Multi-factor authentication is supported now from #25 @abompard
All of the constants are now exposed such as pam.PAM_SUCCESS or pam.PAM_PERM_DENIED
pam.authenticate(..., print_failure_messages=False) parameter was added to help your debugging