title: Custom PAM config: How can I pass username/password parameters to an pam_exec.so module?
body: <p>I'm using openvpn, a PAM aware app. It has the following useful documentation:</p>
  
  <pre><code>For example:
  
    plugin openvpn-auth-pam.so "login login USERNAME password PASSWORD"
  
  tells auth-pam to (a) use the "login" PAM module, (b) answer a
  "login" query with the username given by the OpenVPN client, and
  (c) answer a "password" query with the password given by the
  OpenVPN client.  This provides flexibility in dealing with the different
  types of query strings which different PAM modules might generate.
  For example, suppose you were using a PAM module called
  "test" which queried for "name" rather than "login":
  </code></pre>
  
  <p>Now I want to create an openvpn configuration in /etc/pam.d that gets the username/password from openvpn PAM plugin and passes it to a script. Enter:</p>
  
  <pre><code>pam_exec.so
  </code></pre>
  
  <p>Setting up a PAM openvpn configuration with an: </p>
  
  <p><code>auth required pam_exec.so myscript</code></p>
  
  <p>And configuring openvpn to call: </p>
  
  <p><code>plugin openvpn-auth-pam.so "openvpn login USERNAME password PASSWORD"</code> </p>
  
  <p>All seems straight forward. The part that gets me is what syntax I use to get the login/password that were defined in openvpn out to the script. The documentation of pam_exec.so seems to ignore this key question.</p>
  
  <p>E.g.:</p>
  
  <p><code>auth required pam_exec.so myscript %login %password</code></p>
  
  <p>The above is just my psudo code for how it might look, what should this syntax correctly look like?</p>