These modules may be stacked , or placed upon one another, so that multiple modules are used. The order of a module stack is very important in the authentication process, because it makes it very easy for an administrator to require that several conditions exist before allowing user authentication to occur. Then, a successful rhosts authentication is performed before the connection is allowed. If rhosts authentication fails, then standard password authentication is done. New PAM modules can be added at any time, and PAM-aware applications can then be made to use them.
All PAM modules generate a success or failure result when checked.
Control flags tell PAM what do with the result. Since modules can be stacked in a particular order, control flags give you the ability to set the importance of a module in respect to the modules that follow it. After the module type is specified, the control flags decide how important that particular module type should be considered to the overall goal of allowing access to the program to that user. If a required module check fails, the user is not notified until any other modules of the same module type have been checked. However, if a requisite module check fails, the user is notified immediately with a message reflecting the first failed required or requisite module.