"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "doc/sag/Linux-PAM_SAG.txt" between
Linux-PAM-1.5.2-docs.tar.xz and Linux-PAM-1.5.3-docs.tar.xz

About: Linux-PAM is the Pluggable Authentication Modules for Linux. Documentation.

Linux-PAM_SAG.txt  (Linux-PAM-1.5.2-docs.tar.xz)	:	Linux-PAM_SAG.txt  (Linux-PAM-1.5.3-docs.tar.xz)
skipping to change at line 44		skipping to change at line 44
6. A reference guide for available modules		6. A reference guide for available modules
6.1. pam_access - logdaemon style login access control		6.1. pam_access - logdaemon style login access control
6.2. pam_debug - debug the PAM stack		6.2. pam_debug - debug the PAM stack
6.3. pam_deny - locking-out PAM module		6.3. pam_deny - locking-out PAM module
6.4. pam_echo - print text messages		6.4. pam_echo - print text messages
6.5. pam_env - set/unset environment variables		6.5. pam_env - set/unset environment variables
6.6. pam_exec - call an external command		6.6. pam_exec - call an external command
6.7. pam_faildelay - change the delay on failure per-application		6.7. pam_faildelay - change the delay on failure per-application
6.8. pam_filter - filter module		6.8. pam_faillock - temporarily locking access based on failed
6.9. pam_ftp - module for anonymous access		authentication attempts during an interval
6.10. pam_group - module to modify group access		6.9. pam_filter - filter module
6.11. pam_issue - add issue file to user prompt		6.10. pam_ftp - module for anonymous access
6.12. pam_keyinit - display the keyinit file		6.11. pam_group - module to modify group access
6.13. pam_lastlog - display date of last login		6.12. pam_issue - add issue file to user prompt
6.14. pam_limits - limit resources		6.13. pam_keyinit - display the keyinit file
6.15. pam_listfile - deny or allow services based on an arbitrary file		6.14. pam_lastlog - display date of last login
6.16. pam_localuser - require users to be listed in /etc/passwd		6.15. pam_limits - limit resources
6.17. pam_loginuid - record user's login uid to the process attribute		6.16. pam_listfile - deny or allow services based on an arbitrary file
6.18. pam_mail - inform about available mail		6.17. pam_localuser - require users to be listed in /etc/passwd
6.19. pam_mkhomedir - create users home directory		6.18. pam_loginuid - record user's login uid to the process attribute
6.20. pam_motd - display the motd file		6.19. pam_mail - inform about available mail
6.21. pam_namespace - setup a private namespace		6.20. pam_mkhomedir - create users home directory
6.22. pam_nologin - prevent non-root users from login		6.21. pam_motd - display the motd file
6.23. pam_permit - the promiscuous module		6.22. pam_namespace - setup a private namespace
6.24. pam_pwhistory - grant access using .pwhistory file		6.23. pam_nologin - prevent non-root users from login
6.25. pam_rhosts - grant access using .rhosts file		6.24. pam_permit - the promiscuous module
6.26. pam_rootok - gain only root access		6.25. pam_pwhistory - grant access using .pwhistory file
6.27. pam_securetty - limit root login to special devices		6.26. pam_rhosts - grant access using .rhosts file
6.28. pam_selinux - set the default security context		6.27. pam_rootok - gain only root access
6.29. pam_shells - check for valid login shell		6.28. pam_securetty - limit root login to special devices
6.30. pam_succeed_if - test account characteristics		6.29. pam_selinux - set the default security context
6.31. pam_time - time controlled access		6.30. pam_sepermit - allow/reject access based on SELinux mode
6.32. pam_timestamp - authenticate using cached successful authentication		6.31. pam_setquota - set or modify disk quotas on session start
		6.32. pam_shells - check for valid login shell
		6.33. pam_succeed_if - test account characteristics
		6.34. pam_time - time controlled access
		6.35. pam_timestamp - authenticate using cached successful authentication
attempts		attempts
6.33. pam_umask - set the file mode creation mask		6.36. pam_tty_audit - enable/disable tty auditing
6.34. pam_unix - traditional password authentication		6.37. pam_umask - set the file mode creation mask
6.35. pam_userdb - authenticate against a db database		6.38. pam_unix - traditional password authentication
6.36. pam_warn - logs all PAM items		6.39. pam_userdb - authenticate against a db database
6.37. pam_wheel - only permit root access to members of group wheel		6.40. pam_warn - logs all PAM items
6.38. pam_xauth - forward xauth keys between users		6.41. pam_wheel - only permit root access to members of group wheel
		6.42. pam_xauth - forward xauth keys between users
7. See also		7. See also
8. Author/acknowledgments		8. Author/acknowledgments
9. Copyright information for this document		9. Copyright information for this document
Chapter 1. Introduction		Chapter 1. Introduction
Linux-PAM (Pluggable Authentication Modules for Linux) is a suite of shared		Linux-PAM (Pluggable Authentication Modules for Linux) is a suite of shared
libraries that enable the local system administrator to choose how applications		libraries that enable the local system administrator to choose how applications
authenticate users.		authenticate users.
skipping to change at line 223		skipping to change at line 228
coded into the program. If you have access to the source code you can add the		coded into the program. If you have access to the source code you can add the
appropriate PAM functions. If you do not have access to the source code, and		appropriate PAM functions. If you do not have access to the source code, and
the binary does not have the PAM functions included, then it is not possible to		the binary does not have the PAM functions included, then it is not possible to
use PAM.		use PAM.
Chapter 4. The Linux-PAM configuration file		Chapter 4. The Linux-PAM configuration file
When a PAM aware privilege granting application is started, it activates its		When a PAM aware privilege granting application is started, it activates its
attachment to the PAM-API. This activation performs a number of tasks, the most		attachment to the PAM-API. This activation performs a number of tasks, the most
important being the reading of the configuration file(s): /etc/pam.conf.		important being the reading of the configuration file(s): /etc/pam.conf.
Alternatively, this may be the contents of the /etc/pam.d/ directory. The		Alternatively and preferably, the configuration can be set by individual
presence of this directory will cause Linux-PAM to ignore /etc/pam.conf.		configuration files located in a pam.d directory. The presence of this
		directory will cause Linux-PAM to ignore /etc/pam.conf.
These files list the PAMs that will do the authentication tasks required by		These files list the PAMs that will do the authentication tasks required by
this service, and the appropriate behavior of the PAM-API in the event that		this service, and the appropriate behavior of the PAM-API in the event that
individual PAMs fail.		individual PAMs fail.
4.1. Configuration file syntax		4.1. Configuration file syntax
The syntax of the /etc/pam.conf configuration file is as follows. The file is		The syntax of the /etc/pam.conf configuration file is as follows. The file is
made up of a list of rules, each rule is typically placed on a single line, but		made up of a list of rules, each rule is typically placed on a single line, but
may be extended with an escaped end of line: `\<LF>'. Comments are preceded		may be extended with an escaped end of line: `\<LF>'. Comments are preceded
skipping to change at line 464		skipping to change at line 470
[..[..\]..] --> ..[..]..		[..[..\]..] --> ..[..]..
Any line in (one of) the configuration file(s), that is not formatted		Any line in (one of) the configuration file(s), that is not formatted
correctly, will generally tend (erring on the side of caution) to make the		correctly, will generally tend (erring on the side of caution) to make the
authentication process fail. A corresponding error is written to the system log		authentication process fail. A corresponding error is written to the system log
files with a call to syslog(3).		files with a call to syslog(3).
4.2. Directory based configuration		4.2. Directory based configuration
More flexible than the single configuration file is it to configure libpam via		More flexible than the single configuration file is it to configure libpam via
the contents of the /etc/pam.d/ directory. In this case the directory is filled		the contents of pam.d directories. In this case the directories are filled with
with files each of which has a filename equal to a service-name (in		files each of which has a filename equal to a service-name (in lower-case): it
lower-case): it is the personal configuration file for the named service.		is the personal configuration file for the named service.
		Vendor-supplied PAM configuration files might be installed in the system
		directory /usr/lib/pam.d/ or a configurable vendor specific directory instead
		of the machine configuration directory /etc/pam.d/. If no machine configuration
		file is found, the vendor-supplied file is used. All files in /etc/pam.d/
		override files with the same name in other directories.
The syntax of each file in /etc/pam.d/ is similar to that of the /etc/pam.conf		The syntax of each file in pam.d is similar to that of the /etc/pam.conf file
file and is made up of lines of the following form:		and is made up of lines of the following form:
type control module-path module-arguments		type control module-path module-arguments
The only difference being that the service-name is not present. The		The only difference being that the service-name is not present. The
service-name is of course the name of the given configuration file. For		service-name is of course the name of the given configuration file. For
example, /etc/pam.d/login contains the configuration for the login service.		example, /etc/pam.d/login contains the configuration for the login service.
4.3. Example configuration file entries		4.3. Example configuration file entries
In this section, we give some examples of entries that can be present in the		In this section, we give some examples of entries that can be present in the
skipping to change at line 611		skipping to change at line 623
By default rules for access management are taken from config file /etc/security		By default rules for access management are taken from config file /etc/security
/access.conf if you don't specify another file. Then individual *.conf files		/access.conf if you don't specify another file. Then individual *.conf files
from the /etc/security/access.d/ directory are read. The files are parsed one		from the /etc/security/access.d/ directory are read. The files are parsed one
after another in the order of the system locale. The effect of the individual		after another in the order of the system locale. The effect of the individual
files is the same as if all the files were concatenated together in the order		files is the same as if all the files were concatenated together in the order
of parsing. This means that once a pattern is matched in some file no further		of parsing. This means that once a pattern is matched in some file no further
files are parsed. If a config file is explicitly specified with the accessfile		files are parsed. If a config file is explicitly specified with the accessfile
option the files in the above directory are not parsed.		option the files in the above directory are not parsed.
		By default rules for access management are taken from config file /etc/security
		/access.conf or, if that one is not present, the file %vendordir%/security/
		access.conf. These settings can be overruled by setting in a config file
		explicitly specified with the accessfile option. Then individual *.conf files
		from the /etc/security/access.d/ and %vendordir%/security/access.d directories
		are read. If /etc/security/access.d/@filename@.conf exists, then %vendordir%/
		security/access.d/@filename@.conf will not be used. All access.d/*.conf files
		are sorted by their @filename@.conf in lexicographic order regardless of which
		of the directories they reside in. The effect of the individual files is the
		same as if all the files were concatenated together in the order of parsing.
		This means that once a pattern is matched in some file no further files are
		parsed. If a config file is explicitly specified with the accessfile option the
		files in the above directories are not parsed.
If Linux PAM is compiled with audit support the module will report when it		If Linux PAM is compiled with audit support the module will report when it
denies access based on origin (host, tty, etc.).		denies access based on origin (host, tty, etc.).
6.1.2. DESCRIPTION		6.1.2. DESCRIPTION
The /etc/security/access.conf file specifies (user/group, host), (user/group,		The /etc/security/access.conf file specifies (user/group, host), (user/group,
network/netmask), (user/group, tty), (user/group, X-$DISPLAY-value), or (user/		network/netmask), (user/group, tty), (user/group, X-$DISPLAY-value), or (user/
group, pam-service-name) combinations for which a login will be either accepted		group, pam-service-name) combinations for which a login will be either accepted
or refused.		or refused.
skipping to change at line 744		skipping to change at line 770
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
The user is not known to the system.		The user is not known to the system.
6.1.6. FILES		6.1.6. FILES
/etc/security/access.conf		/etc/security/access.conf
Default configuration file		Default configuration file
		%vendordir%/security/access.conf
		Default configuration file if /etc/security/access.conf does not exist.
6.1.7. EXAMPLES		6.1.7. EXAMPLES
These are some example lines which might be specified in /etc/security/		These are some example lines which might be specified in /etc/security/
access.conf.		access.conf.
User root should be allowed to get access via cron, X11 terminal :0, tty1, ...,		User root should be allowed to get access via cron, X11 terminal :0, tty1, ...,
tty5, tty6.		tty5, tty6.
+:root:crond :0 tty1 tty2 tty3 tty4 tty5 tty6		+:root:crond :0 tty1 tty2 tty3 tty4 tty5 tty6
skipping to change at line 1035		skipping to change at line 1065
pam_env.so [ debug ] [ conffile=conf-file ] [ envfile=env-file ] [ readenv=0|1		pam_env.so [ debug ] [ conffile=conf-file ] [ envfile=env-file ] [ readenv=0|1
] [ user_envfile=env-file ] [ user_readenv=0|1 ]		] [ user_envfile=env-file ] [ user_readenv=0|1 ]
6.5.1. DESCRIPTION		6.5.1. DESCRIPTION
The pam_env PAM module allows the (un)setting of environment variables.		The pam_env PAM module allows the (un)setting of environment variables.
Supported is the use of previously set environment variables as well as		Supported is the use of previously set environment variables as well as
PAM_ITEMs such as PAM_RHOST.		PAM_ITEMs such as PAM_RHOST.
		Rules for (un)setting of variables can be defined in an own config file. The
		path to this file can be specified with the conffile option. If this file does
		not exist, the default rules are taken from the config files /etc/security/
		pam_env.conf and /etc/security/pam_env.conf.d/*.conf. If the file /etc/security
		/pam_env.conf does not exist, the rules are taken from the files %vendordir%/
		security/pam_env.conf, %vendordir%/security/pam_env.conf.d/*.conf and /etc/
		security/pam_env.conf.d/*.conf in that order.
		By default rules for (un)setting of variables are taken from the config file /
		etc/security/pam_env.conf. If this file does not exist %vendordir%/security/
		pam_env.conf is used. An alternate file can be specified with the conffile
		option, which overrules all other files.
By default rules for (un)setting of variables are taken from the config file /		By default rules for (un)setting of variables are taken from the config file /
etc/security/pam_env.conf. An alternate file can be specified with the conffile		etc/security/pam_env.conf. An alternate file can be specified with the conffile
option.		option.
		Environment variables can be defined in a file with simple KEY=VAL pairs on
		separate lines. The path to this file can be specified with the envfile option.
		If this file has not been defined, the settings are read from the files /etc/
		security/environment and /etc/security/environment.d/*. If the file /etc/
		environment does not exist, the settings are read from the files %vendordir%/
		environment, %vendordir%/environment.d/* and /etc/environment.d/* in that
		order. And last but not least, with the readenv option this mechanism can be
		completely disabled.
		Second a file (/etc/environment by default) with simple KEY=VAL pairs on
		separate lines will be read. If this file does not exist, %vendordir%/etc/
		environment is used. With the envfile option an alternate file can be
		specified, which overrules all other files. And with the readenv option this
		can be completely disabled.
Second a file (/etc/environment by default) with simple KEY=VAL pairs on		Second a file (/etc/environment by default) with simple KEY=VAL pairs on
separate lines will be read. With the envfile option an alternate file can be		separate lines will be read. With the envfile option an alternate file can be
specified. And with the readenv option this can be completely disabled.		specified. And with the readenv option this can be completely disabled.
Third it will read a user configuration file ($HOME/.pam_environment by		Third it will read a user configuration file ($HOME/.pam_environment by
default). The default file can be changed with the user_envfile option and it		default). The default file can be changed with the user_envfile option and it
can be turned on and off with the user_readenv option.		can be turned on and off with the user_readenv option.
Since setting of PAM environment variables can have side effects to other		Since setting of PAM environment variables can have side effects to other
modules, this module should be the last one on the stack.		modules, this module should be the last one on the stack.
6.5.2. DESCRIPTION		6.5.2. DESCRIPTION
		The %vendordir%/security/pam_env.conf and /etc/security/pam_env.conf files
		specify the environment variables to be set, unset or modified by pam_env(8).
		When someone logs in, these files are read and the environment variables are
		set according.
The /etc/security/pam_env.conf file specifies the environment variables to be		The /etc/security/pam_env.conf file specifies the environment variables to be
set, unset or modified by pam_env(8). When someone logs in, this file is read		set, unset or modified by pam_env(8). When someone logs in, this file is read
and the environment variables are set according.		and the environment variables are set according.
Each line starts with the variable name, there are then two possible options		Each line starts with the variable name, there are then two possible options
for each variable DEFAULT and OVERRIDE. DEFAULT allows an administrator to set		for each variable DEFAULT and OVERRIDE. DEFAULT allows an administrator to set
the value of the variable to some default value, if none is supplied then the		the value of the variable to some default value, if none is supplied then the
empty string is assumed. The OVERRIDE option tells pam_env that it should enter		empty string is assumed. The OVERRIDE option tells pam_env that it should enter
in its value (overriding the default value) if there is one to use. OVERRIDE is		in its value (overriding the default value) if there is one to use. When
not used, "" is assumed and no override will be done.		OVERRIDE is not used, "" is assumed and no override will be done.
VARIABLE [DEFAULT=[value]] [OVERRIDE=[value]]		VARIABLE [DEFAULT=[value]] [OVERRIDE=[value]]
(Possibly non-existent) environment variables may be used in values using the $		(Possibly non-existent) environment variables may be used in values using the $
{string} syntax and (possibly non-existent) PAM_ITEMs as well as HOME and SHELL		{string} syntax and (possibly non-existent) PAM_ITEMs as well as HOME and SHELL
may be used in values using the @{string} syntax. Both the $ and @ characters		may be used in values using the @{string} syntax. Both the $ and @ characters
can be backslash escaped to be used as literal values values can be delimited		can be backslash escaped to be used as literal values values can be delimited
with "", escaped " not supported. Note that many environment variables that you		with "", escaped " not supported. Note that many environment variables that you
would like to use may not be set by the time the module is called. For example,		would like to use may not be set by the time the module is called. For example,
${HOME} is used below several times, but many PAM applications don't make it		${HOME} is used below several times, but many PAM applications don't make it
available by the time you need it. The special variables @{HOME} and @{SHELL}		available by the time you need it. The special variables @{HOME} and @{SHELL}
are expanded to the values for the user from his passwd entry.		are expanded to the values for the user from his passwd entry.
The "#" character at start of line (no space at front) can be used to mark this		The "#" character at start of line (no space at front) can be used to mark this
line as a comment line.		line as a comment line.
		The %vendordir%/environment and /etc/environment files specify the environment
		variables to be set. These files must consist of simple NAME=VALUE pairs on
		separate lines. The pam_env(8) module will read these files after the
		pam_env.conf file.
The /etc/environment file specifies the environment variables to be set. The		The /etc/environment file specifies the environment variables to be set. The
file must consist of simple NAME=VALUE pairs on separate lines. The pam_env(8)		file must consist of simple NAME=VALUE pairs on separate lines. The pam_env(8)
module will read the file after the pam_env.conf file.		module will read the file after the pam_env.conf file.
6.5.3. OPTIONS		6.5.3. OPTIONS
conffile=/path/to/pam_env.conf		conffile=/path/to/pam_env.conf
Indicate an alternative pam_env.conf style configuration file to override		Indicate an alternative pam_env.conf style configuration file to override
the default. This can be useful when different services need different		the default. This can be useful when different services need different
skipping to change at line 1147		skipping to change at line 1215
PAM_IGNORE		PAM_IGNORE
No pam_env.conf and environment file was found.		No pam_env.conf and environment file was found.
PAM_SUCCESS		PAM_SUCCESS
Environment variables were set.		Environment variables were set.
6.5.6. FILES		6.5.6. FILES
/etc/security/pam_env.conf		%vendordir%/security/pam_env.conf, /etc/security/pam_env.conf
Default configuration file		Default configuration file
/etc/environment		%vendordir%/environment, /etc/environment
Default environment file		Default environment file
$HOME/.pam_environment		$HOME/.pam_environment
User specific environment file		User specific environment file
6.5.7. EXAMPLES		6.5.7. EXAMPLES
These are some example lines which might be specified in /etc/security/		These are some example lines which might be specified in /etc/security/
skipping to change at line 1356		skipping to change at line 1424
6.7.5. EXAMPLES		6.7.5. EXAMPLES
The following example will set the delay on failure to 10 seconds:		The following example will set the delay on failure to 10 seconds:
auth optional pam_faildelay.so delay=10000000		auth optional pam_faildelay.so delay=10000000
6.7.6. AUTHOR		6.7.6. AUTHOR
pam_faildelay was written by Darren Tucker <dtucker@zip.com.au>.		pam_faildelay was written by Darren Tucker <dtucker@zip.com.au>.
6.8. pam_filter - filter module		6.8. pam_faillock - temporarily locking access based on failed authentication
		attempts during an interval
pam_filter.so [ debug ] [ new_term ] [ non_term ] run1|run2 filter [ ... ]		auth ... pam_faillock.so { preauth|authfail|authsucc } [ conf=/path/to/
		config-file ] [ dir=/path/to/tally-directory ] [ even_deny_root ] [ deny=n ] [
		fail_interval=n ] [ unlock_time=n ] [ root_unlock_time=n ] [ admin_group=name ]
		[ audit ] [ silent ] [ no_log_info ]
		account ... pam_faillock.so [ dir=/path/to/tally-directory ] [ no_log_info ]
6.8.1. DESCRIPTION		6.8.1. DESCRIPTION
		This module maintains a list of failed authentication attempts per user during
		a specified interval and locks the account in case there were more than deny
		consecutive failed authentications.
		Normally, failed attempts to authenticate root will not cause the root account
		to become blocked, to prevent denial-of-service: if your users aren't given
		shell accounts and root may only login via su or at the machine console (not
		telnet/rsh, etc), this is safe.
		6.8.2. OPTIONS
		{preauth|authfail|authsucc}
		This argument must be set accordingly to the position of this module
		instance in the PAM stack.
		The preauth argument must be used when the module is called before the
		modules which ask for the user credentials such as the password. The module
		just examines whether the user should be blocked from accessing the service
		in case there were anomalous number of failed consecutive authentication
		attempts recently. This call is optional if authsucc is used.
		The authfail argument must be used when the module is called after the
		modules which determine the authentication outcome, failed. Unless the user
		is already blocked due to previous authentication failures, the module will
		record the failure into the appropriate user tally file.
		The authsucc argument must be used when the module is called after the
		modules which determine the authentication outcome, succeeded. Unless the
		user is already blocked due to previous authentication failures, the module
		will then clear the record of the failures in the respective user tally
		file. Otherwise it will return authentication error. If this call is not
		done, the pam_faillock will not distinguish between consecutive and
		non-consecutive failed authentication attempts. The preauth call must be
		used in such case. Due to complications in the way the PAM stack can be
		configured it is also possible to call pam_faillock as an account module.
		In such configuration the module must be also called in the preauth stage.
		conf=/path/to/config-file
		Use another configuration file instead of the default /etc/security/
		faillock.conf.
		Use another configuration file instead of the default which is to use the
		file /etc/security/faillock.conf or, if that one is not present, the file
		%vendordir%/security/faillock.conf.
		The options for configuring the module behavior are described in the
		faillock.conf(5) manual page. The options specified on the module command line
		override the values from the configuration file.
		6.8.3. MODULE TYPES PROVIDED
		The auth and account module types are provided.
		6.8.4. RETURN VALUES
		PAM_AUTH_ERR
		An invalid option was given, the module was not able to retrieve the user
		name, no valid counter file was found, or too many failed logins.
		PAM_BUF_ERR
		Memory buffer error.
		PAM_CONV_ERR
		The conversation method supplied by the application failed to obtain the
		username.
		PAM_INCOMPLETE
		The conversation method supplied by the application returned
		PAM_CONV_AGAIN.
		PAM_SUCCESS
		Everything was successful.
		PAM_IGNORE
		User not present in passwd database.
		6.8.5. EXAMPLES
		Here are two possible configuration examples for /etc/pam.d/login. They make
		pam_faillock to lock the account after 4 consecutive failed logins during the
		default interval of 15 minutes. Root account will be locked as well. The
		accounts will be automatically unlocked after 20 minutes.
		In the first example the module is called only in the auth phase and the module
		does not print any information about the account being blocked by pam_faillock.
		The preauth call can be added to tell users that their logins are blocked by
		the module and also to abort the authentication without even asking for
		password in such case.
		/etc/security/faillock.conf file example:
		deny=4
		unlock_time=1200
		silent
		/etc/pam.d/config file example:
		auth required pam_securetty.so
		auth required pam_env.so
		auth required pam_nologin.so
		# optionally call: auth requisite pam_faillock.so preauth
		# to display the message about account being locked
		auth [success=1 default=bad] pam_unix.so
		auth [default=die] pam_faillock.so authfail
		auth sufficient pam_faillock.so authsucc
		auth required pam_deny.so
		account required pam_unix.so
		password required pam_unix.so shadow
		session required pam_selinux.so close
		session required pam_loginuid.so
		session required pam_unix.so
		session required pam_selinux.so open
		In the second example the module is called both in the auth and account phases
		and the module informs the authenticating user when the account is locked if
		silent option is not specified in the faillock.conf.
		auth required pam_securetty.so
		auth required pam_env.so
		auth required pam_nologin.so
		auth required pam_faillock.so preauth
		# optionally use requisite above if you do not want to prompt for the password
		# on locked accounts
		auth sufficient pam_unix.so
		auth [default=die] pam_faillock.so authfail
		auth required pam_deny.so
		account required pam_faillock.so
		# if you drop the above call to pam_faillock.so the lock will be done also
		# on non-consecutive authentication failures
		account required pam_unix.so
		password required pam_unix.so shadow
		session required pam_selinux.so close
		session required pam_loginuid.so
		session required pam_unix.so
		session required pam_selinux.so open
		6.8.6. AUTHOR
		pam_faillock was written by Tomas Mraz.
		6.9. pam_filter - filter module
		pam_filter.so [ debug ] [ new_term ] [ non_term ] run1|run2 filter [ ... ]
		6.9.1. DESCRIPTION
This module is intended to be a platform for providing access to all of the		This module is intended to be a platform for providing access to all of the
input/output that passes between the user and the application. It is only		input/output that passes between the user and the application. It is only
suitable for tty-based and (stdin/stdout) applications.		suitable for tty-based and (stdin/stdout) applications.
To function this module requires filters to be installed on the system. The		To function this module requires filters to be installed on the system. The
single filter provided with the module simply transposes upper and lower case		single filter provided with the module simply transposes upper and lower case
letters in the input and output streams. (This can be very annoying and is not		letters in the input and output streams. (This can be very annoying and is not
kind to termcap based editors).		kind to termcap based editors).
Each component of the module has the potential to invoke the desired filter.		Each component of the module has the potential to invoke the desired filter.
The filter is always execv(2) with the privilege of the calling application and		The filter is always execv(2) with the privilege of the calling application and
not that of the user. For this reason it cannot usually be killed by the user		not that of the user. For this reason it cannot usually be killed by the user
without closing their session.		without closing their session.
6.8.2. OPTIONS		6.9.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
new_term		new_term
The default action of the filter is to set the PAM_TTY item to indicate the		The default action of the filter is to set the PAM_TTY item to indicate the
terminal that the user is using to connect to the application. This		terminal that the user is using to connect to the application. This
argument indicates that the filter should set PAM_TTY to the filtered		argument indicates that the filter should set PAM_TTY to the filtered
skipping to change at line 1422		skipping to change at line 1650
For the case of the password component, run1 is used to indicate that the		For the case of the password component, run1 is used to indicate that the
filter is run on the first occasion of pam_chauthtok(3) (the		filter is run on the first occasion of pam_chauthtok(3) (the
PAM_PRELIM_CHECK phase) and run2 is used to indicate that the filter is run		PAM_PRELIM_CHECK phase) and run2 is used to indicate that the filter is run
on the second occasion (the PAM_UPDATE_AUTHTOK phase).		on the second occasion (the PAM_UPDATE_AUTHTOK phase).
filter		filter
The full pathname of the filter to be run and any command line arguments		The full pathname of the filter to be run and any command line arguments
that the filter might expect.		that the filter might expect.
6.8.3. MODULE TYPES PROVIDED		6.9.3. MODULE TYPES PROVIDED
All module types (auth, account, password and session) are provided.		All module types (auth, account, password and session) are provided.
6.8.4. RETURN VALUES		6.9.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
The new filter was set successfully.		The new filter was set successfully.
PAM_ABORT		PAM_ABORT
Critical error, immediate abort.		Critical error, immediate abort.
6.8.5. EXAMPLES		6.9.5. EXAMPLES
Add the following line to /etc/pam.d/login to see how to configure login to		Add the following line to /etc/pam.d/login to see how to configure login to
transpose upper and lower case letters once the user has logged in:		transpose upper and lower case letters once the user has logged in:
session required pam_filter.so run1 /lib/security/pam_filter/upperLOWER		session required pam_filter.so run1 /lib/security/pam_filter/upperLOWER
6.8.6. AUTHOR		6.9.6. AUTHOR
pam_filter was written by Andrew G. Morgan <morgan@kernel.org>.		pam_filter was written by Andrew G. Morgan <morgan@kernel.org>.
6.9. pam_ftp - module for anonymous access		6.10. pam_ftp - module for anonymous access
pam_ftp.so [ debug ] [ ignore ] [ users=XXX,YYY, ...]		pam_ftp.so [ debug ] [ ignore ] [ users=XXX,YYY, ...]
6.9.1. DESCRIPTION		6.10.1. DESCRIPTION
pam_ftp is a PAM module which provides a pluggable anonymous ftp mode of		pam_ftp is a PAM module which provides a pluggable anonymous ftp mode of
access.		access.
This module intercepts the user's name and password. If the name is ftp or		This module intercepts the user's name and password. If the name is ftp or
anonymous, the user's password is broken up at the @ delimiter into a PAM_RUSER		anonymous, the user's password is broken up at the @ delimiter into a PAM_RUSER
and a PAM_RHOST part; these pam-items being set accordingly. The username (		and a PAM_RHOST part; these pam-items being set accordingly. The username (
PAM_USER) is set to ftp. In this case the module succeeds. Alternatively, the		PAM_USER) is set to ftp. In this case the module succeeds. Alternatively, the
module sets the PAM_AUTHTOK item with the entered password and fails.		module sets the PAM_AUTHTOK item with the entered password and fails.
This module is not safe and easily spoofable.		This module is not safe and easily spoofable.
6.9.2. OPTIONS		6.10.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
ignore		ignore
Pay no attention to the email address of the user (if supplied).		Pay no attention to the email address of the user (if supplied).
ftp=XXX,YYY,...		ftp=XXX,YYY,...
Instead of ftp or anonymous, provide anonymous login to the comma separated		Instead of ftp or anonymous, provide anonymous login to the comma separated
list of users: XXX,YYY,.... Should the applicant enter one of these		list of users: XXX,YYY,.... Should the applicant enter one of these
usernames the returned username is set to the first in the list: XXX.		usernames the returned username is set to the first in the list: XXX.
6.9.3. MODULE TYPES PROVIDED		6.10.3. MODULE TYPES PROVIDED
Only the auth module type is provided.		Only the auth module type is provided.
6.9.4. RETURN VALUES		6.10.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
The authentication was successful.		The authentication was successful.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User not known.		User not known.
6.9.5. EXAMPLES		6.10.5. EXAMPLES
Add the following line to /etc/pam.d/ftpd to handle ftp style anonymous login:		Add the following line to /etc/pam.d/ftpd to handle ftp style anonymous login:
#		#
# ftpd; add ftp-specifics. These lines enable anonymous ftp over		# ftpd; add ftp-specifics. These lines enable anonymous ftp over
# standard UN*X access (the listfile entry blocks access to		# standard UN*X access (the listfile entry blocks access to
# users listed in /etc/ftpusers)		# users listed in /etc/ftpusers)
#		#
auth sufficient pam_ftp.so		auth sufficient pam_ftp.so
auth required pam_unix.so use_first_pass		auth required pam_unix.so use_first_pass
auth required pam_listfile.so \		auth required pam_listfile.so \
onerr=succeed item=user sense=deny file=/etc/ftpusers		onerr=succeed item=user sense=deny file=/etc/ftpusers
6.9.6. AUTHOR		6.10.6. AUTHOR
pam_ftp was written by Andrew G. Morgan <morgan@kernel.org>.		pam_ftp was written by Andrew G. Morgan <morgan@kernel.org>.
6.10. pam_group - module to modify group access		6.11. pam_group - module to modify group access
pam_group.so		pam_group.so
6.10.1. DESCRIPTION		6.11.1. DESCRIPTION
The pam_group PAM module does not authenticate the user, but instead it grants		The pam_group PAM module does not authenticate the user, but instead it grants
group memberships (in the credential setting phase of the authentication		group memberships (in the credential setting phase of the authentication
module) to the user. Such memberships are based on the service they are		module) to the user. Such memberships are based on the service they are
applying for.		applying for.
By default rules for group memberships are taken from config file /etc/security		By default rules for group memberships are taken from config file /etc/security
/group.conf.		/group.conf.
		If /etc/security/group.conf does not exist, %vendordir%/security/group.conf is
		used.
This module's usefulness relies on the file-systems accessible to the user. The		This module's usefulness relies on the file-systems accessible to the user. The
point being that once granted the membership of a group, the user may attempt		point being that once granted the membership of a group, the user may attempt
to create a setgid binary with a restricted group ownership. Later, when the		to create a setgid binary with a restricted group ownership. Later, when the
user is not given membership to this group, they can recover group membership		user is not given membership to this group, they can recover group membership
with the precompiled binary. The reason that the file-systems that the user has		with the precompiled binary. The reason that the file-systems that the user has
access to are so significant, is the fact that when a system is mounted nosuid		access to are so significant, is the fact that when a system is mounted nosuid
the user is unable to create or execute such a binary file. For this module to		the user is unable to create or execute such a binary file. For this module to
provide any level of security, all file-systems that the user has write access		provide any level of security, all file-systems that the user has write access
to should be mounted nosuid.		to should be mounted nosuid.
The pam_group module functions in parallel with the /etc/group file. If the		The pam_group module functions in parallel with the /etc/group file. If the
user is granted any groups based on the behavior of this module, they are		user is granted any groups based on the behavior of this module, they are
granted in addition to those entries /etc/group (or equivalent).		granted in addition to those entries /etc/group (or equivalent).
6.10.2. DESCRIPTION		6.11.2. DESCRIPTION
The pam_group PAM module does not authenticate the user, but instead it grants		The pam_group PAM module does not authenticate the user, but instead it grants
group memberships (in the credential setting phase of the authentication		group memberships (in the credential setting phase of the authentication
module) to the user. Such memberships are based on the service they are		module) to the user. Such memberships are based on the service they are
applying for.		applying for.
For this module to function correctly there must be a correctly formatted /etc/		For this module to function correctly there must be a correctly formatted /etc/
security/group.conf file present. White spaces are ignored and lines maybe		security/group.conf file present. White spaces are ignored and lines maybe
extended with '\' (escaped newlines). Text following a '#' is ignored to the		extended with '\' (escaped newlines). Text following a '#' is ignored to the
end of the line.		end of the line.
skipping to change at line 1592		skipping to change at line 1823
the start and finish time (if the finish time is smaller than the start time it		the start and finish time (if the finish time is smaller than the start time it
is deemed to apply on the following day).		is deemed to apply on the following day).
The groups field is a comma or space separated list of groups that the user		The groups field is a comma or space separated list of groups that the user
inherits membership of. These groups are added if the previous fields are		inherits membership of. These groups are added if the previous fields are
satisfied by the user's request.		satisfied by the user's request.
For a rule to be active, ALL of service+ttys+users must be satisfied by the		For a rule to be active, ALL of service+ttys+users must be satisfied by the
applying process.		applying process.
6.10.3. OPTIONS		6.11.3. OPTIONS
This module does not recognise any options.		This module does not recognise any options.
6.10.4. MODULE TYPES PROVIDED		6.11.4. MODULE TYPES PROVIDED
Only the auth module type is provided.		Only the auth module type is provided.
6.10.5. RETURN VALUES		6.11.5. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
group membership was granted.		group membership was granted.
PAM_ABORT		PAM_ABORT
Not all relevant data could be gotten.		Not all relevant data could be gotten.
PAM_BUF_ERR		PAM_BUF_ERR
skipping to change at line 1626		skipping to change at line 1857
Group membership was not granted.		Group membership was not granted.
PAM_IGNORE		PAM_IGNORE
pam_sm_authenticate was called which does nothing.		pam_sm_authenticate was called which does nothing.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
The user is not known to the system.		The user is not known to the system.
6.10.6. FILES		6.11.6. FILES
/etc/security/group.conf		/etc/security/group.conf
Default configuration file		Default configuration file
6.10.7. EXAMPLES		6.11.7. EXAMPLES
These are some example lines which might be specified in /etc/security/		These are some example lines which might be specified in /etc/security/
group.conf.		group.conf.
Running 'xsh' on tty* (any ttyXXX device), the user 'us' is given access to the		Running 'xsh' on tty* (any ttyXXX device), the user 'us' is given access to the
floppy (through membership of the floppy group)		floppy (through membership of the floppy group)
xsh;tty*&!ttyp*;us;Al0000-2400;floppy		xsh;tty*&!ttyp*;us;Al0000-2400;floppy
Running 'xsh' on tty* (any ttyXXX device), the users 'sword', 'pike' and		Running 'xsh' on tty* (any ttyXXX device), the users 'sword', 'pike' and
skipping to change at line 1654		skipping to change at line 1885
after work hours.		after work hours.
xsh; tty* ;sword|pike|shield;!Wk0900-1800;games, sound		xsh; tty* ;sword|pike|shield;!Wk0900-1800;games, sound
xsh; tty* ;*;Al0900-1800;floppy		xsh; tty* ;*;Al0900-1800;floppy
Any member of the group 'admin' running 'xsh' on tty*, is granted access (at		Any member of the group 'admin' running 'xsh' on tty*, is granted access (at
any time) to the group 'plugdev'		any time) to the group 'plugdev'
xsh; tty* ;%admin;Al0000-2400;plugdev		xsh; tty* ;%admin;Al0000-2400;plugdev
6.10.8. AUTHORS		6.11.8. AUTHORS
pam_group was written by Andrew G. Morgan <morgan@kernel.org>.		pam_group was written by Andrew G. Morgan <morgan@kernel.org>.
6.11. pam_issue - add issue file to user prompt		6.12. pam_issue - add issue file to user prompt
pam_issue.so [ noesc ] [ issue=issue-file-name ]		pam_issue.so [ noesc ] [ issue=issue-file-name ]
6.11.1. DESCRIPTION		6.12.1. DESCRIPTION
pam_issue is a PAM module to prepend an issue file to the username prompt. It		pam_issue is a PAM module to prepend an issue file to the username prompt. It
also by default parses escape codes in the issue file similar to some common		also by default parses escape codes in the issue file similar to some common
getty's (using \x format).		getty's (using \x format).
Recognized escapes:		Recognized escapes:
\d		\d
current day		current day
skipping to change at line 1715		skipping to change at line 1946
\U		\U
same as \u except it is suffixed with "user" or "users" (eg. "1 user" or		same as \u except it is suffixed with "user" or "users" (eg. "1 user" or
"10 users")		"10 users")
\v		\v
operating system version and build date (uname -v)		operating system version and build date (uname -v)
6.11.2. OPTIONS		6.12.2. OPTIONS
noesc		noesc
Turns off escape code parsing.		Turns off escape code parsing.
issue=issue-file-name		issue=issue-file-name
The file to output if not using the default.		The file to output if not using the default.
6.11.3. MODULE TYPES PROVIDED		6.12.3. MODULE TYPES PROVIDED
Only the auth module type is provided.		Only the auth module type is provided.
6.11.4. RETURN VALUES		6.12.4. RETURN VALUES
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
PAM_IGNORE		PAM_IGNORE
The prompt was already changed.		The prompt was already changed.
PAM_SERVICE_ERR		PAM_SERVICE_ERR
A service module error occurred.		A service module error occurred.
PAM_SUCCESS		PAM_SUCCESS
The new prompt was set successfully.		The new prompt was set successfully.
6.11.5. EXAMPLES		6.12.5. EXAMPLES
Add the following line to /etc/pam.d/login to set the user specific issue at		Add the following line to /etc/pam.d/login to set the user specific issue at
login:		login:
auth optional pam_issue.so issue=/etc/issue		auth optional pam_issue.so issue=/etc/issue
6.11.6. AUTHOR		6.12.6. AUTHOR
pam_issue was written by Ben Collins <bcollins@debian.org>.		pam_issue was written by Ben Collins <bcollins@debian.org>.
6.12. pam_keyinit - display the keyinit file		6.13. pam_keyinit - display the keyinit file
pam_keyinit.so [ debug ] [ force ] [ revoke ]		pam_keyinit.so [ debug ] [ force ] [ revoke ]
6.12.1. DESCRIPTION		6.13.1. DESCRIPTION
The pam_keyinit PAM module ensures that the invoking process has a session		The pam_keyinit PAM module ensures that the invoking process has a session
keyring other than the user default session keyring.		keyring other than the user default session keyring.
The module checks to see if the process's session keyring is the		The module checks to see if the process's session keyring is the
user-session-keyring(7), and, if it is, creates a new session-keyring(7) with		user-session-keyring(7), and, if it is, creates a new session-keyring(7) with
which to replace it. If a new session keyring is created, it will install a		which to replace it. If a new session keyring is created, it will install a
link to the user-keyring(7) in the session keyring so that keys common to the		link to the user-keyring(7) in the session keyring so that keys common to the
user will be automatically accessible through it. The session keyring of the		user will be automatically accessible through it. The session keyring of the
invoking process will thenceforth be inherited by all its children unless they		invoking process will thenceforth be inherited by all its children unless they
skipping to change at line 1793		skipping to change at line 2024
This module should not, generally, be invoked by programs like su, since it is		This module should not, generally, be invoked by programs like su, since it is
usually desirable for the key set to percolate through to the alternate		usually desirable for the key set to percolate through to the alternate
context. The keys have their own permissions system to manage this.		context. The keys have their own permissions system to manage this.
The keyutils package is used to manipulate keys more directly. This can be		The keyutils package is used to manipulate keys more directly. This can be
obtained from:		obtained from:
Keyutils		Keyutils
6.12.2. OPTIONS		6.13.2. OPTIONS
debug		debug
Log debug information with syslog(3).		Log debug information with syslog(3).
force		force
Causes the session keyring of the invoking process to be replaced		Causes the session keyring of the invoking process to be replaced
unconditionally.		unconditionally.
revoke		revoke
Causes the session keyring of the invoking process to be revoked when the		Causes the session keyring of the invoking process to be revoked when the
invoking process exits if the session keyring was created for this process		invoking process exits if the session keyring was created for this process
in the first place.		in the first place.
6.12.3. MODULE TYPES PROVIDED		6.13.3. MODULE TYPES PROVIDED
Only the session module type is provided.		Only the session module type is provided.
6.12.4. RETURN VALUES		6.13.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
This module will usually return this value		This module will usually return this value
PAM_AUTH_ERR		PAM_AUTH_ERR
Authentication failure.		Authentication failure.
PAM_BUF_ERR		PAM_BUF_ERR
skipping to change at line 1845		skipping to change at line 2076
PAM_SESSION_ERR		PAM_SESSION_ERR
This module will return this value if its arguments are invalid or if a		This module will return this value if its arguments are invalid or if a
system error such as ENOMEM occurs.		system error such as ENOMEM occurs.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User not known.		User not known.
6.12.5. EXAMPLES		6.13.5. EXAMPLES
Add this line to your login entries to start each login session with its own		Add this line to your login entries to start each login session with its own
session keyring:		session keyring:
session required pam_keyinit.so		session required pam_keyinit.so
This will prevent keys from one session leaking into another session for the		This will prevent keys from one session leaking into another session for the
same user.		same user.
6.12.6. AUTHOR		6.13.6. AUTHOR
pam_keyinit was written by David Howells, <dhowells@redhat.com>.		pam_keyinit was written by David Howells, <dhowells@redhat.com>.
6.13. pam_lastlog - display date of last login		6.14. pam_lastlog - display date of last login
pam_lastlog.so [ debug ] [ silent ] [ never ] [ nodate ] [ nohost ] [ noterm ]		pam_lastlog.so [ debug ] [ silent ] [ never ] [ nodate ] [ nohost ] [ noterm ]
[ nowtmp ] [ noupdate ] [ showfailed ] [ inactive=<days> ] [ unlimited ]		[ nowtmp ] [ noupdate ] [ showfailed ] [ inactive=<days> ] [ unlimited ]
6.13.1. DESCRIPTION		6.14.1. DESCRIPTION
pam_lastlog is a PAM module to display a line of information about the last		pam_lastlog is a PAM module to display a line of information about the last
login of the user. In addition, the module maintains the /var/log/lastlog file.		login of the user. In addition, the module maintains the /var/log/lastlog file.
Some applications may perform this function themselves. In such cases, this		Some applications may perform this function themselves. In such cases, this
module is not necessary.		module is not necessary.
The module checks LASTLOG_UID_MAX option in /etc/login.defs and does not update		The module checks LASTLOG_UID_MAX option in /etc/login.defs and does not update
or display last login records for users with UID higher than its value. If the		or display last login records for users with UID higher than its value. If the
option is not present or its value is invalid, no user ID limit is applied.		option is not present or its value is invalid, no user ID limit is applied.
If the module is called in the auth or account phase, the accounts that were		If the module is called in the auth or account phase, the accounts that were
not used recently enough will be disallowed to log in. The check is not		not used recently enough will be disallowed to log in. The check is not
performed for the root account so the root is never locked out. It is also not		performed for the root account so the root is never locked out. It is also not
performed for users with UID higher than the LASTLOG_UID_MAX value.		performed for users with UID higher than the LASTLOG_UID_MAX value.
6.13.2. OPTIONS		6.14.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
silent		silent
Don't inform the user about any previous login, just update the /var/log/		Don't inform the user about any previous login, just update the /var/log/
lastlog file. This option does not affect display of bad login attempts.		lastlog file. This option does not affect display of bad login attempts.
skipping to change at line 1935		skipping to change at line 2166
This option is specific for the auth or account phase. It specifies the		This option is specific for the auth or account phase. It specifies the
number of days after the last login of the user when the user will be		number of days after the last login of the user when the user will be
locked out by the module. The default value is 90.		locked out by the module. The default value is 90.
unlimited		unlimited
If the fsize limit is set, this option can be used to override it,		If the fsize limit is set, this option can be used to override it,
preventing failures on systems with large UID values that lead lastlog to		preventing failures on systems with large UID values that lead lastlog to
become a huge sparse file.		become a huge sparse file.
6.13.3. MODULE TYPES PROVIDED		6.14.3. MODULE TYPES PROVIDED
The auth and account module type allows one to lock out users who did not login		The auth and account module type allows one to lock out users who did not login
recently enough. The session module type is provided for displaying the		recently enough. The session module type is provided for displaying the
information about the last login and/or updating the lastlog and wtmp files.		information about the last login and/or updating the lastlog and wtmp files.
6.13.4. RETURN VALUES		6.14.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
Everything was successful.		Everything was successful.
PAM_SERVICE_ERR		PAM_SERVICE_ERR
Internal service module error.		Internal service module error.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
skipping to change at line 1964		skipping to change at line 2195
PAM_AUTH_ERR		PAM_AUTH_ERR
User locked out in the auth or account phase due to inactivity.		User locked out in the auth or account phase due to inactivity.
PAM_IGNORE		PAM_IGNORE
There was an error during reading the lastlog file in the auth or account		There was an error during reading the lastlog file in the auth or account
phase and thus inactivity of the user cannot be determined.		phase and thus inactivity of the user cannot be determined.
6.13.5. EXAMPLES		6.14.5. EXAMPLES
Add the following line to /etc/pam.d/login to display the last login time of a		Add the following line to /etc/pam.d/login to display the last login time of a
user:		user:
session required pam_lastlog.so nowtmp		session required pam_lastlog.so nowtmp
To reject the user if he did not login during the previous 50 days the		To reject the user if he did not login during the previous 50 days the
following line can be used:		following line can be used:
auth required pam_lastlog.so inactive=50		auth required pam_lastlog.so inactive=50
6.13.6. AUTHOR		6.14.6. AUTHOR
pam_lastlog was written by Andrew G. Morgan <morgan@kernel.org>.		pam_lastlog was written by Andrew G. Morgan <morgan@kernel.org>.
Inactive account lock out added by Tomáš Mráz <tm@t8m.info>.		Inactive account lock out added by Tomáš Mráz <tm@t8m.info>.
6.14. pam_limits - limit resources		6.15. pam_limits - limit resources
pam_limits.so [ conf=/path/to/limits.conf ] [ debug ] [ set_all ] [ utmp_early		pam_limits.so [ conf=/path/to/limits.conf ] [ debug ] [ set_all ] [ utmp_early
] [ noaudit ]		] [ noaudit ]
6.14.1. DESCRIPTION		6.15.1. DESCRIPTION
The pam_limits PAM module sets limits on the system resources that can be		The pam_limits PAM module sets limits on the system resources that can be
obtained in a user-session. Users of uid=0 are affected by this limits, too.		obtained in a user-session. Users of uid=0 are affected by this limits, too.
By default limits are taken from the /etc/security/limits.conf config file.		By default limits are taken from the /etc/security/limits.conf config file.
Then individual *.conf files from the /etc/security/limits.d/ directory are		Then individual *.conf files from the /etc/security/limits.d/ directory are
read. The files are parsed one after another in the order of "C" locale. The		read. The files are parsed one after another in the order of "C" locale. The
effect of the individual files is the same as if all the files were		effect of the individual files is the same as if all the files were
concatenated together in the order of parsing. If a config file is explicitly		concatenated together in the order of parsing. If a config file is explicitly
specified with a module option then the files in the above directory are not		specified with a module option then the files in the above directory are not
parsed.		parsed.
		By default limits are taken from the /etc/security/limits.conf config file or,
		if that one is not present, the file %vendordir%/security/limits.conf. Then
		individual *.conf files from the /etc/security/limits.d/ and %vendordir%/
		security/limits.d directories are read. If /etc/security/limits.d/
		@filename@.conf exists, then %vendordir%/security/limits.d/@filename@.conf will
		not be used. All limits.d/*.conf files are sorted by their @filename@.conf in
		lexicographic order regardless of which of the directories they reside in. The
		effect of the individual files is the same as if all the files were
		concatenated together in the order of parsing. If a config file is explicitly
		specified with the config option the files in the above directories are not
		parsed.
The module must not be called by a multithreaded application.		The module must not be called by a multithreaded application.
If Linux PAM is compiled with audit support the module will report when it		If Linux PAM is compiled with audit support the module will report when it
denies access based on limit of maximum number of concurrent login sessions.		denies access based on limit of maximum number of concurrent login sessions.
6.14.2. DESCRIPTION		6.15.2. DESCRIPTION
The pam_limits.so module applies ulimit limits, nice priority and number of		The pam_limits.so module applies ulimit limits, nice priority and number of
simultaneous login sessions limit to user login sessions. This description of		simultaneous login sessions limit to user login sessions. This description of
the configuration file syntax applies to the /etc/security/limits.conf file and		the configuration file syntax applies to the /etc/security/limits.conf file and
*.conf files in the /etc/security/limits.d directory.		*.conf files in the /etc/security/limits.d directory.
The syntax of the lines is as follows:		The syntax of the lines is as follows:
<domain> <type> <item> <value>		<domain> <type> <item> <value>
skipping to change at line 2180		skipping to change at line 2423
One exception is the maxlogin option, this one is system wide. But there is a		One exception is the maxlogin option, this one is system wide. But there is a
race, concurrent logins at the same time will not always be detect as such but		race, concurrent logins at the same time will not always be detect as such but
only counted as one.		only counted as one.
In the limits configuration file, the '#' character introduces a comment -		In the limits configuration file, the '#' character introduces a comment -
after which the rest of the line is ignored.		after which the rest of the line is ignored.
The pam_limits module does report configuration problems found in its		The pam_limits module does report configuration problems found in its
configuration file and errors via syslog(3).		configuration file and errors via syslog(3).
6.14.3. OPTIONS		6.15.3. OPTIONS
conf=/path/to/limits.conf		conf=/path/to/limits.conf
Indicate an alternative limits.conf style configuration file to override		Indicate an alternative limits.conf style configuration file to override
the default.		the default.
debug		debug
Print debug information.		Print debug information.
skipping to change at line 2210		skipping to change at line 2453
Some broken applications actually allocate a utmp entry for the user before		Some broken applications actually allocate a utmp entry for the user before
the user is admitted to the system. If some of the services you are		the user is admitted to the system. If some of the services you are
configuring PAM for do this, you can selectively use this module argument		configuring PAM for do this, you can selectively use this module argument
to compensate for this behavior and at the same time maintain system-wide		to compensate for this behavior and at the same time maintain system-wide
consistency with a single limits.conf file.		consistency with a single limits.conf file.
noaudit		noaudit
Do not report exceeded maximum logins count to the audit subsystem.		Do not report exceeded maximum logins count to the audit subsystem.
6.14.4. MODULE TYPES PROVIDED		6.15.4. MODULE TYPES PROVIDED
Only the session module type is provided.		Only the session module type is provided.
6.14.5. RETURN VALUES		6.15.5. RETURN VALUES
PAM_ABORT		PAM_ABORT
Cannot get current limits.		Cannot get current limits.
PAM_IGNORE		PAM_IGNORE
No limits found for this user.		No limits found for this user.
PAM_PERM_DENIED		PAM_PERM_DENIED
skipping to change at line 2244		skipping to change at line 2487
Error recovering account name.		Error recovering account name.
PAM_SUCCESS		PAM_SUCCESS
Limits were changed.		Limits were changed.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
The user is not known to the system.		The user is not known to the system.
6.14.6. FILES		6.15.6. FILES
/etc/security/limits.conf		/etc/security/limits.conf
Default configuration file		Default configuration file
6.14.7. EXAMPLES		%vendordir%/security/limits.conf
		Default configuration file if /etc/security/limits.conf does not exist.
		6.15.7. EXAMPLES
These are some example lines which might be specified in /etc/security/		These are some example lines which might be specified in /etc/security/
limits.conf.		limits.conf.
* soft core 0		* soft core 0
* hard nofile 512		* hard nofile 512
@student hard nproc 20		@student hard nproc 20
@faculty soft nproc 20		@faculty soft nproc 20
@faculty hard nproc 50		@faculty hard nproc 50
ftp hard nproc 0		ftp hard nproc 0
@student - maxlogins 4		@student - maxlogins 4
@student - nonewprivs 1		@student - nonewprivs 1
:123 hard cpu 5000		:123 hard cpu 5000
@500: soft cpu 10000		@500: soft cpu 10000
600:700 hard locks 10		600:700 hard locks 10
6.14.8. AUTHORS		6.15.8. AUTHORS
pam_limits was initially written by Cristian Gafton <gafton@redhat.com>		pam_limits was initially written by Cristian Gafton <gafton@redhat.com>
6.15. pam_listfile - deny or allow services based on an arbitrary file		6.16. pam_listfile - deny or allow services based on an arbitrary file
pam_listfile.so item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file		pam_listfile.so item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file
=/path/filename onerr=[succeed|fail] [ apply=[user|@group] ] [ quiet ]		=/path/filename onerr=[succeed|fail] [ apply=[user|@group] ] [ quiet ]
6.15.1. DESCRIPTION		6.16.1. DESCRIPTION
pam_listfile is a PAM module which provides a way to deny or allow services		pam_listfile is a PAM module which provides a way to deny or allow services
based on an arbitrary file.		based on an arbitrary file.
The module gets the item of the type specified -- user specifies the username,		The module gets the item of the type specified -- user specifies the username,
PAM_USER; tty specifies the name of the terminal over which the request has		PAM_USER; tty specifies the name of the terminal over which the request has
been made, PAM_TTY; rhost specifies the name of the remote host (if any) from		been made, PAM_TTY; rhost specifies the name of the remote host (if any) from
which the request was made, PAM_RHOST; and ruser specifies the name of the		which the request was made, PAM_RHOST; and ruser specifies the name of the
remote user (if available) who made the request, PAM_RUSER -- and looks for an		remote user (if available) who made the request, PAM_RUSER -- and looks for an
instance of that item in the file=filename. filename contains one line per item		instance of that item in the file=filename. filename contains one line per item
skipping to change at line 2306		skipping to change at line 2553
An additional argument, apply=, can be used to restrict the application of the		An additional argument, apply=, can be used to restrict the application of the
above to a specific user (apply=username) or a given group (apply=@groupname).		above to a specific user (apply=username) or a given group (apply=@groupname).
This added restriction is only meaningful when used with the tty, rhost and		This added restriction is only meaningful when used with the tty, rhost and
shell items.		shell items.
Besides this last one, all arguments should be specified; do not count on any		Besides this last one, all arguments should be specified; do not count on any
default behavior.		default behavior.
No credentials are awarded by this module.		No credentials are awarded by this module.
6.15.2. OPTIONS		6.16.2. OPTIONS
item=[tty|user|rhost|ruser|group|shell]		item=[tty|user|rhost|ruser|group|shell]
What is listed in the file and should be checked for.		What is listed in the file and should be checked for.
sense=[allow|deny]		sense=[allow|deny]
Action to take if found in file, if the item is NOT found in the file, then		Action to take if found in file, if the item is NOT found in the file, then
the opposite action is requested.		the opposite action is requested.
skipping to change at line 2337		skipping to change at line 2584
Restrict the user class for which the restriction apply. Note that with		Restrict the user class for which the restriction apply. Note that with
item=[user|ruser|group] this does not make sense, but for item=[tty|rhost|		item=[user|ruser|group] this does not make sense, but for item=[tty|rhost|
shell] it have a meaning.		shell] it have a meaning.
quiet		quiet
Do not treat service refusals or missing list files as errors that need to		Do not treat service refusals or missing list files as errors that need to
be logged.		be logged.
6.15.3. MODULE TYPES PROVIDED		6.16.3. MODULE TYPES PROVIDED
All module types (auth, account, password and session) are provided.		All module types (auth, account, password and session) are provided.
6.15.4. RETURN VALUES		6.16.4. RETURN VALUES
PAM_AUTH_ERR		PAM_AUTH_ERR
Authentication failure.		Authentication failure.
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
PAM_IGNORE		PAM_IGNORE
skipping to change at line 2363		skipping to change at line 2610
The rule does not apply to the apply option.		The rule does not apply to the apply option.
PAM_SERVICE_ERR		PAM_SERVICE_ERR
Error in service module.		Error in service module.
PAM_SUCCESS		PAM_SUCCESS
Success.		Success.
6.15.5. EXAMPLES		6.16.5. EXAMPLES
Classic 'ftpusers' authentication can be implemented with this entry in /etc/		Classic 'ftpusers' authentication can be implemented with this entry in /etc/
pam.d/ftpd:		pam.d/ftpd:
#		#
# deny ftp-access to users listed in the /etc/ftpusers file		# deny ftp-access to users listed in the /etc/ftpusers file
#		#
auth required pam_listfile.so \		auth required pam_listfile.so \
onerr=succeed item=user sense=deny file=/etc/ftpusers		onerr=succeed item=user sense=deny file=/etc/ftpusers
skipping to change at line 2392		skipping to change at line 2639
#		#
auth required pam_listfile.so \		auth required pam_listfile.so \
onerr=fail item=user sense=allow file=/etc/loginusers		onerr=fail item=user sense=allow file=/etc/loginusers
For this example to work, all users who are allowed to use the login service		For this example to work, all users who are allowed to use the login service
should be listed in the file /etc/loginusers. Unless you are explicitly trying		should be listed in the file /etc/loginusers. Unless you are explicitly trying
to lock out root, make sure that when you do this, you leave a way for root to		to lock out root, make sure that when you do this, you leave a way for root to
log in, either by listing root in /etc/loginusers, or by listing a user who is		log in, either by listing root in /etc/loginusers, or by listing a user who is
able to su to the root account.		able to su to the root account.
6.15.6. AUTHOR		6.16.6. AUTHOR
pam_listfile was written by Michael K. Johnson <johnsonm@redhat.com> and Elliot		pam_listfile was written by Michael K. Johnson <johnsonm@redhat.com> and Elliot
Lee <sopwith@cuc.edu>.		Lee <sopwith@cuc.edu>.
6.16. pam_localuser - require users to be listed in /etc/passwd		6.17. pam_localuser - require users to be listed in /etc/passwd
pam_localuser.so [ debug ] [ file=/path/passwd ]		pam_localuser.so [ debug ] [ file=/path/passwd ]
6.16.1. DESCRIPTION		6.17.1. DESCRIPTION
pam_localuser is a PAM module to help implementing site-wide login policies,		pam_localuser is a PAM module to help implementing site-wide login policies,
where they typically include a subset of the network's users and a few accounts		where they typically include a subset of the network's users and a few accounts
that are local to a particular workstation. Using pam_localuser and pam_wheel		that are local to a particular workstation. Using pam_localuser and pam_wheel
or pam_listfile is an effective way to restrict access to either local users		or pam_listfile is an effective way to restrict access to either local users
and/or a subset of the network's users.		and/or a subset of the network's users.
This could also be implemented using pam_listfile.so and a very short awk		This could also be implemented using pam_listfile.so and a very short awk
script invoked by cron, but it's common enough to have been separated out.		script invoked by cron, but it's common enough to have been separated out.
6.16.2. OPTIONS		6.17.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
file=/path/passwd		file=/path/passwd
Use a file other than /etc/passwd.		Use a file other than /etc/passwd.
6.16.3. MODULE TYPES PROVIDED		6.17.3. MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.		All module types (account, auth, password and session) are provided.
6.16.4. RETURN VALUES		6.17.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
The new localuser was set successfully.		The new localuser was set successfully.
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
PAM_CONV_ERR		PAM_CONV_ERR
skipping to change at line 2454		skipping to change at line 2701
PAM_CONV_AGAIN.		PAM_CONV_AGAIN.
PAM_SERVICE_ERR		PAM_SERVICE_ERR
The user name is not valid or the passwd file is unavailable.		The user name is not valid or the passwd file is unavailable.
PAM_PERM_DENIED		PAM_PERM_DENIED
The user is not listed in the passwd file.		The user is not listed in the passwd file.
6.16.5. EXAMPLES		6.17.5. EXAMPLES
Add the following lines to /etc/pam.d/su to allow only local users or group		Add the following lines to /etc/pam.d/su to allow only local users or group
wheel to use su.		wheel to use su.
account sufficient pam_localuser.so		account sufficient pam_localuser.so
account required pam_wheel.so		account required pam_wheel.so
6.16.6. AUTHOR		6.17.6. AUTHOR
pam_localuser was written by Nalin Dahyabhai <nalin@redhat.com>.		pam_localuser was written by Nalin Dahyabhai <nalin@redhat.com>.
6.17. pam_loginuid - record user's login uid to the process attribute		6.18. pam_loginuid - record user's login uid to the process attribute
pam_loginuid.so [ require_auditd ]		pam_loginuid.so [ require_auditd ]
6.17.1. DESCRIPTION		6.18.1. DESCRIPTION
The pam_loginuid module sets the loginuid process attribute for the process		The pam_loginuid module sets the loginuid process attribute for the process
that was authenticated. This is necessary for applications to be correctly		that was authenticated. This is necessary for applications to be correctly
audited. This PAM module should only be used for entry point applications like:		audited. This PAM module should only be used for entry point applications like:
login, sshd, gdm, vsftpd, crond and atd. There are probably other entry point		login, sshd, gdm, vsftpd, crond and atd. There are probably other entry point
applications besides these. You should not use it for applications like sudo or		applications besides these. You should not use it for applications like sudo or
su as that defeats the purpose by changing the loginuid to the account they		su as that defeats the purpose by changing the loginuid to the account they
just switched to.		just switched to.
6.17.2. OPTIONS		6.18.2. OPTIONS
require_auditd		require_auditd
This option, when given, will cause this module to query the audit daemon		This option, when given, will cause this module to query the audit daemon
status and deny logins if it is not running.		status and deny logins if it is not running.
6.17.3. MODULE TYPES PROVIDED		6.18.3. MODULE TYPES PROVIDED
Only the session module type is provided.		Only the session module type is provided.
6.17.4. RETURN VALUES		6.18.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
The loginuid value is set and auditd is running if check requested.		The loginuid value is set and auditd is running if check requested.
PAM_IGNORE		PAM_IGNORE
The /proc/self/loginuid file is not present on the system or the login		The /proc/self/loginuid file is not present on the system or the login
process runs inside uid namespace and kernel does not support overwriting		process runs inside uid namespace and kernel does not support overwriting
loginuid.		loginuid.
PAM_SESSION_ERR		PAM_SESSION_ERR
Any other error prevented setting loginuid or auditd is not running.		Any other error prevented setting loginuid or auditd is not running.
6.17.5. EXAMPLES		6.18.5. EXAMPLES
#%PAM-1.0		#%PAM-1.0
auth required pam_unix.so		auth required pam_unix.so
auth required pam_nologin.so		auth required pam_nologin.so
account required pam_unix.so		account required pam_unix.so
password required pam_unix.so		password required pam_unix.so
session required pam_unix.so		session required pam_unix.so
session required pam_loginuid.so		session required pam_loginuid.so
6.17.6. AUTHOR		6.18.6. AUTHOR
pam_loginuid was written by Steve Grubb <sgrubb@redhat.com>		pam_loginuid was written by Steve Grubb <sgrubb@redhat.com>
6.18. pam_mail - inform about available mail		6.19. pam_mail - inform about available mail
pam_mail.so [ close ] [ debug ] [ dir=maildir ] [ empty ] [ hash=count ] [		pam_mail.so [ close ] [ debug ] [ dir=maildir ] [ empty ] [ hash=count ] [
noenv ] [ nopen ] [ quiet ] [ standard ]		noenv ] [ nopen ] [ quiet ] [ standard ]
6.18.1. DESCRIPTION		6.19.1. DESCRIPTION
The pam_mail PAM module provides the "you have new mail" service to the user.		The pam_mail PAM module provides the "you have new mail" service to the user.
It can be plugged into any application that has credential or session hooks. It		It can be plugged into any application that has credential or session hooks. It
gives a single message indicating the newness of any mail it finds in the		gives a single message indicating the newness of any mail it finds in the
user's mail folder. This module also sets the PAM environment variable, MAIL,		user's mail folder. This module also sets the PAM environment variable, MAIL,
to the user's mail directory.		to the user's mail directory.
If the mail spool file (be it /var/mail/$USER or a pathname given with the dir=		If the mail spool file (be it /var/mail/$USER or a pathname given with the dir=
parameter) is a directory then pam_mail assumes it is in the Maildir format.		parameter) is a directory then pam_mail assumes it is in the Maildir format.
6.18.2. OPTIONS		6.19.2. OPTIONS
close		close
Indicate if the user has any mail also on logout.		Indicate if the user has any mail also on logout.
debug		debug
Print debug information.		Print debug information.
dir=maildir		dir=maildir
skipping to change at line 2581		skipping to change at line 2828
quiet		quiet
Only report when there is new mail.		Only report when there is new mail.
standard		standard
Old style "You have..." format which doesn't show the mail spool being		Old style "You have..." format which doesn't show the mail spool being
used. This also implies "empty".		used. This also implies "empty".
6.18.3. MODULE TYPES PROVIDED		6.19.3. MODULE TYPES PROVIDED
The session and auth (on establishment and deletion of credentials) module		The session and auth (on establishment and deletion of credentials) module
types are provided.		types are provided.
6.18.4. RETURN VALUES		6.19.4. RETURN VALUES
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
PAM_SERVICE_ERR		PAM_SERVICE_ERR
Badly formed arguments.		Badly formed arguments.
PAM_SUCCESS		PAM_SUCCESS
Success.		Success.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User not known.		User not known.
6.18.5. EXAMPLES		6.19.5. EXAMPLES
Add the following line to /etc/pam.d/login to indicate that the user has new		Add the following line to /etc/pam.d/login to indicate that the user has new
mail when they login to the system.		mail when they login to the system.
session optional pam_mail.so standard		session optional pam_mail.so standard
6.18.6. AUTHOR		6.19.6. AUTHOR
pam_mail was written by Andrew G. Morgan <morgan@kernel.org>.		pam_mail was written by Andrew G. Morgan <morgan@kernel.org>.
6.19. pam_mkhomedir - create users home directory		6.20. pam_mkhomedir - create users home directory
pam_mkhomedir.so [ silent ] [ debug ] [ umask=mode ] [ skel=skeldir ]		pam_mkhomedir.so [ silent ] [ debug ] [ umask=mode ] [ skel=skeldir ]
6.19.1. DESCRIPTION		6.20.1. DESCRIPTION
The pam_mkhomedir PAM module will create a users home directory if it does not		The pam_mkhomedir PAM module will create a users home directory if it does not
exist when the session begins. This allows users to be present in central		exist when the session begins. This allows users to be present in central
database (such as NIS, kerberos or LDAP) without using a distributed file		database (such as NIS, kerberos or LDAP) without using a distributed file
system or pre-creating a large number of directories. The skeleton directory		system or pre-creating a large number of directories. The skeleton directory
(usually /etc/skel/) is used to copy default files and also sets a umask for		(usually /etc/skel/) is used to copy default files and also sets a umask for
the creation.		the creation.
The new users home directory will not be removed after logout of the user.		The new users home directory will not be removed after logout of the user.
6.19.2. OPTIONS		6.20.2. OPTIONS
silent		silent
Don't print informative messages.		Don't print informative messages.
debug		debug
Turns on debugging via syslog(3).		Turns on debugging via syslog(3).
umask=mask		umask=mask
skipping to change at line 2653		skipping to change at line 2900
0022. If this option is not specified, then the permissions of created user		0022. If this option is not specified, then the permissions of created user
home directory is set to the value of HOME_MODE configuration item from /		home directory is set to the value of HOME_MODE configuration item from /
etc/login.defs. If there is no such configuration item then the value is		etc/login.defs. If there is no such configuration item then the value is
computed from the value of UMASK in the same file. If there is no such		computed from the value of UMASK in the same file. If there is no such
configuration option either the default value of 0755 is used for the mode.		configuration option either the default value of 0755 is used for the mode.
skel=/path/to/skel/directory		skel=/path/to/skel/directory
Indicate an alternative skel directory to override the default /etc/skel.		Indicate an alternative skel directory to override the default /etc/skel.
6.19.3. MODULE TYPES PROVIDED		6.20.3. MODULE TYPES PROVIDED
Only the session module type is provided.		Only the session module type is provided.
6.19.4. RETURN VALUES		6.20.4. RETURN VALUES
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
PAM_PERM_DENIED		PAM_PERM_DENIED
Not enough permissions to create the new directory or read the skel		Not enough permissions to create the new directory or read the skel
directory.		directory.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User not known to the underlying authentication module.		User not known to the underlying authentication module.
PAM_SUCCESS		PAM_SUCCESS
Environment variables were set.		Environment variables were set.
6.19.5. EXAMPLES		6.20.5. EXAMPLES
A sample /etc/pam.d/login file:		A sample /etc/pam.d/login file:
auth requisite pam_securetty.so		auth requisite pam_securetty.so
auth sufficient pam_ldap.so		auth sufficient pam_ldap.so
auth required pam_unix.so		auth required pam_unix.so
auth required pam_nologin.so		auth required pam_nologin.so
account sufficient pam_ldap.so		account sufficient pam_ldap.so
account required pam_unix.so		account required pam_unix.so
password required pam_unix.so		password required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022		session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session required pam_unix.so		session required pam_unix.so
session optional pam_lastlog.so		session optional pam_lastlog.so
session optional pam_mail.so standard		session optional pam_mail.so standard
6.19.6. AUTHOR		6.20.6. AUTHOR
pam_mkhomedir was written by Jason Gunthorpe <jgg@debian.org>.		pam_mkhomedir was written by Jason Gunthorpe <jgg@debian.org>.
6.20. pam_motd - display the motd file		6.21. pam_motd - display the motd file
pam_motd.so [ motd=/path/filename ] [ motd_dir=/path/dirname.d ]		pam_motd.so [ motd=/path/filename ] [ motd_dir=/path/dirname.d ]
6.20.1. DESCRIPTION		6.21.1. DESCRIPTION
pam_motd is a PAM module that can be used to display arbitrary motd (message of		pam_motd is a PAM module that can be used to display arbitrary motd (message of
the day) files after a successful login. By default, pam_motd shows files in		the day) files after a successful login. By default, pam_motd shows files in
the following locations:		the following locations:
/etc/motd		/etc/motd
/run/motd		/run/motd
/usr/lib/motd		/usr/lib/motd
/etc/motd.d/		/etc/motd.d/
/run/motd.d/		/run/motd.d/
skipping to change at line 2735		skipping to change at line 2982
To silence a message, a symbolic link with target /dev/null may be placed in /		To silence a message, a symbolic link with target /dev/null may be placed in /
etc/motd.d with the same filename as the message to be silenced. Example:		etc/motd.d with the same filename as the message to be silenced. Example:
Creating a symbolic link as follows silences /usr/lib/motd.d/my_motd.		Creating a symbolic link as follows silences /usr/lib/motd.d/my_motd.
ln -s /dev/null /etc/motd.d/my_motd		ln -s /dev/null /etc/motd.d/my_motd
The MOTD_SHOWN=pam environment variable is set after showing the motd files,		The MOTD_SHOWN=pam environment variable is set after showing the motd files,
even when all of them were silenced using symbolic links.		even when all of them were silenced using symbolic links.
6.20.2. OPTIONS		6.21.2. OPTIONS
motd=/path/filename		motd=/path/filename
The /path/filename file is displayed as message of the day. Multiple paths		The /path/filename file is displayed as message of the day. Multiple paths
to try can be specified as a colon-separated list. By default this option		to try can be specified as a colon-separated list. By default this option
is set to /etc/motd:/run/motd:/usr/lib/motd.		is set to /etc/motd:/run/motd:/usr/lib/motd.
motd_dir=/path/dirname.d		motd_dir=/path/dirname.d
The /path/dirname.d directory is scanned and each file contained inside of		The /path/dirname.d directory is scanned and each file contained inside of
it is displayed. Multiple directories to scan can be specified as a		it is displayed. Multiple directories to scan can be specified as a
colon-separated list. By default this option is set to /etc/motd.d:/run/		colon-separated list. By default this option is set to /etc/motd.d:/run/
motd.d:/usr/lib/motd.d.		motd.d:/usr/lib/motd.d.
When no options are given, the default behavior applies for both options.		When no options are given, the default behavior applies for both options.
Specifying either option (or both) will disable the default behavior for both		Specifying either option (or both) will disable the default behavior for both
options.		options.
6.20.3. MODULE TYPES PROVIDED		6.21.3. MODULE TYPES PROVIDED
Only the session module type is provided.		Only the session module type is provided.
6.20.4. RETURN VALUES		6.21.4. RETURN VALUES
PAM_ABORT		PAM_ABORT
Not all relevant data or options could be obtained.		Not all relevant data or options could be obtained.
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
PAM_IGNORE		PAM_IGNORE
This is the default return value of this module.		This is the default return value of this module.
6.20.5. EXAMPLES		6.21.5. EXAMPLES
The suggested usage for /etc/pam.d/login is:		The suggested usage for /etc/pam.d/login is:
session optional pam_motd.so		session optional pam_motd.so
To use a motd file from a different location:		To use a motd file from a different location:
session optional pam_motd.so motd=/elsewhere/motd		session optional pam_motd.so motd=/elsewhere/motd
To use a motd file from elsewhere, along with a corresponding .d directory:		To use a motd file from elsewhere, along with a corresponding .d directory:
session optional pam_motd.so motd=/elsewhere/motd motd_dir=/elsewhere/motd.d		session optional pam_motd.so motd=/elsewhere/motd motd_dir=/elsewhere/motd.d
6.20.6. AUTHOR		6.21.6. AUTHOR
pam_motd was written by Ben Collins <bcollins@debian.org>.		pam_motd was written by Ben Collins <bcollins@debian.org>.
The motd_dir= option was added by Allison Karlitskaya		The motd_dir= option was added by Allison Karlitskaya
<allison.karlitskaya@redhat.com>.		<allison.karlitskaya@redhat.com>.
6.21. pam_namespace - setup a private namespace		6.22. pam_namespace - setup a private namespace
pam_namespace.so [ debug ] [ unmnt_remnt ] [ unmnt_only ] [ require_selinux ] [		pam_namespace.so [ debug ] [ unmnt_remnt ] [ unmnt_only ] [ require_selinux ] [
gen_hash ] [ ignore_config_error ] [ ignore_instance_parent_mode ] [		gen_hash ] [ ignore_config_error ] [ ignore_instance_parent_mode ] [
unmount_on_close ] [ use_current_context ] [ use_default_context ] [		unmount_on_close ] [ use_current_context ] [ use_default_context ] [
mount_private ]		mount_private ]
6.21.1. DESCRIPTION		6.22.1. DESCRIPTION
The pam_namespace PAM module sets up a private namespace for a session with		The pam_namespace PAM module sets up a private namespace for a session with
polyinstantiated directories. A polyinstantiated directory provides a different		polyinstantiated directories. A polyinstantiated directory provides a different
instance of itself based on user name, or when using SELinux, user name,		instance of itself based on user name, or when using SELinux, user name,
security context or both. If an executable script /etc/security/namespace.init		security context or both. If an executable script /etc/security/namespace.init
exists, it is used to initialize the instance directory after it is set up and		exists, it is used to initialize the instance directory after it is set up and
mounted on the polyinstantiated directory. The script receives the		mounted on the polyinstantiated directory. The script receives the
polyinstantiated directory path, the instance directory path, flag whether the		polyinstantiated directory path, the instance directory path, flag whether the
instance directory was newly created (0 for no, 1 for yes), and the user name		instance directory was newly created (0 for no, 1 for yes), and the user name
as its arguments.		as its arguments.
		If /etc/security/namespace.init does not exist, %vendordir%/security/
		namespace.init is the alternative to be used for it.
The pam_namespace module disassociates the session namespace from the parent		The pam_namespace module disassociates the session namespace from the parent
namespace. Any mounts/unmounts performed in the parent namespace, such as		namespace. Any mounts/unmounts performed in the parent namespace, such as
mounting of devices, are not reflected in the session namespace. To propagate		mounting of devices, are not reflected in the session namespace. To propagate
selected mount/unmount events from the parent namespace into the disassociated		selected mount/unmount events from the parent namespace into the disassociated
session namespace, an administrator may use the special shared-subtree feature.		session namespace, an administrator may use the special shared-subtree feature.
For additional information on shared-subtree feature, please refer to the mount		For additional information on shared-subtree feature, please refer to the mount
(8) man page and the shared-subtree description at http://lwn.net/Articles/		(8) man page and the shared-subtree description at http://lwn.net/Articles/
159077 and http://lwn.net/Articles/159092.		159077 and http://lwn.net/Articles/159092.
6.21.2. DESCRIPTION		6.22.2. DESCRIPTION
The pam_namespace.so module allows setup of private namespaces with		The pam_namespace.so module allows setup of private namespaces with
polyinstantiated directories. Directories can be polyinstantiated based on user		polyinstantiated directories. Directories can be polyinstantiated based on user
name or, in the case of SELinux, user name, sensitivity level or complete		name or, in the case of SELinux, user name, sensitivity level or complete
security context. If an executable script /etc/security/namespace.init exists,		security context. If an executable script /etc/security/namespace.init exists,
it is used to initialize the namespace every time an instance directory is set		it is used to initialize the namespace every time an instance directory is set
up and mounted. The script receives the polyinstantiated directory path and the		up and mounted. The script receives the polyinstantiated directory path and the
instance directory path as its arguments.		instance directory path as its arguments.
The /etc/security/namespace.conf file specifies which directories are		The /etc/security/namespace.conf file specifies which directories are
polyinstantiated, how they are polyinstantiated, how instance directories would		polyinstantiated, how they are polyinstantiated, how instance directories would
be named, and any users for whom polyinstantiation would not be performed.		be named, and any users for whom polyinstantiation would not be performed.
		The /etc/security/namespace.conf file ( or %vendordir%/security/namespace.conf
		if it does not exist) specifies which directories are polyinstantiated, how
		they are polyinstantiated, how instance directories would be named, and any
		users for whom polyinstantiation would not be performed. Then individual *.conf
		files from the /etc/security/namespace.d/ and %vendordir%/security/namespace.d
		directories are taken too. If /etc/security/namespace.d/@filename@.conf exists,
		then %vendordir%/security/namespace.d/@filename@.conf will not be used. All
		namespace.d/*.conf files are sorted by their @filename@.conf in lexicographic
		order regardless of which of the directories they reside in.
When someone logs in, the file namespace.conf is scanned. Comments are marked		When someone logs in, the file namespace.conf is scanned. Comments are marked
by # characters. Each non comment line represents one polyinstantiated		by # characters. Each non comment line represents one polyinstantiated
directory. The fields are separated by spaces but can be quoted by " characters		directory. The fields are separated by spaces but can be quoted by " characters
also escape sequences \b, \n, and \t are recognized. The fields are as follows:		also escape sequences \b, \n, and \t are recognized. The fields are as follows:
polydir instance_prefix method list_of_uids		polydir instance_prefix method list_of_uids
The first field, polydir, is the absolute pathname of the directory to		The first field, polydir, is the absolute pathname of the directory to
polyinstantiate. The special string $HOME is replaced with the user's home		polyinstantiate. The special string $HOME is replaced with the user's home
directory, and $USER with the username. This field cannot be blank.		directory, and $USER with the username. This field cannot be blank.
skipping to change at line 2909		skipping to change at line 3169
obtained by getexeccon. This context must be set by the calling application or		obtained by getexeccon. This context must be set by the calling application or
pam_selinux.so module. If this context is not set the polyinstatiation will be		pam_selinux.so module. If this context is not set the polyinstatiation will be
based just on user name.		based just on user name.
The "instance differentiation string" is <user name> for "user" method and		The "instance differentiation string" is <user name> for "user" method and
<user name>_<raw directory context> for "context" and "level" methods. If the		<user name>_<raw directory context> for "context" and "level" methods. If the
whole string is too long the end of it is replaced with md5sum of itself. Also		whole string is too long the end of it is replaced with md5sum of itself. Also
when command line option gen_hash is used the whole string is replaced with		when command line option gen_hash is used the whole string is replaced with
md5sum of itself.		md5sum of itself.
6.21.3. OPTIONS		6.22.3. OPTIONS
debug		debug
A lot of debug information is logged using syslog		A lot of debug information is logged using syslog
unmnt_remnt		unmnt_remnt
For programs such as su and newrole, the login session has already setup a		For programs such as su and newrole, the login session has already setup a
polyinstantiated namespace. For these programs, polyinstantiation is		polyinstantiated namespace. For these programs, polyinstantiation is
performed based on new user id or security context, however the command		performed based on new user id or security context, however the command
skipping to change at line 2989		skipping to change at line 3249
module will mark the whole directory tree so any mount and unmount		module will mark the whole directory tree so any mount and unmount
operations in the polyinstantiation namespace are private. Normally the		operations in the polyinstantiation namespace are private. Normally the
pam_namespace will try to detect the shared / mount point and make the		pam_namespace will try to detect the shared / mount point and make the
polyinstantiated directories private automatically. This option has to be		polyinstantiated directories private automatically. This option has to be
used just when only a subtree is shared and / is not.		used just when only a subtree is shared and / is not.
Note that mounts and unmounts done in the private namespace will not affect		Note that mounts and unmounts done in the private namespace will not affect
the parent namespace if this option is used or when the shared / mount		the parent namespace if this option is used or when the shared / mount
point is autodetected.		point is autodetected.
6.21.4. MODULE TYPES PROVIDED		6.22.4. MODULE TYPES PROVIDED
Only the session module type is provided. The module must not be called from		Only the session module type is provided. The module must not be called from
multithreaded processes.		multithreaded processes.
6.21.5. RETURN VALUES		6.22.5. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
Namespace setup was successful.		Namespace setup was successful.
PAM_SERVICE_ERR		PAM_SERVICE_ERR
Unexpected system error occurred while setting up namespace.		Unexpected system error occurred while setting up namespace.
PAM_SESSION_ERR		PAM_SESSION_ERR
Unexpected namespace configuration error occurred.		Unexpected namespace configuration error occurred.
6.21.6. FILES		6.22.6. FILES
/etc/security/namespace.conf		/etc/security/namespace.conf
Main configuration file		Main configuration file
		%vendordir%/security/namespace.conf
		Default configuration file if /etc/security/namespace.conf does not exist.
/etc/security/namespace.d		/etc/security/namespace.d
Directory for additional configuration files		Directory for additional configuration files
		%vendordir%/security/namespace.d
		Directory for additional vendor specific configuration files.
/etc/security/namespace.init		/etc/security/namespace.init
Init script for instance directories		Init script for instance directories
6.21.7. EXAMPLES		%vendordir%/security/namespace.init
		Vendor init script for instance directories if /etc/security/namespace.init
		does not exist.
		6.22.7. EXAMPLES
These are some example lines which might be specified in /etc/security/		These are some example lines which might be specified in /etc/security/
namespace.conf.		namespace.conf.
# The following three lines will polyinstantiate /tmp,		# The following three lines will polyinstantiate /tmp,
# /var/tmp and user's home directories. /tmp and /var/tmp		# /var/tmp and user's home directories. /tmp and /var/tmp
# will be polyinstantiated based on the security level		# will be polyinstantiated based on the security level
# as well as user name, whereas home directory will be		# as well as user name, whereas home directory will be
# polyinstantiated based on the full security context and user name.		# polyinstantiated based on the full security context and user name.
# Polyinstantiation will not be performed for user root		# Polyinstantiation will not be performed for user root
skipping to change at line 3055		skipping to change at line 3328
$HOME    $HOME/$USER.inst/inst- context		$HOME    $HOME/$USER.inst/inst- context
For the <service>s you need polyinstantiation (login for example) put the		For the <service>s you need polyinstantiation (login for example) put the
following line in /etc/pam.d/<service> as the last line for session group:		following line in /etc/pam.d/<service> as the last line for session group:
session required pam_namespace.so [arguments]		session required pam_namespace.so [arguments]
This module also depends on pam_selinux.so setting the context.		This module also depends on pam_selinux.so setting the context.
6.21.8. AUTHORS		6.22.8. AUTHORS
The namespace setup scheme was designed by Stephen Smalley, Janak Desai and		The namespace setup scheme was designed by Stephen Smalley, Janak Desai and
Chad Sellers. The pam_namespace PAM module was developed by Janak Desai		Chad Sellers. The pam_namespace PAM module was developed by Janak Desai
<janak@us.ibm.com>, Chad Sellers <csellers@tresys.com> and Steve Grubb		<janak@us.ibm.com>, Chad Sellers <csellers@tresys.com> and Steve Grubb
<sgrubb@redhat.com>. Additional improvements by Xavier Toth <txtoth@gmail.com>		<sgrubb@redhat.com>. Additional improvements by Xavier Toth <txtoth@gmail.com>
and Tomas Mraz <tmraz@redhat.com>.		and Tomas Mraz <tmraz@redhat.com>.
6.22. pam_nologin - prevent non-root users from login		6.23. pam_nologin - prevent non-root users from login
pam_nologin.so [ file=/path/nologin ] [ successok ]		pam_nologin.so [ file=/path/nologin ] [ successok ]
6.22.1. DESCRIPTION		6.23.1. DESCRIPTION
pam_nologin is a PAM module that prevents users from logging into the system		pam_nologin is a PAM module that prevents users from logging into the system
when /var/run/nologin or /etc/nologin exists. The contents of the file are		when /var/run/nologin or /etc/nologin exists. The contents of the file are
displayed to the user. The pam_nologin module has no effect on the root user's		displayed to the user. The pam_nologin module has no effect on the root user's
ability to log in.		ability to log in.
6.22.2. OPTIONS		6.23.2. OPTIONS
file=/path/nologin		file=/path/nologin
Use this file instead the default /var/run/nologin or /etc/nologin.		Use this file instead the default /var/run/nologin or /etc/nologin.
successok		successok
Return PAM_SUCCESS if no file exists, the default is PAM_IGNORE.		Return PAM_SUCCESS if no file exists, the default is PAM_IGNORE.
6.22.3. MODULE TYPES PROVIDED		6.23.3. MODULE TYPES PROVIDED
The auth and account module types are provided.		The auth and account module types are provided.
6.22.4. RETURN VALUES		6.23.4. RETURN VALUES
PAM_AUTH_ERR		PAM_AUTH_ERR
The user is not root and /etc/nologin exists, so the user is not permitted		The user is not root and /etc/nologin exists, so the user is not permitted
to log in.		to log in.
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
skipping to change at line 3111		skipping to change at line 3384
This is the default return value.		This is the default return value.
PAM_SUCCESS		PAM_SUCCESS
Success: either the user is root or the nologin file does not exist.		Success: either the user is root or the nologin file does not exist.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User not known to the underlying authentication module.		User not known to the underlying authentication module.
6.22.5. EXAMPLES		6.23.5. EXAMPLES
The suggested usage for /etc/pam.d/login is:		The suggested usage for /etc/pam.d/login is:
auth required pam_nologin.so		auth required pam_nologin.so
6.22.6. AUTHOR		6.23.6. AUTHOR
pam_nologin was written by Michael K. Johnson <johnsonm@redhat.com>.		pam_nologin was written by Michael K. Johnson <johnsonm@redhat.com>.
6.23. pam_permit - the promiscuous module		6.24. pam_permit - the promiscuous module
pam_permit.so		pam_permit.so
6.23.1. DESCRIPTION		6.24.1. DESCRIPTION
pam_permit is a PAM module that always permit access. It does nothing else.		pam_permit is a PAM module that always permit access. It does nothing else.
In the case of authentication, the user's name will be set to nobody if the		In the case of authentication, the user's name will be set to nobody if the
application didn't set one. Many applications and PAM modules become confused		application didn't set one. Many applications and PAM modules become confused
if this name is unknown.		if this name is unknown.
This module is very dangerous. It should be used with extreme caution.		This module is very dangerous. It should be used with extreme caution.
6.23.2. OPTIONS		6.24.2. OPTIONS
This module does not recognise any options.		This module does not recognise any options.
6.23.3. MODULE TYPES PROVIDED		6.24.3. MODULE TYPES PROVIDED
The auth, account, password and session module types are provided.		The auth, account, password and session module types are provided.
6.23.4. RETURN VALUES		6.24.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
This module always returns this value.		This module always returns this value.
6.23.5. EXAMPLES		6.24.5. EXAMPLES
Add this line to your other login entries to disable account management, but		Add this line to your other login entries to disable account management, but
continue to permit users to log in.		continue to permit users to log in.
account required pam_permit.so		account required pam_permit.so
6.23.6. AUTHOR		6.24.6. AUTHOR
pam_permit was written by Andrew G. Morgan, <morgan@kernel.org>.		pam_permit was written by Andrew G. Morgan, <morgan@kernel.org>.
6.24. pam_pwhistory - grant access using .pwhistory file		6.25. pam_pwhistory - grant access using .pwhistory file
pam_pwhistory.so [ debug ] [ use_authtok ] [ enforce_for_root ] [ remember=N ]		pam_pwhistory.so [ debug ] [ use_authtok ] [ enforce_for_root ] [ remember=N ]
[ retry=N ] [ authtok_type=STRING ]		[ retry=N ] [ authtok_type=STRING ] [ file=/path/filename ] [ conf=/path/to/
		config-file ]
6.24.1. DESCRIPTION		6.25.1. DESCRIPTION
This module saves the last passwords for each user in order to force password		This module saves the last passwords for each user in order to force password
change history and keep the user from alternating between the same password too		change history and keep the user from alternating between the same password too
frequently.		frequently.
This module does not work together with kerberos. In general, it does not make		This module does not work together with kerberos. In general, it does not make
much sense to use this module in conjunction with NIS or LDAP, since the old		much sense to use this module in conjunction with NIS or LDAP, since the old
passwords are stored on the local machine and are not available on another		passwords are stored on the local machine and are not available on another
machine for password history checking.		machine for password history checking.
6.24.2. OPTIONS		6.25.2. OPTIONS
debug		debug
Turns on debugging via syslog(3).		Turns on debugging via syslog(3).
use_authtok		use_authtok
When password changing enforce the module to use the new password provided		When password changing enforce the module to use the new password provided
by a previously stacked password module (this is used in the example of the		by a previously stacked password module (this is used in the example of the
stacking of the pam_passwdqc module documented below).		stacking of the pam_passwdqc module documented below).
enforce_for_root		enforce_for_root
If this option is set, the check is enforced for root, too.		If this option is set, the check is enforced for root, too.
remember=N		remember=N
The last N passwords for each user are saved in /etc/security/opasswd. The		The last N passwords for each user are saved. The default is 10. Value of 0
default is 10. Value of 0 makes the module to keep the existing contents of		makes the module to keep the existing contents of the opasswd file
the opasswd file unchanged.		unchanged.
retry=N		retry=N
Prompt user at most N times before returning with error. The default is 1.		Prompt user at most N times before returning with error. The default is 1.
authtok_type=STRING		authtok_type=STRING
See pam_get_authtok(3) for more details.		See pam_get_authtok(3) for more details.
6.24.3. MODULE TYPES PROVIDED		file=/path/filename
		Store password history in file /path/filename rather than the default
		location. The default location is /etc/security/opasswd.
		conf=/path/to/config-file
		Use another configuration file instead of the default /etc/security/
		pwhistory.conf.
		The options for configuring the module behavior are described in the
		pwhistory.conf(5) manual page. The options specified on the module command line
		override the values from the configuration file.
		6.25.3. MODULE TYPES PROVIDED
Only the password module type is provided.		Only the password module type is provided.
6.24.4. RETURN VALUES		6.25.4. RETURN VALUES
PAM_AUTHTOK_ERR		PAM_AUTHTOK_ERR
No new password was entered, the user aborted password change or new		No new password was entered, the user aborted password change or new
password couldn't be set.		password couldn't be set.
PAM_IGNORE		PAM_IGNORE
Password history was disabled.		Password history was disabled.
PAM_MAXTRIES		PAM_MAXTRIES
Password was rejected too often.		Password was rejected too often.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User is not known to system.		User is not known to system.
6.24.5. FILES		6.25.5. FILES
/etc/security/opasswd		/etc/security/opasswd
File with password history		Default file with password history
		/etc/security/pwhistory.conf
		Config file for pam_pwhistory options
		%vendordir%/security/pwhistory.conf
		Config file for pam_pwhistory options. It will be used if /etc/security/
		pwhistory.conf does not exist.
6.24.6. EXAMPLES		6.25.6. EXAMPLES
An example password section would be:		An example password section would be:
#%PAM-1.0		#%PAM-1.0
password required pam_pwhistory.so		password required pam_pwhistory.so
password required pam_unix.so use_authtok		password required pam_unix.so use_authtok
In combination with pam_passwdqc:		In combination with pam_passwdqc:
#%PAM-1.0		#%PAM-1.0
password required pam_passwdqc.so config=/etc/passwdqc.conf		password required pam_passwdqc.so config=/etc/passwdqc.conf
password required pam_pwhistory.so use_authtok		password required pam_pwhistory.so use_authtok
password required pam_unix.so use_authtok		password required pam_unix.so use_authtok
6.24.7. AUTHOR		6.25.7. AUTHOR
pam_pwhistory was written by Thorsten Kukuk <kukuk@thkukuk.de>		pam_pwhistory was written by Thorsten Kukuk <kukuk@thkukuk.de>
6.25. pam_rhosts - grant access using .rhosts file		6.26. pam_rhosts - grant access using .rhosts file
pam_rhosts.so		pam_rhosts.so
6.25.1. DESCRIPTION		6.26.1. DESCRIPTION
This module performs the standard network authentication for services, as used		This module performs the standard network authentication for services, as used
by traditional implementations of rlogin and rsh etc.		by traditional implementations of rlogin and rsh etc.
The authentication mechanism of this module is based on the contents of two		The authentication mechanism of this module is based on the contents of two
files; /etc/hosts.equiv (or and ~/.rhosts. Firstly, hosts listed in the former		files; /etc/hosts.equiv (or and ~/.rhosts. Firstly, hosts listed in the former
file are treated as equivalent to the localhost. Secondly, entries in the		file are treated as equivalent to the localhost. Secondly, entries in the
user's own copy of the latter file is used to map "remote-host remote-user"		user's own copy of the latter file is used to map "remote-host remote-user"
pairs to that user's account on the current host. Access is granted to the user		pairs to that user's account on the current host. Access is granted to the user
if their host is present in /etc/hosts.equiv and their remote account is		if their host is present in /etc/hosts.equiv and their remote account is
identical to their local one, or if their remote account has an entry in their		identical to their local one, or if their remote account has an entry in their
personal configuration file.		personal configuration file.
The module authenticates a remote user (internally specified by the item		The module authenticates a remote user (internally specified by the item
PAM_RUSER connecting from the remote host (internally specified by the item		PAM_RUSER connecting from the remote host (internally specified by the item
PAM_RHOST). Accordingly, for applications to be compatible this authentication		PAM_RHOST). Accordingly, for applications to be compatible this authentication
module they must set these items prior to calling pam_authenticate(). The		module they must set these items prior to calling pam_authenticate(). The
module is not capable of independently probing the network connection for such		module is not capable of independently probing the network connection for such
information.		information.
6.25.2. OPTIONS		6.26.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
silent		silent
Don't print informative messages.		Don't print informative messages.
superuser=account		superuser=account
Handle account as root.		Handle account as root.
6.25.3. MODULE TYPES PROVIDED		6.26.3. MODULE TYPES PROVIDED
Only the auth module type is provided.		Only the auth module type is provided.
6.25.4. RETURN VALUES		6.26.4. RETURN VALUES
PAM_AUTH_ERR		PAM_AUTH_ERR
The remote host, remote user name or the local user name couldn't be		The remote host, remote user name or the local user name couldn't be
determined or access was denied by .rhosts file.		determined or access was denied by .rhosts file.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User is not known to system.		User is not known to system.
6.25.5. EXAMPLES		6.26.5. EXAMPLES
To grant a remote user access by /etc/hosts.equiv or .rhosts for rsh add the		To grant a remote user access by /etc/hosts.equiv or .rhosts for rsh add the
following lines to /etc/pam.d/rsh:		following lines to /etc/pam.d/rsh:
#%PAM-1.0		#%PAM-1.0
#		#
auth required pam_rhosts.so		auth required pam_rhosts.so
auth required pam_nologin.so		auth required pam_nologin.so
auth required pam_env.so		auth required pam_env.so
auth required pam_unix.so		auth required pam_unix.so
6.25.6. AUTHOR		6.26.6. AUTHOR
pam_rhosts was written by Thorsten Kukuk <kukuk@thkukuk.de>		pam_rhosts was written by Thorsten Kukuk <kukuk@thkukuk.de>
6.26. pam_rootok - gain only root access		6.27. pam_rootok - gain only root access
pam_rootok.so [ debug ]		pam_rootok.so [ debug ]
6.26.1. DESCRIPTION		6.27.1. DESCRIPTION
pam_rootok is a PAM module that authenticates the user if their UID is 0.		pam_rootok is a PAM module that authenticates the user if their UID is 0.
Applications that are created setuid-root generally retain the UID of the user		Applications that are created setuid-root generally retain the UID of the user
but run with the authority of an enhanced effective-UID. It is the real UID		but run with the authority of an enhanced effective-UID. It is the real UID
that is checked.		that is checked.
6.26.2. OPTIONS		6.27.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
6.26.3. MODULE TYPES PROVIDED		6.27.3. MODULE TYPES PROVIDED
The auth, account and password module types are provided.		The auth, account and password module types are provided.
6.26.4. RETURN VALUES		6.27.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
The UID is 0.		The UID is 0.
PAM_AUTH_ERR		PAM_AUTH_ERR
The UID is not 0.		The UID is not 0.
6.26.5. EXAMPLES		6.27.5. EXAMPLES
In the case of the su(1) application the historical usage is to permit the		In the case of the su(1) application the historical usage is to permit the
superuser to adopt the identity of a lesser user without the use of a password.		superuser to adopt the identity of a lesser user without the use of a password.
To obtain this behavior with PAM the following pair of lines are needed for the		To obtain this behavior with PAM the following pair of lines are needed for the
corresponding entry in the /etc/pam.d/su configuration file:		corresponding entry in the /etc/pam.d/su configuration file:
# su authentication. Root is granted access by default.		# su authentication. Root is granted access by default.
auth sufficient pam_rootok.so		auth sufficient pam_rootok.so
auth required pam_unix.so		auth required pam_unix.so
6.26.6. AUTHOR		6.27.6. AUTHOR
pam_rootok was written by Andrew G. Morgan, <morgan@kernel.org>.		pam_rootok was written by Andrew G. Morgan, <morgan@kernel.org>.
6.27. pam_securetty - limit root login to special devices		6.28. pam_securetty - limit root login to special devices
pam_securetty.so [ debug ]		pam_securetty.so [ debug ]
6.27.1. DESCRIPTION		6.28.1. DESCRIPTION
pam_securetty is a PAM module that allows root logins only if the user is		pam_securetty is a PAM module that allows root logins only if the user is
logging in on a "secure" tty, as defined by the listing in the securetty file.		logging in on a "secure" tty, as defined by the listing in the securetty file.
pam_securetty checks at first, if /etc/securetty exists. If not and it was		pam_securetty checks at first, if /etc/securetty exists. If not and it was
built with vendordir support, it will use %vendordir%/securetty. pam_securetty		built with vendordir support, it will use %vendordir%/securetty. pam_securetty
also checks that the securetty files are plain files and not world writable. It		also checks that the securetty files are plain files and not world writable. It
will also allow root logins on the tty specified with console= switch on the		will also allow root logins on the tty specified with console= switch on the
kernel command line and on ttys from the /sys/class/tty/console/active.		kernel command line and on ttys from the /sys/class/tty/console/active.
This module has no effect on non-root users and requires that the application		This module has no effect on non-root users and requires that the application
fills in the PAM_TTY item correctly.		fills in the PAM_TTY item correctly.
For canonical usage, should be listed as a required authentication method		For canonical usage, should be listed as a required authentication method
before any sufficient authentication methods.		before any sufficient authentication methods.
6.27.2. OPTIONS		6.28.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
noconsole		noconsole
Do not automatically allow root logins on the kernel console device, as		Do not automatically allow root logins on the kernel console device, as
specified on the kernel command line or by the sys file, if it is not also		specified on the kernel command line or by the sys file, if it is not also
specified in the securetty file.		specified in the securetty file.
6.27.3. MODULE TYPES PROVIDED		6.28.3. MODULE TYPES PROVIDED
Only the auth module type is provided.		Only the auth module type is provided.
6.27.4. RETURN VALUES		6.28.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
The user is allowed to continue authentication. Either the user is not		The user is allowed to continue authentication. Either the user is not
root, or the root user is trying to log in on an acceptable device.		root, or the root user is trying to log in on an acceptable device.
PAM_AUTH_ERR		PAM_AUTH_ERR
Authentication is rejected. Either root is attempting to log in via an		Authentication is rejected. Either root is attempting to log in via an
unacceptable device, or the securetty file is world writable or not a		unacceptable device, or the securetty file is world writable or not a
skipping to change at line 3444		skipping to change at line 3741
An error occurred while the module was determining the user's name or tty,		An error occurred while the module was determining the user's name or tty,
or the module could not open the securetty file.		or the module could not open the securetty file.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
The module could not find the user name in the /etc/passwd file to verify		The module could not find the user name in the /etc/passwd file to verify
whether the user had a UID of 0. Therefore, the results of running this		whether the user had a UID of 0. Therefore, the results of running this
module are ignored.		module are ignored.
6.27.5. EXAMPLES		6.28.5. EXAMPLES
auth required pam_securetty.so		auth required pam_securetty.so
auth required pam_unix.so		auth required pam_unix.so
6.27.6. AUTHOR		6.28.6. AUTHOR
pam_securetty was written by Elliot Lee <sopwith@cuc.edu>.		pam_securetty was written by Elliot Lee <sopwith@cuc.edu>.
6.28. pam_selinux - set the default security context		6.29. pam_selinux - set the default security context
pam_selinux.so [ open ] [ close ] [ restore ] [ nottys ] [ debug ] [ verbose ]		pam_selinux.so [ open ] [ close ] [ restore ] [ nottys ] [ debug ] [ verbose ]
[ select_context ] [ env_params ] [ use_current_range ]		[ select_context ] [ env_params ] [ use_current_range ]
6.28.1. DESCRIPTION		6.29.1. DESCRIPTION
pam_selinux is a PAM module that sets up the default SELinux security context		pam_selinux is a PAM module that sets up the default SELinux security context
for the next executed process.		for the next executed process.
When a new session is started, the open_session part of the module computes and		When a new session is started, the open_session part of the module computes and
sets up the execution security context used for the next execve(2) call, the		sets up the execution security context used for the next execve(2) call, the
file security context for the controlling terminal, and the security context		file security context for the controlling terminal, and the security context
used for creating a new kernel keyring.		used for creating a new kernel keyring.
When the session is ended, the close_session part of the module restores old		When the session is ended, the close_session part of the module restores old
security contexts that were in effect before the change made by the		security contexts that were in effect before the change made by the
open_session part of the module.		open_session part of the module.
Adding pam_selinux into the PAM stack might disrupt behavior of other PAM		Adding pam_selinux into the PAM stack might disrupt behavior of other PAM
modules which execute applications. To avoid that, pam_selinux.so open should		modules which execute applications. To avoid that, pam_selinux.so open should
be placed after such modules in the PAM stack, and pam_selinux.so close should		be placed after such modules in the PAM stack, and pam_selinux.so close should
be placed before them. When such a placement is not feasible, pam_selinux.so		be placed before them. When such a placement is not feasible, pam_selinux.so
restore could be used to temporary restore original security contexts.		restore could be used to temporary restore original security contexts.
6.28.2. OPTIONS		6.29.2. OPTIONS
open		open
Only execute the open_session part of the module.		Only execute the open_session part of the module.
close		close
Only execute the close_session part of the module.		Only execute the close_session part of the module.
restore		restore
skipping to change at line 3528		skipping to change at line 3825
and SELINUX_USE_CURRENT_RANGE. The first two variables are self describing		and SELINUX_USE_CURRENT_RANGE. The first two variables are self describing
and the last one if set to 1 makes the PAM module behave as if the		and the last one if set to 1 makes the PAM module behave as if the
use_current_range was specified on the command line of the module.		use_current_range was specified on the command line of the module.
use_current_range		use_current_range
Use the sensitivity level of the current process for the user context		Use the sensitivity level of the current process for the user context
instead of the default level. Also suppresses asking of the sensitivity		instead of the default level. Also suppresses asking of the sensitivity
level from the user or obtaining it from PAM environment.		level from the user or obtaining it from PAM environment.
6.28.3. MODULE TYPES PROVIDED		6.29.3. MODULE TYPES PROVIDED
Only the session module type is provided.		Only the session module type is provided.
6.28.4. RETURN VALUES		6.29.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
The security context was set successfully.		The security context was set successfully.
PAM_SESSION_ERR		PAM_SESSION_ERR
Unable to get or set a valid context.		Unable to get or set a valid context.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
The user is not known to the system.		The user is not known to the system.
PAM_BUF_ERR		PAM_BUF_ERR
Memory allocation error.		Memory allocation error.
6.28.5. EXAMPLES		6.29.5. EXAMPLES
auth required pam_unix.so		auth required pam_unix.so
session required pam_permit.so		session required pam_permit.so
session optional pam_selinux.so		session optional pam_selinux.so
6.28.6. AUTHOR		6.29.6. AUTHOR
pam_selinux was written by Dan Walsh <dwalsh@redhat.com>.		pam_selinux was written by Dan Walsh <dwalsh@redhat.com>.
6.29. pam_shells - check for valid login shell		6.30. pam_sepermit - allow/reject access based on SELinux mode
		pam_sepermit.so [ debug ] [ conf=/path/to/config/file ]
		6.30.1. DESCRIPTION
		The pam_sepermit module allows or denies login depending on SELinux enforcement
		state.
		When the user which is logging in matches an entry in the config file he is
		allowed access only when the SELinux is in enforcing mode. Otherwise he is
		denied access. For users not matching any entry in the config file the
		pam_sepermit module returns PAM_IGNORE return value.
		The config file contains a list of user names one per line with optional
		arguments. If the name is prefixed with @ character it means that all users in
		the group name match. If it is prefixed with a % character the SELinux user is
		used to match against the name instead of the account name. Note that when
		SELinux is disabled the SELinux user assigned to the account cannot be
		determined. This means that such entries are never matched when SELinux is
		disabled and pam_sepermit will return PAM_IGNORE.
		See sepermit.conf(5) for details.
		If there is no explicitly specified configuration file and /etc/security/
		sepermit.conf does not exist, %vendordir%/security/sepermit.conf is used.
		6.30.2. OPTIONS
		debug
		Turns on debugging via syslog(3).
		conf=/path/to/config/file
		Path to alternative config file overriding the default.
		6.30.3. MODULE TYPES PROVIDED
		The auth and account module types are provided.
		6.30.4. RETURN VALUES
		PAM_AUTH_ERR
		SELinux is disabled or in the permissive mode and the user matches.
		PAM_SUCCESS
		SELinux is in the enforcing mode and the user matches.
		PAM_IGNORE
		The user does not match any entry in the config file.
		PAM_USER_UNKNOWN
		The module was unable to determine the user's name.
		PAM_SERVICE_ERR
		Error during reading or parsing the config file.
		6.30.5. FILES
		/etc/security/sepermit.conf
		Default configuration file
		6.30.6. EXAMPLES
		auth [success=done ignore=ignore default=bad] pam_sepermit.so
		auth required pam_unix.so
		account required pam_unix.so
		session required pam_permit.so
		6.30.7. AUTHOR
		pam_sepermit and this manual page were written by Tomas Mraz
		<tmraz@redhat.com>.
		6.31. pam_setquota - set or modify disk quotas on session start
		pam_setquota.so [ fs=/home ] [ overwrite=0 ] [ debug=0 ] [ startuid=1000 ] [
		enduid=0 ] [ bsoftlimit=19000 ] [ bhardlimit=20000 ] [ isoftlimit=3000 ] [
		ihardlimit=4000 ]
		6.31.1. DESCRIPTION
		pam_setquota is a PAM module to set or modify a disk quota at session start
		This makes quotas usable with central user databases, such as MySQL or LDAP.
		6.31.2. OPTIONS
		fs=/home
		The device file or mountpoint the policy applies to. Defaults to the
		filesystem containing the users home directory.
		overwrite=0
		Overwrite an existing quota. Note: Enabling this will remove the ability
		for the admin to manually configure different quotas for users for a
		filesystem with edquota(8). (Defaults to 0)
		debug=0
		Enable debugging. A value of 1 outputs the old and new quota on a device. A
		value of 2 also prints out the matched and found filesystems should fs be
		unset. (Defaults to 0)
		startuid=1000
		Describe the start of the UID range the policy is applied to. (Defaults to
		UID_MIN from login.defs or the uidmin value defined at compile-time if
		UID_MIN is undefined.)
		enduid=0
		Describe the end of the UID range the policy is applied to. Setting enduid=
		0 results in an open-ended UID range (i.e. all uids greater than startuid
		are included). (Defaults to 0)
		bsoftlimit=19000
		Soft limit for disk quota blocks, as defined by quotactl(2). Note:
		bsoftlimit and bhardlimit must be set at the same time!
		bhardlimit=20000
		Hard limit for disk quota blocks, as defined by quotactl(2). Note:
		bsoftlimit and bhardlimit must be set at the same time!
		isoftlimit=3000
		Soft limit for inodes, as defined by quotactl(2). Note: isoftlimit and
		ihardlimit must be set at the same time!
		ihardlimit=4000
		Hard limit for inodes, as defined by quotactl(2). Note: isoftlimit and
		ihardlimit must be set at the same time!
		6.31.3. MODULE TYPES PROVIDED
		Only the session module type is provided.
		6.31.4. RETURN VALUES
		PAM_SUCCESS
		The quota was set successfully.
		PAM_IGNORE
		No action was taken because either the UID of the user was outside of the
		specified range, a quota already existed and overwrite=1 was not configured
		or no limits were configured at all.
		PAM_USER_UNKNOWN
		The user was not found.
		PAM_PERM_DENIED
		/proc/mounts could not be opened.
		The filesystem or device specified was not found.
		The limits for the user could not be retrieved. See syslog for more
		information.
		The limits for the user could not be set. See syslog for more information.
		Either isoftlimit/ihardlimit or bsoftlimit/bhardlimit were not set at the
		same time.
		6.31.5. EXAMPLES
		A single invocation of `pam_setquota` applies a specific policy to a UID range.
		Applying different policies to specific UID ranges is done by invoking
		pam_setquota more than once. The last matching entry defines the resulting
		quota.
		session required pam_setquota.so bsoftlimit=1000 bhardlimit=2000 isoftl
		imit=1000 ihardlimit=2000 startuid=1000 enduid=0 fs=/home
		session required pam_setquota.so bsoftlimit=19000 bhardlimit=20000 isof
		tlimit=3000 ihardlimit=4000 startuid=2001 enduid=3000 fs=/dev/sda1
		session required pam_setquota.so bsoftlimit=19000 bhardlimit=20000 isof
		tlimit=3000 ihardlimit=4000 startuid=3001 enduid=4000 fs=/dev/sda1 overwrite=1
		6.31.6. AUTHOR
		pam_setquota was originally written by Ruslan Savchenko <savrus@mexmat.net>.
		Further modifications were made by Shane Tzen <shane@ict.usc.edu>, Sven Hartge
		<sven@svenhartge.de> and Keller Fuchs <kellerfuchs@hashbang.sh>.
		6.32. pam_shells - check for valid login shell
pam_shells.so		pam_shells.so
6.29.1. DESCRIPTION		6.32.1. DESCRIPTION
pam_shells is a PAM module that only allows access to the system if the user's		pam_shells is a PAM module that only allows access to the system if the user's
shell is listed in /etc/shells.		shell is listed in /etc/shells.
It also checks if /etc/shells is a plain file and not world writable.		If this file does not exist, entries are taken from files %vendordir%/shells,
		%vendordir%/shells.d/* and /etc/shells.d/* in that order.
6.29.2. OPTIONS		It also checks if needed files (e.g. /etc/shells) are plain files and not world
		writable.
		6.32.2. OPTIONS
This module does not recognise any options.		This module does not recognise any options.
6.29.3. MODULE TYPES PROVIDED		6.32.3. MODULE TYPES PROVIDED
The auth and account module types are provided.		The auth and account module types are provided.
6.29.4. RETURN VALUES		6.32.4. RETURN VALUES
PAM_AUTH_ERR		PAM_AUTH_ERR
Access to the system was denied.		Access to the system was denied.
PAM_SUCCESS		PAM_SUCCESS
The user's login shell was listed as valid shell in /etc/shells.		The user's login shell was listed as valid shell in /etc/shells.
PAM_SERVICE_ERR		PAM_SERVICE_ERR
The module was not able to get the name of the user.		The module was not able to get the name of the user.
6.29.5. EXAMPLES		6.32.5. EXAMPLES
auth required pam_shells.so		auth required pam_shells.so
6.29.6. AUTHOR		6.32.6. AUTHOR
pam_shells was written by Erik Troan <ewt@redhat.com>.		pam_shells was written by Erik Troan <ewt@redhat.com>.
6.30. pam_succeed_if - test account characteristics		6.33. pam_succeed_if - test account characteristics
pam_succeed_if.so [flag...] [condition...]		pam_succeed_if.so [flag...] [condition...]
6.30.1. DESCRIPTION		6.33.1. DESCRIPTION
pam_succeed_if.so is designed to succeed or fail authentication based on		pam_succeed_if.so is designed to succeed or fail authentication based on
characteristics of the account belonging to the user being authenticated or		characteristics of the account belonging to the user being authenticated or
values of other PAM items. One use is to select whether to load other modules		values of other PAM items. One use is to select whether to load other modules
based on this test.		based on this test.
The module should be given one or more conditions as module arguments, and		The module should be given one or more conditions as module arguments, and
authentication will succeed only if all of the conditions are met.		authentication will succeed only if all of the conditions are met.
6.30.2. OPTIONS		6.33.2. OPTIONS
The following flags are supported:		The following flags are supported:
debug		debug
Turns on debugging messages sent to syslog.		Turns on debugging messages sent to syslog.
use_uid		use_uid
Evaluate conditions using the account of the user whose UID the application		Evaluate conditions using the account of the user whose UID the application
skipping to change at line 3713		skipping to change at line 4210
User is not in given group(s).		User is not in given group(s).
user innetgr netgroup		user innetgr netgroup
(user,host) is in given netgroup.		(user,host) is in given netgroup.
user notinnetgr group		user notinnetgr group
(user,host) is not in given netgroup.		(user,host) is not in given netgroup.
6.30.3. MODULE TYPES PROVIDED		6.33.3. MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.		All module types (account, auth, password and session) are provided.
6.30.4. RETURN VALUES		6.33.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
The condition was true.		The condition was true.
PAM_AUTH_ERR		PAM_AUTH_ERR
The condition was false.		The condition was false.
PAM_SERVICE_ERR		PAM_SERVICE_ERR
A service error occurred or the arguments can't be parsed correctly.		A service error occurred or the arguments can't be parsed correctly.
6.30.5. EXAMPLES		6.33.5. EXAMPLES
To emulate the behaviour of pam_wheel, except there is no fallback to group 0		To emulate the behaviour of pam_wheel, except there is no fallback to group 0
being only approximated by checking also the root group membership:		being only approximated by checking also the root group membership:
auth required pam_succeed_if.so quiet user ingroup wheel:root		auth required pam_succeed_if.so quiet user ingroup wheel:root
Given that the type matches, only loads the othermodule rule if the UID is over		Given that the type matches, only loads the othermodule rule if the UID is over
500. Adjust the number after default to skip several rules.		500. Adjust the number after default to skip several rules.
type [default=1 success=ignore] pam_succeed_if.so quiet uid > 500		type [default=1 success=ignore] pam_succeed_if.so quiet uid > 500
type required othermodule.so arguments...		type required othermodule.so arguments...
6.30.6. AUTHOR		6.33.6. AUTHOR
Nalin Dahyabhai <nalin@redhat.com>		Nalin Dahyabhai <nalin@redhat.com>
6.31. pam_time - time controlled access		6.34. pam_time - time controlled access
pam_time.so [ conffile=conf-file ] [ debug ] [ noaudit ]		pam_time.so [ conffile=conf-file ] [ debug ] [ noaudit ]
6.31.1. DESCRIPTION		6.34.1. DESCRIPTION
The pam_time PAM module does not authenticate the user, but instead it		The pam_time PAM module does not authenticate the user, but instead it
restricts access to a system and or specific applications at various times of		restricts access to a system and or specific applications at various times of
the day and on specific days or over various terminal lines. This module can be		the day and on specific days or over various terminal lines. This module can be
configured to deny access to (individual) users based on their name, the time		configured to deny access to (individual) users based on their name, the time
of day, the day of week, the service they are applying for and their terminal		of day, the day of week, the service they are applying for and their terminal
from which they are making their request.		from which they are making their request.
By default rules for time/port access are taken from config file /etc/security/		By default rules for time/port access are taken from config file /etc/security/
time.conf. An alternative file can be specified with the conffile option.		time.conf. An alternative file can be specified with the conffile option.
		If there is no explicitly specified configuration file and /etc/security/
		time.conf does not exist, %vendordir%/security/time.conf is used.
If Linux PAM is compiled with audit support the module will report when it		If Linux PAM is compiled with audit support the module will report when it
denies access.		denies access.
6.31.2. DESCRIPTION		6.34.2. DESCRIPTION
The pam_time PAM module does not authenticate the user, but instead it		The pam_time PAM module does not authenticate the user, but instead it
restricts access to a system and or specific applications at various times of		restricts access to a system and or specific applications at various times of
the day and on specific days or over various terminal lines. This module can be		the day and on specific days or over various terminal lines. This module can be
configured to deny access to (individual) users based on their name, the time		configured to deny access to (individual) users based on their name, the time
of day, the day of week, the service they are applying for and their terminal		of day, the day of week, the service they are applying for and their terminal
from which they are making their request.		from which they are making their request.
For this module to function correctly there must be a correctly formatted /etc/		For this module to function correctly there must be a correctly formatted /etc/
security/time.conf file present. White spaces are ignored and lines maybe		security/time.conf file present. White spaces are ignored and lines maybe
skipping to change at line 3824		skipping to change at line 4324
is deemed to apply on the following day).		is deemed to apply on the following day).
For a rule to be active, ALL of service+ttys+users must be satisfied by the		For a rule to be active, ALL of service+ttys+users must be satisfied by the
applying process.		applying process.
Note, currently there is no daemon enforcing the end of a session. This needs		Note, currently there is no daemon enforcing the end of a session. This needs
to be remedied.		to be remedied.
Poorly formatted rules are logged as errors using syslog(3).		Poorly formatted rules are logged as errors using syslog(3).
6.31.3. OPTIONS		6.34.3. OPTIONS
conffile=/path/to/time.conf		conffile=/path/to/time.conf
Indicate an alternative time.conf style configuration file to override the		Indicate an alternative time.conf style configuration file to override the
default.		default.
debug		debug
Some debug information is printed with syslog(3).		Some debug information is printed with syslog(3).
noaudit		noaudit
Do not report logins at disallowed time to the audit subsystem.		Do not report logins at disallowed time to the audit subsystem.
6.31.4. MODULE TYPES PROVIDED		6.34.4. MODULE TYPES PROVIDED
Only the account type is provided.		Only the account type is provided.
6.31.5. RETURN VALUES		6.34.5. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
Access was granted.		Access was granted.
PAM_ABORT		PAM_ABORT
Not all relevant data could be gotten.		Not all relevant data could be gotten.
PAM_BUF_ERR		PAM_BUF_ERR
skipping to change at line 3865		skipping to change at line 4365
Memory buffer error.		Memory buffer error.
PAM_PERM_DENIED		PAM_PERM_DENIED
Access was not granted.		Access was not granted.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
The user is not known to the system.		The user is not known to the system.
6.31.6. FILES		6.34.6. FILES
/etc/security/time.conf		/etc/security/time.conf
Default configuration file		Default configuration file
6.31.7. EXAMPLES		6.34.7. EXAMPLES
These are some example lines which might be specified in /etc/security/		These are some example lines which might be specified in /etc/security/
time.conf.		time.conf.
All users except for root are denied access to console-login at all times:		All users except for root are denied access to console-login at all times:
login ; tty* & !ttyp* ; !root ; !Al0000-2400		login ; tty* & !ttyp* ; !root ; !Al0000-2400
Games (configured to use PAM) are only to be accessed out of working hours.		Games (configured to use PAM) are only to be accessed out of working hours.
This rule does not apply to the user waster:		This rule does not apply to the user waster:
games ; * ; !waster ; Wd0000-2400 | Wk1800-0800		games ; * ; !waster ; Wd0000-2400 | Wk1800-0800
6.31.8. AUTHOR		6.34.8. AUTHOR
pam_time was written by Andrew G. Morgan <morgan@kernel.org>.		pam_time was written by Andrew G. Morgan <morgan@kernel.org>.
6.32. pam_timestamp - authenticate using cached successful authentication		6.35. pam_timestamp - authenticate using cached successful authentication
attempts		attempts
pam_timestamp.so [ timestampdir=directory ] [ timestamp_timeout=number ] [		pam_timestamp.so [ timestampdir=directory ] [ timestamp_timeout=number ] [
verbose ] [ debug ]		verbose ] [ debug ]
6.32.1. DESCRIPTION		6.35.1. DESCRIPTION
In a nutshell, pam_timestamp caches successful authentication attempts, and		In a nutshell, pam_timestamp caches successful authentication attempts, and
allows you to use a recent successful attempt as the basis for authentication.		allows you to use a recent successful attempt as the basis for authentication.
This is similar mechanism which is used in sudo.		This is similar mechanism which is used in sudo.
When an application opens a session using pam_timestamp, a timestamp file is		When an application opens a session using pam_timestamp, a timestamp file is
created in the timestampdir directory for the user. When an application		created in the timestampdir directory for the user. When an application
attempts to authenticate the user, a pam_timestamp will treat a sufficiently		attempts to authenticate the user, a pam_timestamp will treat a sufficiently
recent timestamp file as grounds for succeeding.		recent timestamp file as grounds for succeeding.
The default encryption hash is taken from the HMAC_CRYPTO_ALGO variable from /		The default encryption hash is taken from the HMAC_CRYPTO_ALGO variable from /
etc/login.defs.		etc/login.defs.
6.32.2. OPTIONS		6.35.2. OPTIONS
timestampdir=directory		timestampdir=directory
Specify an alternate directory where pam_timestamp creates timestamp files.		Specify an alternate directory where pam_timestamp creates timestamp files.
timestamp_timeout=number		timestamp_timeout=number
How long should pam_timestamp treat timestamp as valid after their last		How long should pam_timestamp treat timestamp as valid after their last
modification date (in seconds). Default is 300 seconds.		modification date (in seconds). Default is 300 seconds.
verbose		verbose
Attempt to inform the user when access is granted.		Attempt to inform the user when access is granted.
debug		debug
Turns on debugging messages sent to syslog(3).		Turns on debugging messages sent to syslog(3).
6.32.3. MODULE TYPES PROVIDED		6.35.3. MODULE TYPES PROVIDED
The auth and session module types are provided.		The auth and session module types are provided.
6.32.4. RETURN VALUES		6.35.4. RETURN VALUES
PAM_AUTH_ERR		PAM_AUTH_ERR
The module was not able to retrieve the user name or no valid timestamp		The module was not able to retrieve the user name or no valid timestamp
file was found.		file was found.
PAM_SUCCESS		PAM_SUCCESS
Everything was successful.		Everything was successful.
PAM_SESSION_ERR		PAM_SESSION_ERR
Timestamp file could not be created or updated.		Timestamp file could not be created or updated.
6.32.5. NOTES		6.35.5. NOTES
Users can get confused when they are not always asked for passwords when		Users can get confused when they are not always asked for passwords when
running a given program. Some users reflexively begin typing information before		running a given program. Some users reflexively begin typing information before
noticing that it is not being asked for.		noticing that it is not being asked for.
6.32.6. EXAMPLES		6.35.6. EXAMPLES
auth sufficient pam_timestamp.so verbose		auth sufficient pam_timestamp.so verbose
auth required pam_unix.so		auth required pam_unix.so
session required pam_unix.so		session required pam_unix.so
session optional pam_timestamp.so		session optional pam_timestamp.so
6.32.7. FILES		6.35.7. FILES
/var/run/pam_timestamp/...		/var/run/pam_timestamp/...
timestamp files and directories		timestamp files and directories
6.32.8. AUTHOR		6.35.8. AUTHOR
pam_timestamp was written by Nalin Dahyabhai.		pam_timestamp was written by Nalin Dahyabhai.
6.33. pam_umask - set the file mode creation mask		6.36. pam_tty_audit - enable/disable tty auditing
		pam_tty_audit.so [ disable=patterns ] [ enable=patterns ]
		6.36.1. DESCRIPTION
		The pam_tty_audit PAM module is used to enable or disable TTY auditing. By
		default, the kernel does not audit input on any TTY.
		6.36.2. OPTIONS
		disable=patterns
		For each user matching patterns, disable TTY auditing. This overrides any
		previous enable option matching the same user name on the command line. See
		NOTES for further description of patterns.
		enable=patterns
		For each user matching patterns, enable TTY auditing. This overrides any
		previous disable option matching the same user name on the command line.
		See NOTES for further description of patterns.
		open_only
		Set the TTY audit flag when opening the session, but do not restore it when
		closing the session. Using this option is necessary for some services that
		don't fork() to run the authenticated session, such as sudo.
		log_passwd
		Log keystrokes when ECHO mode is off but ICANON mode is active. This is the
		mode in which the tty is placed during password entry. By default,
		passwords are not logged. This option may not be available on older kernels
		(3.9?).
		6.36.3. MODULE TYPES PROVIDED
		Only the session type is supported.
		6.36.4. RETURN VALUES
		PAM_SESSION_ERR
		Error reading or modifying the TTY audit flag. See the system log for more
		details.
		PAM_SUCCESS
		Success.
		6.36.5. NOTES
		When TTY auditing is enabled, it is inherited by all processes started by that
		user. In particular, daemons restarted by a user will still have TTY auditing
		enabled, and audit TTY input even by other users unless auditing for these
		users is explicitly disabled. Therefore, it is recommended to use disable=* as
		the first option for most daemons using PAM.
		To view the data that was logged by the kernel to audit use the command
		aureport --tty.
		The patterns are comma separated lists of glob patterns or ranges of uids. A
		range is specified as min_uid:max_uid where one of these values can be empty.
		If min_uid is empty only user with the uid max_uid will be matched. If max_uid
		is empty users with the uid greater than or equal to min_uid will be matched.
		Please note that passwords in some circumstances may be logged by TTY auditing
		even if the log_passwd is not used. For example, all input to an ssh session
		will be logged - even if there is a password being typed into some software
		running at the remote host because only the local TTY state affects the local
		TTY auditing.
		6.36.6. EXAMPLES
		Audit all administrative actions.
		session required pam_tty_audit.so disable=* enable=root
		6.36.7. AUTHOR
		pam_tty_audit was written by Miloslav Trmač <mitr@redhat.com>. The log_passwd
		option was added by Richard Guy Briggs <rgb@redhat.com>.
		6.37. pam_umask - set the file mode creation mask
pam_umask.so [ debug ] [ silent ] [ usergroups ] [ nousergroups ] [ umask=mask		pam_umask.so [ debug ] [ silent ] [ usergroups ] [ nousergroups ] [ umask=mask
]		]
6.33.1. DESCRIPTION		6.37.1. DESCRIPTION
pam_umask is a PAM module to set the file mode creation mask of the current		pam_umask is a PAM module to set the file mode creation mask of the current
environment. The umask affects the default permissions assigned to newly		environment. The umask affects the default permissions assigned to newly
created files.		created files.
The PAM module tries to get the umask value from the following places in the		The PAM module tries to get the umask value from the following places in the
following order:		following order:
• umask= entry in the user's GECOS field		• umask= entry in the user's GECOS field
skipping to change at line 3998		skipping to change at line 4582
• UMASK entry from /etc/login.defs		• UMASK entry from /etc/login.defs
• UMASK= entry from /etc/default/login		• UMASK= entry from /etc/default/login
The GECOS field is split on comma ',' characters. The module also in addition		The GECOS field is split on comma ',' characters. The module also in addition
to the umask= entry recognizes pri= entry, which sets the nice priority value		to the umask= entry recognizes pri= entry, which sets the nice priority value
for the session, and ulimit= entry, which sets the maximum size of files the		for the session, and ulimit= entry, which sets the maximum size of files the
processes in the session can create.		processes in the session can create.
6.33.2. OPTIONS		6.37.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
silent		silent
Don't print informative messages.		Don't print informative messages.
usergroups		usergroups
skipping to change at line 4025		skipping to change at line 4609
This is the direct opposite of the usergroups option described above, which		This is the direct opposite of the usergroups option described above, which
can be useful in case pam_umask has been compiled with usergroups enabled		can be useful in case pam_umask has been compiled with usergroups enabled
by default and you want to disable it at runtime.		by default and you want to disable it at runtime.
umask=mask		umask=mask
Sets the calling process's file mode creation mask (umask) to mask & 0777.		Sets the calling process's file mode creation mask (umask) to mask & 0777.
The value is interpreted as Octal.		The value is interpreted as Octal.
6.33.3. MODULE TYPES PROVIDED		6.37.3. MODULE TYPES PROVIDED
Only the session type is provided.		Only the session type is provided.
6.33.4. RETURN VALUES		6.37.4. RETURN VALUES
PAM_SUCCESS		PAM_SUCCESS
The new umask was set successfully.		The new umask was set successfully.
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
PAM_CONV_ERR		PAM_CONV_ERR
skipping to change at line 4057		skipping to change at line 4641
PAM_CONV_AGAIN.		PAM_CONV_AGAIN.
PAM_SERVICE_ERR		PAM_SERVICE_ERR
No username was given.		No username was given.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User not known.		User not known.
6.33.5. EXAMPLES		6.37.5. EXAMPLES
Add the following line to /etc/pam.d/login to set the user specific umask at		Add the following line to /etc/pam.d/login to set the user specific umask at
login:		login:
session optional pam_umask.so umask=0022		session optional pam_umask.so umask=0022
6.33.6. AUTHOR		6.37.6. AUTHOR
pam_umask was written by Thorsten Kukuk <kukuk@thkukuk.de>.		pam_umask was written by Thorsten Kukuk <kukuk@thkukuk.de>.
6.34. pam_unix - traditional password authentication		6.38. pam_unix - traditional password authentication
pam_unix.so [ ... ]		pam_unix.so [ ... ]
6.34.1. DESCRIPTION		6.38.1. DESCRIPTION
This is the standard Unix authentication module. It uses standard calls from		This is the standard Unix authentication module. It uses standard calls from
the system's libraries to retrieve and set account information as well as		the system's libraries to retrieve and set account information as well as
authentication. Usually this is obtained from the /etc/passwd and the /etc/		authentication. Usually this is obtained from the /etc/passwd and the /etc/
shadow file as well if shadow is enabled.		shadow file as well if shadow is enabled.
The account component performs the task of establishing the status of the		The account component performs the task of establishing the status of the
user's account and password based on the following shadow elements: expire,		user's account and password based on the following shadow elements: expire,
last_change, max_change, min_change, warn_change. In the case of the latter, it		last_change, max_change, min_change, warn_change. In the case of the latter, it
may offer advice to the user on changing their password or, through the		may offer advice to the user on changing their password or, through the
skipping to change at line 4118		skipping to change at line 4702
The password component of this module performs the task of updating the user's		The password component of this module performs the task of updating the user's
password. The default encryption hash is taken from the ENCRYPT_METHOD variable		password. The default encryption hash is taken from the ENCRYPT_METHOD variable
from /etc/login.defs		from /etc/login.defs
The session component of this module logs when a user logins or leave the		The session component of this module logs when a user logins or leave the
system.		system.
Remaining arguments, supported by others functions of this module, are silently		Remaining arguments, supported by others functions of this module, are silently
ignored. Other arguments are logged as errors through syslog(3).		ignored. Other arguments are logged as errors through syslog(3).
6.34.2. OPTIONS		6.38.2. OPTIONS
debug		debug
Turns on debugging via syslog(3).		Turns on debugging via syslog(3).
audit		audit
A little more extreme than debug.		A little more extreme than debug.
quiet		quiet
skipping to change at line 4255		skipping to change at line 4839
When set ignore password expiration as defined by the shadow entry of the		When set ignore password expiration as defined by the shadow entry of the
user. The option has an effect only in case pam_unix was not used for the		user. The option has an effect only in case pam_unix was not used for the
authentication or it returned authentication failure meaning that other		authentication or it returned authentication failure meaning that other
authentication source or method succeeded. The example can be public key		authentication source or method succeeded. The example can be public key
authentication in sshd. The module will return PAM_SUCCESS instead of		authentication in sshd. The module will return PAM_SUCCESS instead of
eventual PAM_NEW_AUTHTOK_REQD or PAM_AUTHTOK_EXPIRED.		eventual PAM_NEW_AUTHTOK_REQD or PAM_AUTHTOK_EXPIRED.
Invalid arguments are logged with syslog(3).		Invalid arguments are logged with syslog(3).
6.34.3. MODULE TYPES PROVIDED		6.38.3. MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.		All module types (account, auth, password and session) are provided.
6.34.4. RETURN VALUES		6.38.4. RETURN VALUES
PAM_IGNORE		PAM_IGNORE
Ignore this module.		Ignore this module.
6.34.5. EXAMPLES		6.38.5. EXAMPLES
An example usage for /etc/pam.d/login would be:		An example usage for /etc/pam.d/login would be:
# Authenticate the user		# Authenticate the user
auth required pam_unix.so		auth required pam_unix.so
# Ensure users account and password are still active		# Ensure users account and password are still active
account required pam_unix.so		account required pam_unix.so
# Change the user's password, but at first check the strength		# Change the user's password, but at first check the strength
# with pam_passwdqc(8)		# with pam_passwdqc(8)
password required pam_passwdqc.so config=/etc/passwdqc.conf		password required pam_passwdqc.so config=/etc/passwdqc.conf
password required pam_unix.so use_authtok nullok yescrypt		password required pam_unix.so use_authtok nullok yescrypt
session required pam_unix.so		session required pam_unix.so
6.34.6. AUTHOR		6.38.6. AUTHOR
pam_unix was written by various people.		pam_unix was written by various people.
6.35. pam_userdb - authenticate against a db database		6.39. pam_userdb - authenticate against a db database
pam_userdb.so db=/path/database [ debug ] [ crypt=[crypt|none] ] [ icase ] [		pam_userdb.so db=/path/database [ debug ] [ crypt=[crypt|none] ] [ icase ] [
dump ] [ try_first_pass ] [ use_first_pass ] [ unknown_ok ] [ key_only ]		dump ] [ try_first_pass ] [ use_first_pass ] [ unknown_ok ] [ key_only ]
6.35.1. DESCRIPTION		6.39.1. DESCRIPTION
The pam_userdb module is used to verify a username/password pair against values		The pam_userdb module is used to verify a username/password pair against values
stored in a Berkeley DB database. The database is indexed by the username, and		stored in a Berkeley DB database. The database is indexed by the username, and
the data fields corresponding to the username keys are the passwords.		the data fields corresponding to the username keys are the passwords.
6.35.2. OPTIONS		6.39.2. OPTIONS
crypt=[crypt|none]		crypt=[crypt|none]
Indicates whether encrypted or plaintext passwords are stored in the		Indicates whether encrypted or plaintext passwords are stored in the
database. If it is crypt, passwords should be stored in the database in		database. If it is crypt, passwords should be stored in the database in
crypt(3) form. If none is selected, passwords should be stored in the		crypt(3) form. If none is selected, passwords should be stored in the
database as plaintext.		database as plaintext.
db=/path/database		db=/path/database
skipping to change at line 4351		skipping to change at line 4935
username/password pair in more than a database.		username/password pair in more than a database.
key_only		key_only
The username and password are concatenated together in the database hash as		The username and password are concatenated together in the database hash as
'username-password' with a random value. if the concatenation of the		'username-password' with a random value. if the concatenation of the
username and password with a dash in the middle returns any result, the		username and password with a dash in the middle returns any result, the
user is valid. this is useful in cases where the username may not be unique		user is valid. this is useful in cases where the username may not be unique
but the username and password pair are.		but the username and password pair are.
6.35.3. MODULE TYPES PROVIDED		6.39.3. MODULE TYPES PROVIDED
The auth and account module types are provided.		The auth and account module types are provided.
6.35.4. RETURN VALUES		6.39.4. RETURN VALUES
PAM_AUTH_ERR		PAM_AUTH_ERR
Authentication failure.		Authentication failure.
PAM_AUTHTOK_RECOVERY_ERR		PAM_AUTHTOK_RECOVERY_ERR
Authentication information cannot be recovered.		Authentication information cannot be recovered.
PAM_BUF_ERR		PAM_BUF_ERR
skipping to change at line 4385		skipping to change at line 4969
Error in service module.		Error in service module.
PAM_SUCCESS		PAM_SUCCESS
Success.		Success.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User not known to the underlying authentication module.		User not known to the underlying authentication module.
6.35.5. EXAMPLES		6.39.5. EXAMPLES
auth sufficient pam_userdb.so icase db=/etc/dbtest		auth sufficient pam_userdb.so icase db=/etc/dbtest
6.35.6. AUTHOR		6.39.6. AUTHOR
pam_userdb was written by Cristian Gafton >gafton@redhat.com<.		pam_userdb was written by Cristian Gafton >gafton@redhat.com<.
6.36. pam_warn - logs all PAM items		6.40. pam_warn - logs all PAM items
pam_warn.so		pam_warn.so
6.36.1. DESCRIPTION		6.40.1. DESCRIPTION
pam_warn is a PAM module that logs the service, terminal, user, remote user and		pam_warn is a PAM module that logs the service, terminal, user, remote user and
remote host to syslog(3). The items are not probed for, but instead obtained		remote host to syslog(3). The items are not probed for, but instead obtained
from the standard PAM items. The module always returns PAM_IGNORE, indicating		from the standard PAM items. The module always returns PAM_IGNORE, indicating
that it does not want to affect the authentication process.		that it does not want to affect the authentication process.
6.36.2. OPTIONS		6.40.2. OPTIONS
This module does not recognise any options.		This module does not recognise any options.
6.36.3. MODULE TYPES PROVIDED		6.40.3. MODULE TYPES PROVIDED
The auth, account, password and session module types are provided.		The auth, account, password and session module types are provided.
6.36.4. RETURN VALUES		6.40.4. RETURN VALUES
PAM_IGNORE		PAM_IGNORE
This module always returns PAM_IGNORE.		This module always returns PAM_IGNORE.
6.36.5. EXAMPLES		6.40.5. EXAMPLES
#%PAM-1.0		#%PAM-1.0
#		#
# If we don't have config entries for a service, the		# If we don't have config entries for a service, the
# OTHER entries are used. To be secure, warn and deny		# OTHER entries are used. To be secure, warn and deny
# access to everything.		# access to everything.
other auth required pam_warn.so		other auth required pam_warn.so
other auth required pam_deny.so		other auth required pam_deny.so
other account required pam_warn.so		other account required pam_warn.so
other account required pam_deny.so		other account required pam_deny.so
other password required pam_warn.so		other password required pam_warn.so
other password required pam_deny.so		other password required pam_deny.so
other session required pam_warn.so		other session required pam_warn.so
other session required pam_deny.so		other session required pam_deny.so
6.36.6. AUTHOR		6.40.6. AUTHOR
pam_warn was written by Andrew G. Morgan <morgan@kernel.org>.		pam_warn was written by Andrew G. Morgan <morgan@kernel.org>.
6.37. pam_wheel - only permit root access to members of group wheel		6.41. pam_wheel - only permit root access to members of group wheel
pam_wheel.so [ debug ] [ deny ] [ group=name ] [ root_only ] [ trust ] [		pam_wheel.so [ debug ] [ deny ] [ group=name ] [ root_only ] [ trust ] [
use_uid ]		use_uid ]
6.37.1. DESCRIPTION		6.41.1. DESCRIPTION
The pam_wheel PAM module is used to enforce the so-called wheel group. By		The pam_wheel PAM module is used to enforce the so-called wheel group. By
default it permits access to the target user if the applicant user is a member		default it permits access to the target user if the applicant user is a member
of the wheel group. If no group with this name exist, the module is using the		of the wheel group. If no group with this name exist, the module is using the
group with the group-ID 0.		group with the group-ID 0.
6.37.2. OPTIONS		6.41.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
deny		deny
Reverse the sense of the auth operation: if the user is trying to get UID 0		Reverse the sense of the auth operation: if the user is trying to get UID 0
access and is a member of the wheel group (or the group of the group		access and is a member of the wheel group (or the group of the group
option), deny access. Conversely, if the user is not in the group, return		option), deny access. Conversely, if the user is not in the group, return
skipping to change at line 4486		skipping to change at line 5070
user is a member of the wheel group (thus with a little play stacking the		user is a member of the wheel group (thus with a little play stacking the
modules the wheel members may be able to su to root without being prompted		modules the wheel members may be able to su to root without being prompted
for a passwd).		for a passwd).
use_uid		use_uid
The check will be done against the real uid of the calling process, instead		The check will be done against the real uid of the calling process, instead
of trying to obtain the user from the login session associated with the		of trying to obtain the user from the login session associated with the
terminal in use.		terminal in use.
6.37.3. MODULE TYPES PROVIDED		6.41.3. MODULE TYPES PROVIDED
The auth and account module types are provided.		The auth and account module types are provided.
6.37.4. RETURN VALUES		6.41.4. RETURN VALUES
PAM_AUTH_ERR		PAM_AUTH_ERR
Authentication failure.		Authentication failure.
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
PAM_IGNORE		PAM_IGNORE
skipping to change at line 4520		skipping to change at line 5104
Cannot determine the user name.		Cannot determine the user name.
PAM_SUCCESS		PAM_SUCCESS
Success.		Success.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User not known.		User not known.
6.37.5. EXAMPLES		6.41.5. EXAMPLES
The root account gains access by default (rootok), only wheel members can		The root account gains access by default (rootok), only wheel members can
become root (wheel) but Unix authenticate non-root applicants.		become root (wheel) but Unix authenticate non-root applicants.
su auth sufficient pam_rootok.so		su auth sufficient pam_rootok.so
su auth required pam_wheel.so		su auth required pam_wheel.so
su auth required pam_unix.so		su auth required pam_unix.so
6.37.6. AUTHOR		6.41.6. AUTHOR
pam_wheel was written by Cristian Gafton <gafton@redhat.com>.		pam_wheel was written by Cristian Gafton <gafton@redhat.com>.
6.38. pam_xauth - forward xauth keys between users		6.42. pam_xauth - forward xauth keys between users
pam_xauth.so [ debug ] [ xauthpath=/path/to/xauth ] [ systemuser=UID ] [		pam_xauth.so [ debug ] [ xauthpath=/path/to/xauth ] [ systemuser=UID ] [
targetuser=UID ]		targetuser=UID ]
6.38.1. DESCRIPTION		6.42.1. DESCRIPTION
The pam_xauth PAM module is designed to forward xauth keys (sometimes referred		The pam_xauth PAM module is designed to forward xauth keys (sometimes referred
to as "cookies") between users.		to as "cookies") between users.
Without pam_xauth, when xauth is enabled and a user uses the su(1) command to		Without pam_xauth, when xauth is enabled and a user uses the su(1) command to
assume another user's privileges, that user is no longer able to access the		assume another user's privileges, that user is no longer able to access the
original user's X display because the new user does not have the key needed to		original user's X display because the new user does not have the key needed to
access the display. pam_xauth solves the problem by forwarding the key from the		access the display. pam_xauth solves the problem by forwarding the key from the
user running su (the source user) to the user whose identity the source user is		user running su (the source user) to the user whose identity the source user is
assuming (the target user) when the session is created, and destroying the key		assuming (the target user) when the session is created, and destroying the key
skipping to change at line 4574		skipping to change at line 5158
If a user has a .xauth/export file, the user will only forward cookies to users		If a user has a .xauth/export file, the user will only forward cookies to users
listed in the file. If there is no ~/.xauth/export file, and the invoking user		listed in the file. If there is no ~/.xauth/export file, and the invoking user
is not root, the user will forward cookies to any other user. If there is no ~		is not root, the user will forward cookies to any other user. If there is no ~
/.xauth/export file, and the invoking user is root, the user will not forward		/.xauth/export file, and the invoking user is root, the user will not forward
cookies to other users.		cookies to other users.
Both the import and export files support wildcards (such as *). Both the import		Both the import and export files support wildcards (such as *). Both the import
and export files can be empty, signifying that no users are allowed.		and export files can be empty, signifying that no users are allowed.
6.38.2. OPTIONS		6.42.2. OPTIONS
debug		debug
Print debug information.		Print debug information.
xauthpath=/path/to/xauth		xauthpath=/path/to/xauth
Specify the path the xauth program (it is expected in /usr/X11R6/bin/xauth,		Specify the path the xauth program (it is expected in /usr/X11R6/bin/xauth,
/usr/bin/xauth, or /usr/bin/X11/xauth by default).		/usr/bin/xauth, or /usr/bin/X11/xauth by default).
systemuser=UID		systemuser=UID
Specify the highest UID which will be assumed to belong to a "system" user.		Specify the highest UID which will be assumed to belong to a "system" user.
pam_xauth will refuse to forward credentials to users with UID less than or		pam_xauth will refuse to forward credentials to users with UID less than or
equal to this number, except for root and the "targetuser", if specified.		equal to this number, except for root and the "targetuser", if specified.
targetuser=UID		targetuser=UID
Specify a single target UID which is exempt from the systemuser check.		Specify a single target UID which is exempt from the systemuser check.
6.38.3. MODULE TYPES PROVIDED		6.42.3. MODULE TYPES PROVIDED
Only the session type is provided.		Only the session type is provided.
6.38.4. RETURN VALUES		6.42.4. RETURN VALUES
PAM_BUF_ERR		PAM_BUF_ERR
Memory buffer error.		Memory buffer error.
PAM_PERM_DENIED		PAM_PERM_DENIED
Permission denied by import/export file.		Permission denied by import/export file.
PAM_SESSION_ERR		PAM_SESSION_ERR
skipping to change at line 4621		skipping to change at line 5205
Cannot determine user name, UID or access users home directory.		Cannot determine user name, UID or access users home directory.
PAM_SUCCESS		PAM_SUCCESS
Success.		Success.
PAM_USER_UNKNOWN		PAM_USER_UNKNOWN
User not known.		User not known.
6.38.5. EXAMPLES		6.42.5. EXAMPLES
Add the following line to /etc/pam.d/su to forward xauth keys between users		Add the following line to /etc/pam.d/su to forward xauth keys between users
when calling su:		when calling su:
session optional pam_xauth.so		session optional pam_xauth.so
6.38.6. AUTHOR		6.42.6. AUTHOR
pam_xauth was written by Nalin Dahyabhai <nalin@redhat.com>, based on original		pam_xauth was written by Nalin Dahyabhai <nalin@redhat.com>, based on original
version by Michael K. Johnson <johnsonm@redhat.com>.		version by Michael K. Johnson <johnsonm@redhat.com>.
Chapter 7. See also		Chapter 7. See also
• The Linux-PAM Application Writers' Guide.		• The Linux-PAM Application Writers' Guide.
• The Linux-PAM Module Writers' Guide.		• The Linux-PAM Module Writers' Guide.
End of changes. 254 change blocks.
276 lines changed or deleted		863 lines changed or added

---