diff options
author | Thorsten Kukuk <kukuk@thkukuk.de> | 2006-06-02 15:37:38 +0000 |
---|---|---|
committer | Thorsten Kukuk <kukuk@thkukuk.de> | 2006-06-02 15:37:38 +0000 |
commit | bad0ed8d159cb77466ed81a624355b1e80ead0dc (patch) | |
tree | c1115143eded6faa7e8fe0abc42fc50d4e28fe17 /modules/pam_listfile/pam_listfile.8.xml | |
parent | 29a98911d9cb5e9187c1afe4e161c6861fac4f2b (diff) |
Relevant BUGIDs: 1427738
Purpose of commit: new feature/bugfix
Commit summary:
---------------
2006-06-02 Thorsten Kukuk <kukuk@thkukuk.de>
* doc/man/PAM.8: Regenerate with DocBook XSL Stylesheets v1.70.1.
* doc/man/pam.3: Likewise.
* doc/man/pam.conf.5: Likewise.
* doc/man/pam_acct_mgmt.3: Likewise.
* doc/man/pam_authenticate.3: Likewise.
* doc/man/pam_chauthtok.3: Likewise.
* doc/man/pam_close_session.3: Likewise.
* doc/man/pam_conv.3: Likewise.
* doc/man/pam_end.3: Likewise.
* doc/man/pam_error.3: Likewise.
* doc/man/pam_fail_delay.3: Likewise.
* doc/man/pam_get_data.3: Likewise.
* doc/man/pam_get_item.3: Likewise.
* doc/man/pam_get_user.3: Likewise.
* doc/man/pam_getenv.3: Likewise.
* doc/man/pam_getenvlist.3: Likewise.
* doc/man/pam_info.3: Likewise.
* doc/man/pam_open_session.3: Likewise.
* doc/man/pam_prompt.3: Likewise.
* doc/man/pam_putenv.3: Likewise.
* doc/man/pam_set_data.3: Likewise.
* doc/man/pam_set_item.3: Likewise.
* doc/man/pam_setcred.3: Likewise.
* doc/man/pam_sm_acct_mgmt.3: Likewise.
* doc/man/pam_start.3: Likewise.
* doc/man/pam_strerror.3: Likewise.
* doc/man/pam_syslog.3: Likewise.
* modules/pam_access/access.conf.5: Likewise.
* modules/pam_access/pam_access.8: Likewise.
* modules/pam_cracklib/pam_cracklib.8: Likewise.
* modules/pam_deny/pam_deny.8: Likewise.
* modules/pam_echo/pam_echo.8: Likewise.
* modules/pam_env/pam_env.8: Likewise.
* modules/pam_env/pam_env.conf.5: Likewise.
* modules/pam_exec/pam_exec.8: Likewise.
* modules/pam_filter/pam_filter.8: Likewise.
* modules/pam_ftp/pam_ftp.8: Likewise.
* modules/pam_group/group.conf.5: Likewise.
* modules/pam_group/pam_group.8: Likewise.
* modules/pam_issue/pam_issue.8: Likewise.
* modules/pam_lastlog/pam_lastlog.8: Likewise.
* modules/pam_mkhomedir/pam_mkhomedir.8: Likewise.
* modules/pam_succeed_if/pam_succeed_if.8: Likewise.
* modules/pam_umask/pam_umask.8: Likewise.
* modules/pam_unix/pam_unix_acct.c (pam_sm_acct_mgmt): Use
dngettext if available [#1427738].
* configure.in: Check for dngettext [#1427738].
* po/*.po: Update to dngettext usage.
* modules/pam_listfile/Makefile.am: Include Make.xml.rules.
* modules/pam_listfile/pam_listfile.8.xml: New.
* modules/pam_listfile/pam_listfile.8: New, generated from xml file.
* modules/pam_listfile/README.xml: New.
* modules/pam_listfile/README: Regenerated from xml file.
Diffstat (limited to 'modules/pam_listfile/pam_listfile.8.xml')
-rw-r--r-- | modules/pam_listfile/pam_listfile.8.xml | 282 |
1 files changed, 282 insertions, 0 deletions
diff --git a/modules/pam_listfile/pam_listfile.8.xml b/modules/pam_listfile/pam_listfile.8.xml new file mode 100644 index 00000000..85489d3c --- /dev/null +++ b/modules/pam_listfile/pam_listfile.8.xml @@ -0,0 +1,282 @@ +<?xml version="1.0" encoding='UTF-8'?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN" + "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd"> + +<refentry id="pam_listfile"> + + <refmeta> + <refentrytitle>pam_listfile</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class="sectdesc">Linux-PAM Manual</refmiscinfo> + </refmeta> + + <refnamediv id="pam_listfile-name"> + <refname>pam_listfile</refname> + <refpurpose>deny or allow services based on an arbitrary file.</refpurpose> + </refnamediv> + + <refsynopsisdiv> + <cmdsynopsis id="pam_listfile-cmdsynopsis"> + <command>pam_listfile.so</command> + <arg choice="plain"> + item=[tty|user|rhost|ruser|group|shell] + </arg> + <arg choice="plain"> + sense=[allow|deny] + </arg> + <arg choice="plain"> + file=<replaceable>/path/filename</replaceable> + </arg> + <arg choice="plain"> + onerr=[succeed|fail] + </arg> + <arg choice="opt"> + apply=[<replaceable>user</replaceable>|<replaceable>@group</replaceable>] + </arg> + </cmdsynopsis> + </refsynopsisdiv> + + <refsect1 id="pam_listfile-description"> + + <title>DESCRIPTION</title> + + <para> + pam_listfile is a PAM module which provides a way to deny or + allow services based on an arbitrary file. + </para> + <para> + The module gets the <option>item</option> of the type specified -- + <emphasis>user</emphasis> specifies the username, + <emphasis>PAM_USER</emphasis>; tty specifies the name of the terminal + over which the request has been made, <emphasis>PAM_TTY</emphasis>; + rhost specifies the name of the remote host (if any) from which the + request was made, <emphasis>PAM_RHOST</emphasis>; and ruser specifies + the name of the remote user (if available) who made the request, + <emphasis>PAM_RUSER</emphasis> -- and looks for an instance of that + item in the <option>file=<replaceable>filename</replaceable></option>. + <filename>filename</filename> contains one line per item listed. If + the item is found, then if + <option>sense=<replaceable>allow</replaceable></option>, + <emphasis>PAM_SUCCESS</emphasis> is returned, causing the authorization + request to succeed; else if + <option>sense=<replaceable>deny</replaceable></option>, + <emphasis>PAM_AUTH_ERR</emphasis> is returned, causing the authorization + request to fail. + </para> + <para> + If an error is encountered (for instance, if + <filename>filename</filename> does not exist, or a poorly-constructed + argument is encountered), then if <emphasis>onerr=succeed</emphasis>, + <emphasis>PAM_SUCCESS</emphasis> is returned, otherwise if + <emphasis>onerr=fail</emphasis>, <emphasis>PAM_AUTH_ERR</emphasis> or + <emphasis>PAM_SERVICE_ERR</emphasis> (as appropriate) will be returned. + </para> + <para> + An additional argument, <option>apply=</option>, can be used + to restrict the application of the above to a specific user + (<option>apply=<replaceable>username</replaceable></option>) + or a given group + (<option>apply=<replaceable>@groupname</replaceable></option>). + This added restriction is only meaningful when used with the + <emphasis>tty</emphasis>, <emphasis>rhost</emphasis> and + <emphasis>shell</emphasis> items. + </para> + <para> + Besides this last one, all arguments should be specified; do not + count on any default behavior. + </para> + <para> + No credentials are awarded by this module. + </para> + </refsect1> + + <refsect1 id="pam_listfile-options"> + + <title>OPTIONS</title> + <para> + <variablelist> + + <varlistentry> + <term> + <option>item=[tty|user|rhost|ruser|group|shell]</option> + </term> + <listitem> + <para> + What is listed in the file and should be checked for. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>sense=[allow|deny]</option> + </term> + <listitem> + <para> + Action to take if found in file, if the item is NOT found in + the file, then the opposite action is requested. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>file=<replaceable>/path/filename</replaceable></option> + </term> + <listitem> + <para> + File containing one item per line. The file needs to be a plain + file and not world writeable. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>onerr=[succeed|fail]</option> + </term> + <listitem> + <para> + What to do if something weird happens like being unable to open + the file. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> + <option>apply=[<replaceable>user</replaceable>|<replaceable>@group</replaceable>]</option> + </term> + <listitem> + <para> + Restrict the user class for which the restriction apply. Note that + with <option>item=[user|ruser|group]</option> this oes not make sense, + but for <option>item=[tty|rhost|shell]</option> it have a meaning. + </para> + </listitem> + </varlistentry> + </variablelist> + + </para> + </refsect1> + + <refsect1 id="pam_listfile-services"> + <title>MODULE SERVICES PROVIDED</title> + <para> + The services <option>auth</option>, <option>account</option>, + <option>password</option> and <option>session</option> are supported. + </para> + </refsect1> + + <refsect1 id='pam_listfile-return_values'> + <title>RETURN VALUES</title> + <para> + <variablelist> + + <varlistentry> + <term>PAM_AUTH_ERR</term> + <listitem> + <para>Authentication failure.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>PAM_BUF_ERR</term> + <listitem> + <para> + Memory buffer error. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>PAM_IGNORE</term> + <listitem> + <para> + The rule does not apply to the <option>apply</option> option. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>PAM_SERVICE_ERR</term> + <listitem> + <para> + Error in service module. + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>PAM_SUCCESS</term> + <listitem> + <para> + Success. + </para> + </listitem> + </varlistentry> + + </variablelist> + </para> + </refsect1> + + <refsect1 id='pam_listfile-examples'> + <title>EXAMPLES</title> + <para> + Classic 'ftpusers' authentication can be implemented with this entry + in <filename>/etc/pam.d/ftpd</filename>: + <programlisting> +# +# deny ftp-access to users listed in the /etc/ftpusers file +# +auth required pam_listfile.so \ + onerr=succeed item=user sense=deny file=/etc/ftpusers + </programlisting> + Note, users listed in <filename>/etc/ftpusers</filename> file are + (counterintuitively) <emphasis>not</emphasis> allowed access to + the ftp service. + </para> + <para> + To allow login access only for certain users, you can use a + <filename>/etc/pam.d/login</filename> entry like this: + <programlisting> +# +# permit login to users listed in /etc/loginusers +# +auth required pam_listfile.so \ + onerr=fail item=user sense=allow file=/etc/loginusers + </programlisting> + For this example to work, all users who are allowed to use the + login service should be listed in the file + <filename>/etc/loginusers</filename>. Unless you are explicitly + trying to lock out root, make sure that when you do this, you leave + a way for root to log in, either by listing root in + <filename>/etc/loginusers</filename>, or by listing a user who is + able to <emphasis>su</emphasis> to the root account. + </para> + </refsect1> + + <refsect1 id='pam_listfile-see_also'> + <title>SEE ALSO</title> + <para> + <citerefentry> + <refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam.d</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum> + </citerefentry> + </para> + </refsect1> + + <refsect1 id='pam_listfile-author'> + <title>AUTHOR</title> + <para> + pam_listfile was written by Michael K. Johnson <johnsonm@redhat.com> + and Elliot Lee <sopwith@cuc.edu>. + </para> + </refsect1> + +</refentry> |