diff options
Diffstat (limited to 'modules/pam_access/access.conf')
| -rw-r--r-- | modules/pam_access/access.conf | 28 |
1 files changed, 18 insertions, 10 deletions
diff --git a/modules/pam_access/access.conf b/modules/pam_access/access.conf index b22f1d43..74c5fbe8 100644 --- a/modules/pam_access/access.conf +++ b/modules/pam_access/access.conf @@ -1,14 +1,14 @@ # Login access control table. -# +# # Comment line must start with "#", no space at front. # Order of lines is important. # # When someone logs in, the table is scanned for the first entry that # matches the (user, host) combination, or, in case of non-networked # logins, the first entry that matches the (user, tty) combination. The -# permissions field of that table entry determines whether the login will +# permissions field of that table entry determines whether the login will # be accepted or refused. -# +# # Format of the login access control table is three fields separated by a # ":" character: # @@ -17,11 +17,11 @@ # '|'. This is useful for configurations where you are trying to use # pam_access with X applications that provide PAM_TTY values that are # the display variable like "host:0".] -# +# # permission : users : origins -# +# # The first field should be a "+" (access granted) or "-" (access denied) -# character. +# character. # # The second field should be a list of one or more login names, group # names, or ALL (always matches). A pattern of the form user@host is @@ -42,20 +42,28 @@ # The group file is searched only when a name does not match that of the # logged-in user. Both the user's primary group is matched, as well as # groups in which users are explicitly listed. +# To avoid problems with accounts, which have the same name as a group, +# you can use brackets around group names '(group)' to differentiate. +# In this case, you should also set the "nodefgroup" option. # # TTY NAMES: Must be in the form returned by ttyname(3) less the initial # "/dev" (e.g. tty1 or vc/1) # ############################################################################## -# +# # Disallow non-root logins on tty1 # #-:ALL EXCEPT root:tty1 -# +# # Disallow console logins to all but a few accounts. # #-:ALL EXCEPT wheel shutdown sync:LOCAL # +# Same, but make sure that really the group wheel and not the user +# wheel is used (use nodefgroup argument, too): +# +#-:ALL EXCEPT (wheel) shutdown sync:LOCAL +# # Disallow non-local logins to privileged accounts (group wheel). # #-:wheel:ALL EXCEPT LOCAL .win.tue.nl @@ -87,7 +95,7 @@ # Uses string matching also. #+ : root : .foo.bar.org # -# User "root" should be denied to get access from all other sources. +# User "root" should be denied to get access from all other sources. #- : root : ALL # # User "foo" and members of netgroup "nis_group" should be @@ -111,4 +119,4 @@ #+ : john : 2001:4ca0:0:101::/64 # # All other users should be denied to get access from all sources. -#- : ALL : ALL +#- : ALL : ALL |