summaryrefslogtreecommitdiff
path: root/doc/modules/pam_access.sgml
blob: e192d12e513f3a11ec3eb52531615dec3d046886 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
<!--
   
   pam_access module docs added by Tim Berger <timb@transmeta.com>

-->

<sect1> The access module

<sect2>Synopsis

<p>
<descrip>

<tag><bf>Module Name:</bf></tag>

<tt>pam_access</tt>


<tag><bf>Author[s]:</bf></tag>

Alexei Nogin &lt;alexei@nogin.dnttm.ru&gt;

<tag><bf>Maintainer:</bf></tag>
	
Author

<tag><bf>Management groups provided:</bf></tag>

account

<tag><bf>Cryptographically sensitive:</bf></tag>

<tag><bf>Security rating:</bf></tag>

<tag><bf>Clean code base:</bf></tag>

<tag><bf>System dependencies:</bf></tag>
Requires a configuration file <tt>/etc/security/access.conf</tt>
<tag><bf>Network aware:</bf></tag>

Through <tt/PAM_TTY/ if set, otherwise attempts getting tty name of
the stdin file descriptor with <tt/ttyname()/.  Standard
gethostname(), <tt/yp_get_default_domain()/, <tt/gethostbyname()/
calls.  <bf/NIS/ is used for netgroup support.

</descrip>

<sect2>Overview of module

<p>
Provides logdaemon style login access control.

<sect2> Account component

<p>
<descrip>

<tag><bf>Recognized arguments:</bf></tag>

<tag><bf>Description:</bf></tag>

This module provides logdaemon style login access control based on
login names and on host (or domain) names, internet addresses (or
network numbers), or on terminal line names in case of non-networked
logins. Diagnostics are reported through <tt/syslog(3)/.  Wietse
Venema's <tt/login_access.c/ from <em/logdaemon-5.6/ is used with
several changes by A. Nogin.

<tag><bf>Examples/suggested usage:</bf></tag>

Use of module is recommended, for example, on administrative machines
such as <bf/NIS/ servers and mail servers where you need several accounts
active but don't want them all to have login capability.

For <tt>/etc/pam.d</tt> style configurations where your modules live
in <tt>/lib/security</tt>, start by adding the following line to
<tt>/etc/pam.d/login</tt>, <tt>/etc/pam.d/rlogin</tt>,
<tt>/etc/pam.d/rsh</tt> and <tt>/etc/pam.d/ftp</tt>:

<tscreen>
<verb>
account  required       /lib/security/pam_access.so
</verb>
</tscreen>

Note that use of this module is not effective unless your system ignores
<tt>.rhosts</tt> files.  See the the pam_rhosts_auth documentation.

A sample <tt>access.conf</tt> configuration file is included with the
distribution.

</descrip>