blob: 1ba4ee71dcd4faee1bf5293c718d1bdf823689f0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
|
<?xml version="1.0" encoding='UTF-8'?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
"http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd">
<refentry id='pam_usertype'>
<refmeta>
<refentrytitle>pam_usertype</refentrytitle>
<manvolnum>8</manvolnum>
<refmiscinfo class='sectdesc'>Linux-PAM</refmiscinfo>
</refmeta>
<refnamediv id='pam_usertype-name'>
<refname>pam_usertype</refname>
<refpurpose>check if the authenticated user is a system or regular account</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis id='pam_usertype-cmdsynopsis'>
<command>pam_usertype.so</command>
<arg choice='opt' rep='repeat'><replaceable>flag</replaceable></arg>
<arg choice='req'><replaceable>condition</replaceable></arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1 id='pam_usertype-description'>
<title>DESCRIPTION</title>
<para>
pam_usertype.so is designed to succeed or fail authentication
based on type of the account of the authenticated user.
The type of the account is decided with help of
<emphasis>SYS_UID_MIN</emphasis> and <emphasis>SYS_UID_MAX</emphasis>
settings in <emphasis>/etc/login.defs</emphasis>. One use is to select
whether to load other modules based on this test.
</para>
<para>
The module should be given only one condition as module argument.
Authentication will succeed only if the condition is met.
</para>
</refsect1>
<refsect1 id="pam_usertype-options">
<title>OPTIONS</title>
<para>
The following <emphasis>flag</emphasis>s are supported:
</para>
<variablelist>
<varlistentry>
<term><option>use_uid</option></term>
<listitem>
<para>
Evaluate conditions using the account of the user whose UID
the application is running under instead of the user being
authenticated.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>audit</option></term>
<listitem>
<para>
Log unknown users to the system log.
</para>
</listitem>
</varlistentry>
</variablelist>
<para>
Available <emphasis>condition</emphasis>s are:
</para>
<variablelist>
<varlistentry>
<term><option>issystem</option></term>
<listitem>
<para>Succeed if the user is a system user.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>isregular</option></term>
<listitem>
<para>Succeed if the user is a regular user.</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1 id="pam_usertype-types">
<title>MODULE TYPES PROVIDED</title>
<para>
All module types (<option>account</option>, <option>auth</option>,
<option>password</option> and <option>session</option>) are provided.
</para>
</refsect1>
<refsect1 id='pam_usertype-return_values'>
<title>RETURN VALUES</title>
<variablelist>
<varlistentry>
<term>PAM_SUCCESS</term>
<listitem>
<para>
The condition was true.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>PAM_AUTH_ERR</term>
<listitem>
<para>
The condition was false.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>PAM_SERVICE_ERR</term>
<listitem>
<para>
A service error occurred or the arguments can't be
parsed correctly.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>PAM_USER_UNKNOWN</term>
<listitem>
<para>
User was not found.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1 id='pam_usertype-examples'>
<title>EXAMPLES</title>
<para>
Skip remaining modules if the user is a system user:
</para>
<programlisting>
account sufficient pam_usertype.so issystem
</programlisting>
</refsect1>
<refsect1 id='pam_usertype-see_also'>
<title>SEE ALSO</title>
<para>
<citerefentry>
<refentrytitle>login.defs</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum>
</citerefentry>
</para>
</refsect1>
<refsect1 id='pam_usertype-author'>
<title>AUTHOR</title>
<para>Pavel Březina <pbrezina@redhat.com></para>
</refsect1>
</refentry>
|
