From de848d9e9146434817c65d74d1d0313e9d729462 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 27 Apr 2024 14:01:37 +0200 Subject: Adding upstream version 1.4.0. Signed-off-by: Daniel Baumann --- modules/pam_listfile/pam_listfile.8.xml | 297 ++++++++++++++++++++++++++++++++ 1 file changed, 297 insertions(+) create mode 100644 modules/pam_listfile/pam_listfile.8.xml (limited to 'modules/pam_listfile/pam_listfile.8.xml') diff --git a/modules/pam_listfile/pam_listfile.8.xml b/modules/pam_listfile/pam_listfile.8.xml new file mode 100644 index 0000000..15f047c --- /dev/null +++ b/modules/pam_listfile/pam_listfile.8.xml @@ -0,0 +1,297 @@ + + + + + + + pam_listfile + 8 + Linux-PAM Manual + + + + pam_listfile + deny or allow services based on an arbitrary file + + + + + pam_listfile.so + + item=[tty|user|rhost|ruser|group|shell] + + + sense=[allow|deny] + + + file=/path/filename + + + onerr=[succeed|fail] + + + apply=[user|@group] + + + quiet + + + + + + + DESCRIPTION + + + pam_listfile is a PAM module which provides a way to deny or + allow services based on an arbitrary file. + + + The module gets the of the type specified -- + user specifies the username, + PAM_USER; tty specifies the name of the terminal + over which the request has been made, PAM_TTY; + rhost specifies the name of the remote host (if any) from which the + request was made, PAM_RHOST; and ruser specifies + the name of the remote user (if available) who made the request, + PAM_RUSER -- and looks for an instance of that + item in the . + filename contains one line per item listed. If + the item is found, then if + , + PAM_SUCCESS is returned, causing the authorization + request to succeed; else if + , + PAM_AUTH_ERR is returned, causing the authorization + request to fail. + + + If an error is encountered (for instance, if + filename does not exist, or a poorly-constructed + argument is encountered), then if onerr=succeed, + PAM_SUCCESS is returned, otherwise if + onerr=fail, PAM_AUTH_ERR or + PAM_SERVICE_ERR (as appropriate) will be returned. + + + An additional argument, , can be used + to restrict the application of the above to a specific user + () + or a given group + (). + This added restriction is only meaningful when used with the + tty, rhost and + shell items. + + + Besides this last one, all arguments should be specified; do not + count on any default behavior. + + + No credentials are awarded by this module. + + + + + + OPTIONS + + + + + + + + + + What is listed in the file and should be checked for. + + + + + + + + + + + Action to take if found in file, if the item is NOT found in + the file, then the opposite action is requested. + + + + + + + + + + + File containing one item per line. The file needs to be a plain + file and not world writable. + + + + + + + + + + + What to do if something weird happens like being unable to open + the file. + + + + + + + + + + + Restrict the user class for which the restriction apply. Note that + with this does not make sense, + but for it have a meaning. + + + + + + + + + + + Do not treat service refusals or missing list files as + errors that need to be logged. + + + + + + + + + + MODULE TYPES PROVIDED + + All module types (, , + and ) are provided. + + + + + RETURN VALUES + + + + + PAM_AUTH_ERR + + Authentication failure. + + + + + PAM_BUF_ERR + + + Memory buffer error. + + + + + + PAM_IGNORE + + + The rule does not apply to the option. + + + + + + PAM_SERVICE_ERR + + + Error in service module. + + + + + + PAM_SUCCESS + + + Success. + + + + + + + + + + EXAMPLES + + Classic 'ftpusers' authentication can be implemented with this entry + in /etc/pam.d/ftpd: + +# +# deny ftp-access to users listed in the /etc/ftpusers file +# +auth required pam_listfile.so \ + onerr=succeed item=user sense=deny file=/etc/ftpusers + + Note, users listed in /etc/ftpusers file are + (counterintuitively) not allowed access to + the ftp service. + + + To allow login access only for certain users, you can use a + /etc/pam.d/login entry like this: + +# +# permit login to users listed in /etc/loginusers +# +auth required pam_listfile.so \ + onerr=fail item=user sense=allow file=/etc/loginusers + + For this example to work, all users who are allowed to use the + login service should be listed in the file + /etc/loginusers. Unless you are explicitly + trying to lock out root, make sure that when you do this, you leave + a way for root to log in, either by listing root in + /etc/loginusers, or by listing a user who is + able to su to the root account. + + + + + SEE ALSO + + + pam.conf5 + , + + pam.d5 + , + + pam8 + + + + + + AUTHOR + + pam_listfile was written by Michael K. Johnson <johnsonm@redhat.com> + and Elliot Lee <sopwith@cuc.edu>. + + + + -- cgit v1.2.3