From 333f7ecfa3e040191c66b2b92f6c117ca2cbac1d Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 27 Apr 2024 14:50:00 +0200 Subject: Adding upstream version 1:4.8.1. Signed-off-by: Daniel Baumann --- man/suauth.5.xml | 229 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 229 insertions(+) create mode 100644 man/suauth.5.xml (limited to 'man/suauth.5.xml') diff --git a/man/suauth.5.xml b/man/suauth.5.xml new file mode 100644 index 0000000..97ef6d1 --- /dev/null +++ b/man/suauth.5.xml @@ -0,0 +1,229 @@ + + + +]> + + + + + Marek + Michałkiewicz + Creation, 1996 + + + Thomas + Kłoczko + kloczek@pld.org.pl + shadow-utils maintainer, 2000 - 2007 + + + Nicolas + François + nicolas.francois@centraliens.net + shadow-utils maintainer, 2007 - now + + + + suauth + 5 + File Formats and Conversions + shadow-utils + &SHADOW_UTILS_VERSION; + + + suauth + detailed su control file + + + + + /etc/suauth + + + + + DESCRIPTION + + The file /etc/suauth is referenced whenever the + su command is called. It can change the behaviour of the su command, + based upon: + + + + + 1) the user su is targeting + + + + 2) the user executing the su command (or any groups he might be + a member of) + + + + The file is formatted like this, with lines starting with a # being + treated as comment lines and ignored; + + + + to-id:from-id:ACTION + + + + Where to-id is either the word ALL, a list of + usernames delimited by "," or the words ALL + EXCEPT followed by a list of usernames delimited by ",". + + + + from-id is formatted the same as to-id except the extra word + GROUP is recognized. ALL EXCEPT + GROUP is perfectly valid too. Following + GROUP appears one or more group names, delimited + by ",". It is not sufficient to have primary group id of the relevant + group, an entry in + /etc/group + 5 is necessary. + + + + Action can be one only of the following currently supported options. + + + + + DENY + + + The attempt to su is stopped before a password is + even asked for. + + + + + + NOPASS + + + + The attempt to su is automatically successful; no password is + asked for. + + + + + + OWNPASS + + + + For the su command to be successful, the user must enter his or + her own password. They are told this. + + + + + + + Note there are three separate fields delimited by a colon. No + whitespace must surround this colon. Also note that the file is + examined sequentially line by line, and the first applicable rule is + used without examining the file further. This makes it possible for a + system administrator to exercise as fine control as he or she wishes. + + + + + EXAMPLE + + # sample /etc/suauth file + # + # A couple of privileged usernames may + # su to root with their own password. + # + root:chris,birddog:OWNPASS + # + # Anyone else may not su to root unless in + # group wheel. This is how BSD does things. + # + root:ALL EXCEPT GROUP wheel:DENY + # + # Perhaps terry and birddog are accounts + # owned by the same person. + # Access can be arranged between them + # with no password. + # + terry:birddog:NOPASS + birddog:terry:NOPASS + # + + + + + + FILES + + + /etc/suauth + + + + + + + BUGS + + There could be plenty lurking. The file parser is particularly + unforgiving about syntax errors, expecting no spurious whitespace + (apart from beginning and end of lines), and a specific token + delimiting different things. + + + + + DIAGNOSTICS + + An error parsing the file is reported using + syslogd8 + as level ERR on facility AUTH. + + + + + SEE ALSO + + + su1 + . + + + -- cgit v1.2.3