diff options
Diffstat (limited to 'modules/pam_limits/pam_limits.8.xml')
| -rw-r--r-- | modules/pam_limits/pam_limits.8.xml | 257 |
1 files changed, 257 insertions, 0 deletions
diff --git a/modules/pam_limits/pam_limits.8.xml b/modules/pam_limits/pam_limits.8.xml new file mode 100644 index 0000000..bc46cbf --- /dev/null +++ b/modules/pam_limits/pam_limits.8.xml @@ -0,0 +1,257 @@ +<?xml version="1.0" encoding="ISO-8859-1"?> +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN" + "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"> + +<refentry id='pam_limits'> + + <refmeta> + <refentrytitle>pam_limits</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class='setdesc'>Linux-PAM Manual</refmiscinfo> + </refmeta> + + <refnamediv id='pam_limits-name'> + <refname>pam_limits</refname> + <refpurpose> + PAM module to limit resources + </refpurpose> + </refnamediv> + +<!-- body begins here --> + + <refsynopsisdiv> + <cmdsynopsis id="pam_limits-cmdsynopsis"> + <command>pam_limits.so</command> + <arg choice="opt"> + conf=<replaceable>/path/to/limits.conf</replaceable> + </arg> + <arg choice="opt"> + debug + </arg> + <arg choice="opt"> + set_all + </arg> + <arg choice="opt"> + utmp_early + </arg> + <arg choice="opt"> + noaudit + </arg> + </cmdsynopsis> + </refsynopsisdiv> + + + <refsect1 id="pam_limits-description"> + <title>DESCRIPTION</title> + <para> + The pam_limits PAM module sets limits on the system resources that can be + obtained in a user-session. Users of <emphasis>uid=0</emphasis> are affected + by this limits, too. + </para> + <para> + By default limits are taken from the <filename>/etc/security/limits.conf</filename> + config file. Then individual *.conf files from the <filename>/etc/security/limits.d/</filename> + directory are read. The files are parsed one after another in the order of "C" locale. + The effect of the individual files is the same as if all the files were + concatenated together in the order of parsing. + If a config file is explicitly specified with a module option then the + files in the above directory are not parsed. + </para> + <para> + The module must not be called by a multithreaded application. + </para> + <para> + If Linux PAM is compiled with audit support the module will report + when it denies access based on limit of maximum number of concurrent + login sessions. + </para> + </refsect1> + + <refsect1 id="pam_limits-options"> + <title>OPTIONS</title> + <variablelist> + <varlistentry> + <term> + <option>conf=<replaceable>/path/to/limits.conf</replaceable></option> + </term> + <listitem> + <para> + Indicate an alternative limits.conf style configuration file to + override the default. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <option>debug</option> + </term> + <listitem> + <para> + Print debug information. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <option>set_all</option> + </term> + <listitem> + <para> + Set the limits for which no value is specified in the + configuration file to the one from the process with the + PID 1. Please note that if the init process is systemd + these limits will not be the kernel default limits and + this option should not be used. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <option>utmp_early</option> + </term> + <listitem> + <para> + Some broken applications actually allocate a utmp entry for + the user before the user is admitted to the system. If some + of the services you are configuring PAM for do this, you can + selectively use this module argument to compensate for this + behavior and at the same time maintain system-wide consistency + with a single limits.conf file. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term> + <option>noaudit</option> + </term> + <listitem> + <para> + Do not report exceeded maximum logins count to the audit subsystem. + </para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1 id="pam_limits-types"> + <title>MODULE TYPES PROVIDED</title> + <para> + Only the <option>session</option> module type is provided. + </para> + </refsect1> + + <refsect1 id="pam_limits-return_values"> + <title>RETURN VALUES</title> + <variablelist> + <varlistentry> + <term>PAM_ABORT</term> + <listitem> + <para> + Cannot get current limits. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_IGNORE</term> + <listitem> + <para> + No limits found for this user. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_PERM_DENIED</term> + <listitem> + <para> + New limits could not be set. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_SERVICE_ERR</term> + <listitem> + <para> + Cannot read config file. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_SESSION_ERR</term> + <listitem> + <para> + Error recovering account name. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_SUCCESS</term> + <listitem> + <para> + Limits were changed. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term>PAM_USER_UNKNOWN</term> + <listitem> + <para> + The user is not known to the system. + </para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1 id="pam_limits-files"> + <title>FILES</title> + <variablelist> + <varlistentry> + <term><filename>/etc/security/limits.conf</filename></term> + <listitem> + <para>Default configuration file</para> + </listitem> + </varlistentry> + </variablelist> + </refsect1> + + <refsect1 id='pam_limits-examples'> + <title>EXAMPLES</title> + <para> + For the services you need resources limits (login for example) put a + the following line in <filename>/etc/pam.d/login</filename> as the last + line for that service (usually after the pam_unix session line): + </para> + <programlisting> +#%PAM-1.0 +# +# Resource limits imposed on login sessions via pam_limits +# +session required pam_limits.so + </programlisting> + <para> + Replace "login" for each service you are using this module. + </para> + </refsect1> + + <refsect1 id="pam_limits-see_also"> + <title>SEE ALSO</title> + <para> + <citerefentry> + <refentrytitle>limits.conf</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam.d</refentrytitle><manvolnum>5</manvolnum> + </citerefentry>, + <citerefentry> + <refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum> + </citerefentry>. + </para> + </refsect1> + + <refsect1 id="pam_limits-authors"> + <title>AUTHORS</title> + <para> + pam_limits was initially written by Cristian Gafton <gafton@redhat.com> + </para> + </refsect1> +</refentry> |