title: crm_simulate(8)

text:
# crm_simulate(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_simulate <data source> <operation> [options]

## DESCRIPTION
crm_simulate - simulate a Pacemaker cluster's response to events

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-operations

Show operations options

--help-synthetic

Show synthetic cluster event options

--help-artifact

Show artifact options

--help-source

Show data source options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Operations:
-R, --run

Process the supplied input and show what actions the cluster will take in response

-S, --simulate

Like --run, but also simulate taking those actions and show the resulting new status

-X, --in-place

Like --simulate, but also store the results back to the input file

-A, --show-attrs

Show node attributes

-c, --show-failcounts

Show resource fail counts

-s, --show-scores

Show allocation scores

-U, --show-utilization

Show utilization information

-P, --profile=DIR

Process all the XML files in the named directory to create profiling data

-N, --repeat=N

With --profile, repeat each test N times and print timings

### Synthetic Cluster Events:
-u, --node-up=NODE

Simulate bringing a node online

-d, --node-down=NODE

Simulate taking a node offline

-f, --node-fail=NODE

Simulate a node failing

-i, --op-inject=OPSPEC

Generate a failure for the cluster to react to in the simulation. See `Operation Specification` help for more information.

-F, --op-fail=OPSPEC

If the specified task occurs during the simulation, have it fail with return code ${rc}. The transition will normally stop at the failed action. Save the result with --save-output and re-run with --xml-file. See `Operation Specification` help for more information.

-t, --set-datetime=DATETIME

Set date/time (ISO 8601 format, see https://en.wikipedia.org/wiki/ISO_8601)

-q, --quorum=QUORUM

Set to '1' (or 'true') to indicate cluster has quorum

-w, --watchdog=DEVICE

Set to '1' (or 'true') to indicate cluster has an active watchdog device

-g, --ticket-grant=TICKET

Simulate granting a ticket

-r, --ticket-revoke=TICKET

Simulate revoking a ticket

-b, --ticket-standby=TICKET

Simulate making a ticket standby

-e, --ticket-activate=TICKET

Simulate activating a ticket

### Artifact Options:
-I, --save-input=FILE

Save the input configuration to the named file

-O, --save-output=FILE

Save the output configuration to the named file

-G, --save-graph=FILE

Save the transition graph (XML format) to the named file

-D, --save-dotfile=FILE

Save the transition graph (DOT format) to the named file

-a, --all-actions

Display all possible actions in DOT graph (even if not part of transition)

### Data Source:
-L, --live-check

Connect to CIB manager and use the current CIB contents as input

-x, --xml-file=FILE

Retrieve XML from the named file

-p, --xml-pipe

Retrieve XML from stdin

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-Q, --quiet

Display only essential output

## OPERATION SPECIFICATION
The OPSPEC in any command line option is of the form ${resource}_${task}_${interval_in_ms}@${node}=${rc} (memcached_monitor_20000@bart.example.com=7, for example). ${rc} is an OCF return code. For more information on these return codes, refer to https://clusterlabs.org/pacemaker/doc/2.1/Pacemaker_Administration/html/agents.html#ocf-return-codes

## EXAMPLES
Pretend a recurring monitor action found memcached stopped on node fred.example.com and, during recovery, that the memcached stop action failed:

crm_simulate -LS --op-inject memcached:0_monitor_20000@bart.example.com=7 --op-fail memcached:0_stop_0@fred.example.com=1 --save-output /tmp/memcached-test.xml

Now see what the reaction to the stop failed would be:

crm_simulate -S --xml-file /tmp/memcached-test.xml

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


package: pacemaker-cli

title: crm_standby(8)

text:
# crm_standby(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_standby <command> [options]

## DESCRIPTION
crm_standby - Query, enable, or disable standby mode for a node

Nodes in standby mode may not host cluster resources.

### Common options:
--help

Display this text, then exit

--version

Display version information, then exit

-V, --verbose

Specify multiple times to increase debug output

-q, --quiet

Print only the standby status (if querying)

### Commands:
-G, --query

Query the current value of standby mode (on/off)

-v, --update=VALUE

Update the value of standby mode (on/off)

-D, --delete

Let standby mode use default value

### Additional Options:
-N, --node=NODE

Operate on the named node instead of the current one

-l, --lifetime=VALUE

Until when should the setting take effect (valid values: reboot, forever)

-i, --id=VALUE

(Advanced) XML ID used to identify standby attribute

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: crm_ticket(8)

text:
# crm_ticket(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_ticket <query>|<command> [options]

## DESCRIPTION
Perform tasks related to cluster tickets

Allows ticket attributes to be queried, modified and deleted.

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-queries

Show queries

--help-commands

Show command options

--help-advanced

Show advanced options

--help-additional

Show additional options

--help-deprecated

Show deprecated options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Queries:
-l, --info

Display the information of ticket(s)

-L, --details

Display the details of ticket(s)

-w, --raw

Display the IDs of ticket(s)

-q, --query-xml

Query the XML of ticket(s)

-c, --constraints

Display the rsc_ticket constraints that apply to ticket(s)

### Commands:
-g, --grant

Grant a ticket to this cluster site

-r, --revoke

Revoke a ticket from this cluster site

-s, --standby

Tell this cluster site this ticket is standby

-a, --activate

Tell this cluster site this ticket is active

### Advanced Options:
-G, --get-attr=ATTRIBUTE

Display the named attribute for a ticket

-S, --set-attr=ATTRIBUTE

Set the named attribute for a ticket

-D, --delete-attr=ATTRIBUTE

Delete the named attribute for a ticket

-C, --cleanup

Delete all state of a ticket at this cluster site

### Additional Options:
-v, --attr-value=VALUE

Attribute value to use with -S

-d, --default=VALUE

(Advanced) Default attribute value to display if none is found (for use with -G)

-f, --force

(Advanced) Force the action to be performed

-t, --ticket=ID

Ticket ID

### Deprecated Options:
-n, --set-name=ID

(Advanced) ID of the instance_attributes object to change

-i, --nvpair=ID

(Advanced) ID of the nvpair object to change/delete

-Q, --quiet

Print only the value on stdout

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

## EXAMPLES
Display the info of tickets:

crm_ticket --info

Display the detailed info of tickets:

crm_ticket --details

Display the XML of 'ticketA':

crm_ticket --ticket ticketA --query-xml

Display the rsc_ticket constraints that apply to 'ticketA':

crm_ticket --ticket ticketA --constraints

Grant 'ticketA' to this cluster site:

crm_ticket --ticket ticketA --grant

Revoke 'ticketA' from this cluster site:

crm_ticket --ticket ticketA --revoke

Make 'ticketA' standby (the cluster site will treat a granted 'ticketA' as 'standby', and the dependent resources will be stopped or demoted gracefully without triggering loss-policies):

crm_ticket --ticket ticketA --standby

Activate 'ticketA' from being standby:

crm_ticket --ticket ticketA --activate

Get the value of the 'granted' attribute for 'ticketA':

crm_ticket --ticket ticketA --get-attr granted

Set the value of the 'standby' attribute for 'ticketA':

crm_ticket --ticket ticketA --set-attr standby --attr-value true

Delete the 'granted' attribute for 'ticketA':

crm_ticket --ticket ticketA --delete-attr granted

Erase the operation history of 'ticketA' at this cluster site, causing the cluster site to 'forget' the existing ticket state:

crm_ticket --ticket ticketA --cleanup

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: crm_verify(8)

text:
# crm_verify(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crm_verify [<options>]

## DESCRIPTION
Check a Pacemaker configuration for errors

Check the well-formedness of a complete Pacemaker XML configuration, its conformance to the configured schema, and the presence of common misconfigurations. Problems reported as errors must be fixed before the cluster will work properly. It is left to the administrator to decide whether to fix problems reported as warnings.

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-data

Show data options

--help-additional

Show additional options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Data sources:
-L, --live-check

Check the configuration used by the running cluster

-x, --xml-file=FILE

Check the configuration in the named file

-p, --xml-pipe

Check the configuration piped in via stdin

-X, --xml-text=XML

Check the configuration in the supplied string

### Additional options:
-S, --save-xml=FILE

Save verified XML to named file (most useful with -L)

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-q, --quiet

Don't print verify information

## EXAMPLES
Check the consistency of the configuration in the running cluster:

crm_verify --live-check

Check the consistency of the configuration in a given file and produce quiet output:

crm_verify --xml-file file.xml --quiet

Check the consistency of the configuration in a given file and produce verbose output:

crm_verify --xml-file file.xml --verbose

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


crmadmin

title: crmadmin(8)

text:
# crmadmin(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
crmadmin [options] [node]

## DESCRIPTION
query and manage the Pacemaker controller

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-command

Show command options

--help-additional

Show additional options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Commands:
-S, --status=NODE

Display the status of the specified node. Result is state of node's internal finite state machine, which can be useful for debugging

-P, --pacemakerd

Display the status of local pacemakerd. Result is the state of the sub-daemons watched by pacemakerd.

-D, --dc_lookup

Display the uname of the node co-ordinating the cluster. This is an internal detail rarely useful to administrators except when deciding on which node to examine the logs.

-N, --nodes=TYPE

Display the uname of all member nodes [optionally filtered by type (comma-separated)] Types: all (default), cluster, guest, remote

### Additional Options:
-t, --timeout=DURATION

Time to wait before declaring the operation failed (default 30s; use 0 to disable timeout)

-B, --bash-export

Display nodes as shell commands of the form 'export uname=uuid' (valid with -N/--nodes)

-i, --ipc-name=NAME

Name to use for ipc instead of 'crmadmin' (with -P/--pacemakerd).

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-q, --quiet

Display only the essential query information

## NOTES
DURATION in any command line option can be specified as an integer number of seconds, an integer plus units (ms, msec, us, usec, s, sec, m, min, h, or hr), or an ISO 8601 period specification.

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors

## REPORTING BUGS
Report bugs to https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker


title: fence_watchdog(8)

text:
# fence_watchdog(8)

## NAME
fence_watchdog - Part of the Pacemaker cluster resource manager

## DESCRIPTION
fence_watchdog just provides meta-data - actual fencing is done by the pacemaker internal watchdog agent.

### Usage:

fence_watchdog [options]

## OPTIONS
-o, --action=[action]

Action: metadata

-N, --nodename

Node name of fence target (ignored)

-n, --plug=[id]

Physical plug number on device (ignored)

-V, --version

Display version information and exit

-h, --help

Display this help and exit


title: iso8601(8)

text:
# iso8601(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
iso8601 <command> [options]

## DESCRIPTION
Display and parse ISO 8601 dates and times

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-commands

Show command options

--help-modifiers

Show output modifiers

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Commands:
-n, --now

Display the current date/time

-d, --date=DATE

Parse an ISO 8601 date/time (for example, '2019-09-24 00:30:00 +01:00' or '2019-040')

-p, --period=PERIOD

Parse an ISO 8601 period (interval) with start time (for example, '2005-040/2005-043')

-D, --duration=DURATION

Parse an ISO 8601 duration (for example, 'P1M')

-E, --expected=TEXT

Exit with error status if result does not match this text. Requires: -n or -d

### Output modifiers:
-s, --seconds

Show result as a seconds since 0000-001 00:00:00Z

-S, --epoch

Show result as a seconds since EPOCH (1970-001 00:00:00Z)

-L, --local

Show result as a 'local' date/time

-O, --ordinal

Show result as an 'ordinal' date/time

-W, --week

Show result as an 'calendar week' date/time

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

For more information on the ISO 8601 standard, see https://en.wikipedia.org/wiki/ISO_8601

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors


title: stonith_admin(8)

text:
# stonith_admin(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
stonith_admin <command> [<options>]

## DESCRIPTION
stonith_admin - Access the Pacemaker fencing API

## OPTIONS

### Help Options:
-?, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

--help-definition

Show device definition help

--help-queries

Show query help

--help-fence

Show fence help

--help-additional

Show additional options

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), html, xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

--html-cgi

Add CGI headers (requires --output-as=html)

--html-stylesheet=URI

Link to an external stylesheet (requires --output-as=html)

--html-title=TITLE

Specify a page title (requires --output-as=html)

### Device Definition Commands:
-R, --register=DEVICE

Register the named stonith device. Requires: --agent. Optional: --option, --env-option.

-D, --deregister=DEVICE

De-register the named stonith device.

-r, --register-level=TARGET

Register a stonith level for the named target, specified as one of NAME, @PATTERN, or ATTR=VALUE. Requires: --index and one or more --device entries.

-d, --deregister-level=TARGET

Unregister a stonith level for the named target, specified as for --register-level. Requires: --index

### Queries:
-l, --list=HOST

List devices that can terminate the specified host. Optional: --timeout

-L, --list-registered

List all registered devices. Optional: --timeout.

-I, --list-installed

List all installed devices. Optional: --timeout.

-s, --list-targets=DEVICE

List the targets that can be fenced by the named device. Optional: --timeout.

-M, --metadata

Show agent metadata. Requires: --agent. Optional: --timeout.

-Q, --query=DEVICE

Check the named device's status. Optional: --timeout.

-H, --history=NODE

Show last successful fencing operation for named node (or '*' for all nodes). Optional: --timeout, --cleanup, --quiet (show only the operation's epoch timestamp), --verbose (show all recorded and pending operations), --broadcast (update history from all nodes available).

-h, --last=NODE

Indicate when the named node was last fenced. Optional: --as-node-id.

-K, --validate

Validate a fence device configuration. Requires: --agent. Optional: --option, --env-option, --quiet (print no output, only return status).

### Fencing Commands:
-F, --fence=HOST

Fence named host. Optional: --timeout, --tolerance, --delay.

-U, --unfence=HOST

Unfence named host. Optional: --timeout, --tolerance, --delay.

-B, --reboot=HOST

Reboot named host. Optional: --timeout, --tolerance, --delay.

-C, --confirm=HOST

Tell cluster that named host is now safely down.

### Additional Options:
-c, --cleanup

Cleanup wherever appropriate. Requires --history.

-b, --broadcast

Broadcast wherever appropriate.

-a, --agent=AGENT

The agent to use (for example, fence_xvm; with --register, --metadata, --validate).

-o, --option=PARAM

Specify a device configuration parameter as NAME=VALUE (may be specified multiple times; with --register, --validate).

-e, --env-option=PARAM

Specify a device configuration parameter with the specified name, using the value of the environment variable of the same name prefixed with OCF_RESKEY_ (may be specified multiple times; with --register, --validate).

-T, --tag=TAG

Identify fencing operations in logs with the specified tag; useful when multiple entities might invoke stonith_admin (used with most commands).

-v, --device=DEVICE

Device ID (with --register-level, device to associate with a given host and level; may be specified multiple times) (with --validate, name to use to load CIB secrets).

-i, --index=LEVEL

The stonith level (1-9) (with --register-level, --deregister-level).

-t, --timeout=SECONDS

Operation timeout in seconds (default 120; used with most commands).

-y, --delay=SECONDS

Apply a fencing delay in seconds. Any static/random delays from pcmk_delay_base/max will be added, otherwise all disabled with the value -1 (default 0; with --fence, --reboot, --unfence).

-n, --as-node-id

(Advanced) The supplied node is the corosync node ID (with --last).

--tolerance=SECONDS

(Advanced) Do nothing if an equivalent --fence request succeeded less than this many seconds earlier (with --fence, --unfence, --reboot).

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-q, --quiet

Be less descriptive in output.

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors

## REPORTING BUGS
Report bugs to https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker


pacemaker-remoted

package: pacemaker-remote

title: pacemaker-remoted(8)

text:
# pacemaker-remoted(8)

## NAME
Pacemaker - Part of the Pacemaker cluster resource manager

## SYNOPSIS
pacemaker-remoted [options]

## DESCRIPTION
resource agent executor daemon for Pacemaker Remote nodes

## OPTIONS

### Help Options:
-h, --help

Show help options

--help-all

Show all help options

--help-output

Show output help

### Output Options:
--output-as=FORMAT

Specify output format as one of: text (default), xml

--output-to=DEST

Specify file name for output (or "-" for stdout)

### Application Options:
-$, --version

Display software version and exit

-V, --verbose

Increase debug output (may be specified multiple times)

-l, --logfile

Send logs to the additional named logfile

-p, --port

Port to listen on (defaults to 3121)

## AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors

## REPORTING BUGS
Report bugs to https://bugs.clusterlabs.org/enter_bug.cgi?product=Pacemaker


PAM

package: pam

title: PAM(8)

text:
# PAM(8)

## NAME
PAM, pam - Pluggable Authentication Modules for Linux

## DESCRIPTION
This manual is intended to offer a quick introduction to Linux-PAM. For more information the reader is directed to the Linux-PAM system administrators' guide.

Linux-PAM is a system of libraries that handle the authentication tasks of applications (services) on the system. The library provides a stable general interface (Application Programming Interface - API) that privilege granting programs (such as login(1) and su(1)) defer to to perform standard authentication tasks.

The principal feature of the PAM approach is that the nature of the authentication is dynamically configurable. In other words, the system administrator is free to choose how individual service-providing applications will authenticate users. This dynamic configuration is set by the contents of the single Linux-PAM configuration file /etc/pam.conf. Alternatively and preferably, the configuration can be set by individual configuration files located in a pam.d directory. The presence of this directory will cause Linux-PAM to ignore /etc/pam.conf.

Vendor-supplied PAM configuration files might be installed in the system directory /usr/lib/pam.d/ or a configurable vendor specific directory instead of the machine configuration directory /etc/pam.d/. If no machine configuration file is found, the vendor-supplied file is used. All files in /etc/pam.d/ override files with the same name in other directories.

From the point of view of the system administrator, for whom this manual is provided, it is not of primary importance to understand the internal behavior of the Linux-PAM library. The important point to recognize is that the configuration file(s) define the connection between applications (services) and the pluggable authentication modules (PAMs) that perform the actual authentication tasks.

Linux-PAM separates the tasks of authentication into four independent management groups: account management; authentication management; password management; and session management. (We highlight the abbreviations used for these groups in the configuration file.)

Simply put, these groups take care of different aspects of a typical user's request for a restricted service:

account - provide account verification types of service: has the user's password expired?; is this user permitted access to the requested service?

authentication - authenticate a user and set up user credentials. Typically this is via some challenge-response request that the user must satisfy: if you are who you claim to be please enter your password. Not all authentications are of this type, there exist hardware based authentication schemes (such as the use of smart-cards and biometric devices), with suitable modules, these may be substituted seamlessly for more standard approaches to authentication - such is the flexibility of Linux-PAM.

password - this group's responsibility is the task of updating authentication mechanisms. Typically, such services are strongly coupled to those of the auth group. Some authentication mechanisms lend themselves well to being updated with such a function. Standard UN*X password-based access is the obvious example: please enter a replacement password.

session - this group of tasks cover things that should be done prior to a service being given and after it is withdrawn. Such tasks include the maintenance of audit trails and the mounting of the user's home directory. The session management group is important as it provides both an opening and closing hook for modules to affect the services available to a user.

## FILES
/etc/pam.conf

the configuration file

/etc/pam.d

the Linux-PAM configuration directory. Generally, if this directory is present, the /etc/pam.conf file is ignored.

/usr/lib/pam.d

the Linux-PAM vendor configuration directory. Files in /etc/pam.d override files with the same name in this directory.

## ERRORS
Typically errors generated by the Linux-PAM system of libraries, will be written to syslog(3).

## CONFORMING TO
DCE-RFC 86.0, October 1995. Contains additional features, but remains backwardly compatible with this RFC.

## SEE ALSO
pam(3), pam_authenticate(3), pam_sm_setcred(3), pam_strerror(3), PAM(8)


faillock

title: faillock(8)

text:
# faillock(8)

## NAME
faillock - Tool for displaying and modifying the authentication failure record files

## SYNOPSIS
faillock [--dir /path/to/tally-directory] [--user username] [--reset]

## DESCRIPTION
The pam_faillock.so module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than deny consecutive failed authentications. It stores the failure records into per-user files in the tally directory.

The faillock command is an application which can be used to examine and modify the contents of the tally files. It can display the recent failed authentication attempts of the username or clear the tally files of all or individual usernames.

## OPTIONS
--conf /path/to/config-file

The file where the configuration is located. The default is /etc/security/faillock.conf.

--dir /path/to/tally-directory

The directory where the user files with the failure records are kept. The priority to set this option is to use the value provided from the command line. If this isn't provided, then the value from the configuration file is used. Finally, if neither of them has been provided, then /var/run/faillock is used.

--user username

The user whose failure records should be displayed or cleared.

--reset

Instead of displaying the user's failure records, clear them.

## FILES
/var/run/faillock/*

the files logging the authentication failures for users

## SEE ALSO
pam_faillock(8), pam(8)

## AUTHOR
faillock was written by Tomas Mraz.


title: mkhomedir_helper(8)

text:
# mkhomedir_helper(8)

## NAME
mkhomedir_helper - Helper binary that creates home directories

## SYNOPSIS
mkhomedir_helper {user} [umask [ path-to-skel [ home_mode ] ]]

## DESCRIPTION
mkhomedir_helper is a helper program for the pam_mkhomedir module that creates home directories and populates them with contents of the specified skel directory.

The default value of umask is 0077 and the default value of path-to-skel is /etc/skel. The default value of home_mode is computed from the value of umask.

The helper is separated from the module to not require direct access from login SELinux domains to the contents of user home directories. The SELinux domain transition happens when the module is executing the mkhomedir_helper.

The helper never touches home directories if they already exist.

## SEE ALSO
pam_mkhomedir(8)

## AUTHOR
Written by Tomas Mraz based on the code originally in pam_mkhomedir module.


title: pam_access(8)

text:
# pam_access(8)

## NAME
pam_access - PAM module for logdaemon style login access control

## SYNOPSIS
pam_access.so [debug] [nodefgroup] [noaudit] [quiet_log] [accessfile=file] [fieldsep=sep] [listsep=sep]

## DESCRIPTION
The pam_access PAM module is mainly for access management. It provides logdaemon style login access control based on login names, host or domain names, internet addresses or network numbers, or on terminal line names, X $DISPLAY values, or PAM service names in case of non-networked logins.

By default rules for access management are taken from config file /etc/security/access.conf if you don't specify another file. Then individual *.conf files from the /etc/security/access.d/ directory are read. The files are parsed one after another in the order of the system locale. The effect of the individual files is the same as if all the files were concatenated together in the order of parsing. This means that once a pattern is matched in some file no further files are parsed. If a config file is explicitly specified with the accessfile option the files in the above directory are not parsed.

If Linux PAM is compiled with audit support the module will report when it denies access based on origin (host, tty, etc.).

## OPTIONS
accessfile=/path/to/access.conf

Indicate an alternative access.conf style configuration file to override the default. This can be useful when different services need different access lists.

debug

A lot of debug information is printed with syslog(3).

noaudit

Do not report logins from disallowed hosts and ttys to the audit subsystem.

quiet_log

Do not log denials with syslog(3).

fieldsep=separators

This option modifies the field separator character that pam_access will recognize when parsing the access configuration file. For example: fieldsep=| will cause the default `:' character to be treated as part of a field value and `|' becomes the field separator. Doing this may be useful in conjunction with a system that wants to use pam_access with X based applications, since the PAM_TTY item is likely to be of the form "hostname:0" which includes a `:' character in its value. But you should not need this.

listsep=separators

This option modifies the list separator character that pam_access will recognize when parsing the access configuration file. For example: listsep=, will cause the default ` ' (space) and `\t' (tab) characters to be treated as part of a list element value and `,' becomes the only list element separator. Doing this may be useful on a system with group information obtained from a Windows domain, where the default built-in groups "Domain Users", "Domain Admins" contain a space.

nodefgroup

User tokens which are not enclosed in parentheses will not be matched against the group database. The backwards compatible default is to try the group database match even for tokens not enclosed in parentheses.

## MODULE TYPES PROVIDED
All module types (auth, account, password and session) are provided.

## RETURN VALUES
PAM_SUCCESS

Access was granted.

PAM_PERM_DENIED

Access was not granted.

PAM_IGNORE

pam_setcred was called which does nothing.

PAM_ABORT

Not all relevant data or options could be gotten.

PAM_USER_UNKNOWN

The user is not known to the system.

## FILES
/etc/security/access.conf

Default configuration file

## SEE ALSO
access.conf(5), pam.d(5), pam(8).

## AUTHORS
The logdaemon style login access control scheme was designed and implemented by Wietse Venema. The pam_access PAM module was developed by Alexei Nogin <alexei@nogin.dnttm.ru>. The IPv6 support and the network(address) / netmask feature was developed and provided by Mike Becher <mike.becher@lrz-muenchen.de>.


title: pam_canonicalize_user(8)

summary: Get user name and canonicalize it

text:
# pam_canonicalize_user(8)

## NAME
pam_canonicalize_user - Get user name and canonicalize it

## SYNOPSIS
pam_canonicalize_user.so

## DESCRIPTION
This PAM module uses the name of the user obtained via pam_get_user(3) as a key to query the password database, and replaces PAM_USER with the pw_name value that has been returned.

## OPTIONS
This module does not recognise any options.

## MODULE TYPES PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_IGNORE

The user name was set successfully.

PAM_USER_UNKNOWN

The user was not found.

PAM_SYSTEM_ERR

The application did not supply neither a user name nor a conversation method.

PAM_INCOMPLETE

The conversation method supplied by the application is waiting for an event.

PAM_CONV_ERR

The conversation method supplied by the application failed to obtain the user name.

PAM_ABORT

Error resuming an old conversation.

PAM_BUF_ERR

Memory buffer error.

## EXAMPLES
Prepend the PAM auth stack with the following line to canonicalize the user name before the authentication:

```
        auth required pam_canonicalize_user.so

```

## SEE ALSO
pam_get_user(3), pam_get_item(3), pam_set_item(3), getpwnam(3), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_canonicalize_user was written by Dmitry V. Levin <ldv@strace.io>.


title: pam_debug(8)

summary: PAM module to debug the PAM stack

text:
# pam_debug(8)

## NAME
pam_debug - PAM module to debug the PAM stack

## SYNOPSIS
pam_debug.so [auth=value] [cred=value] [acct=value] [prechauthtok=value] [chauthtok=value] [auth=value] [open_session=value] [close_session=value]

## DESCRIPTION
The pam_debug PAM module is intended as a debugging aide for determining how the PAM stack is operating. This module returns what its module arguments tell it to return.

## OPTIONS
auth=value

The pam_sm_authenticate(3) function will return value.

cred=value

The pam_sm_setcred(3) function will return value.

acct=value

The pam_sm_acct_mgmt(3) function will return value.

prechauthtok=value

The pam_sm_chauthtok(3) function will return value if the PAM_PRELIM_CHECK flag is set.

chauthtok=value

The pam_sm_chauthtok(3) function will return value if the PAM_PRELIM_CHECK flag is not set.

open_session=value

The pam_sm_open_session(3) function will return value.

close_session=value

The pam_sm_close_session(3) function will return value.

Where value can be one of: success, open_err, symbol_err, service_err, system_err, buf_err, perm_denied, auth_err, cred_insufficient, authinfo_unavail, user_unknown, maxtries, new_authtok_reqd, acct_expired, session_err, cred_unavail, cred_expired, cred_err, no_module_data, conv_err, authtok_err, authtok_recover_err, authtok_lock_busy, authtok_disable_aging, try_again, ignore, abort, authtok_expired, module_unknown, bad_item, conv_again, incomplete.

## MODULE TYPES PROVIDED
All module types (auth, account, password and session) are provided.

## RETURN VALUES
PAM_SUCCESS

Default return code if no other value was specified, else specified return value.

## EXAMPLES

```
auth    requisite       pam_permit.so
auth    [success=2 default=ok]  pam_debug.so auth=perm_denied cred=success
auth    [default=reset]         pam_debug.so auth=success cred=perm_denied
auth    [success=done default=die] pam_debug.so
auth    optional        pam_debug.so auth=perm_denied cred=perm_denied
auth    sufficient      pam_debug.so auth=success cred=success

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_debug was written by Andrew G. Morgan <morgan@kernel.org>.


title: pam_deny(8)

summary: The locking\-out PAM module

text:
# pam_deny(8)

## NAME
pam_deny - The locking-out PAM module

## SYNOPSIS
pam_deny.so

## DESCRIPTION
This module can be used to deny access. It always indicates a failure to the application through the PAM framework. It might be suitable for using for default (the OTHER) entries.

## OPTIONS
This module does not recognise any options.

## MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.

## RETURN VALUES
PAM_AUTH_ERR

This is returned by the account and auth services.

PAM_CRED_ERR

This is returned by the setcred function.

PAM_AUTHTOK_ERR

This is returned by the password service.

PAM_SESSION_ERR

This is returned by the session service.

## EXAMPLES

```
#%PAM-1.0
#
# If we don't have config entries for a service, the
# OTHER entries are used. To be secure, warn and deny
# access to everything.
other auth     required       pam_warn.so
other auth     required       pam_deny.so
other account  required       pam_warn.so
other account  required       pam_deny.so
other password required       pam_warn.so
other password required       pam_deny.so
other session  required       pam_warn.so
other session  required       pam_deny.so

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_deny was written by Andrew G. Morgan <morgan@kernel.org>


title: pam_echo(8)

summary: PAM module for printing text messages

text:
# pam_echo(8)

## NAME
pam_echo - PAM module for printing text messages

## SYNOPSIS
pam_echo.so [file=/path/message]

## DESCRIPTION
The pam_echo PAM module is for printing text messages to inform user about special things. Sequences starting with the % character are interpreted in the following way:

%H

The name of the remote host (PAM_RHOST).

%h

The name of the local host.

%s

The service name (PAM_SERVICE).

%t

The name of the controlling terminal (PAM_TTY).

%U

The remote user name (PAM_RUSER).

%u

The local user name (PAM_USER).

All other sequences beginning with % expands to the characters following the % character.

## OPTIONS
file=/path/message

The content of the file /path/message will be printed with the PAM conversion function as PAM_TEXT_INFO.

## MODULE TYPES PROVIDED
All module types (auth, account, password and session) are provided.

## RETURN VALUES
PAM_BUF_ERR

Memory buffer error.

PAM_SUCCESS

Message was successful printed.

PAM_IGNORE

PAM_SILENT flag was given or message file does not exist, no message printed.

## EXAMPLES
For an example of the use of this module, we show how it may be used to print information about good passwords:

```
password optional pam_echo.so file=/usr/share/doc/good-password.txt
password required pam_unix.so

```

## SEE ALSO
pam.conf(8), pam.d(5), pam(8)

## AUTHOR
Thorsten Kukuk <kukuk@thkukuk.de>


title: pam_env(8)

text:
# pam_env(8)

## NAME
pam_env - PAM module to set/unset environment variables

## SYNOPSIS
pam_env.so [debug] [conffile=conf-file] [envfile=env-file] [readenv=0|1] [user_envfile=env-file] [user_readenv=0|1]

## DESCRIPTION
The pam_env PAM module allows the (un)setting of environment variables. Supported is the use of previously set environment variables as well as PAM_ITEMs such as PAM_RHOST.

By default rules for (un)setting of variables are taken from the config file /etc/security/pam_env.conf. An alternate file can be specified with the conffile option.

Second a file (/etc/environment by default) with simple KEY=VAL pairs on separate lines will be read. With the envfile option an alternate file can be specified. And with the readenv option this can be completely disabled.

Third it will read a user configuration file ($HOME/.pam_environment by default). The default file can be changed with the user_envfile option and it can be turned on and off with the user_readenv option.

Since setting of PAM environment variables can have side effects to other modules, this module should be the last one on the stack.

This module is only executed if the main application calls pam_setcred(3) or pam_open_session(3). The module does nothing and returns PAM_IGNORE if called by pam_authenticate(3).

## OPTIONS
conffile=/path/to/pam_env.conf

Indicate an alternative pam_env.conf style configuration file to override the default. This can be useful when different services need different environments.

debug

A lot of debug information is printed with syslog(3).

envfile=/path/to/environment

Indicate an alternative environment file to override the default. The syntax are simple KEY=VAL pairs on separate lines. The export instruction can be specified for bash compatibility, but will be ignored. This can be useful when different services need different environments.

readenv=0|1

Turns on or off the reading of the file specified by envfile (0 is off, 1 is on). By default this option is on.

user_envfile=filename

Indicate an alternative .pam_environment file to override the default. The syntax is the same as for /etc/security/pam_env.conf. The filename is relative to the user home directory. This can be useful when different services need different environments.

user_readenv=0|1

Turns on or off the reading of the user specific environment file. 0 is off, 1 is on. By default this option is off as user supplied environment variables in the PAM environment could affect behavior of subsequent modules in the stack without the consent of the system administrator. Due to problematic security this functionality is deprecated since the 1.5.0 version and will be removed completely at some point in the future.

## MODULE TYPES PROVIDED
The auth and session module types are provided.

## RETURN VALUES
PAM_ABORT

Not all relevant data or options could be gotten.

PAM_BUF_ERR

Memory buffer error.

PAM_IGNORE

No pam_env.conf and environment file was found or the module got called by pam_authenticate(3).

PAM_SUCCESS

Environment variables were set.

## FILES
/etc/security/pam_env.conf

Default configuration file

/etc/environment

Default environment file

$HOME/.pam_environment

User specific environment file

## SEE ALSO
pam_env.conf(5), pam.d(5), pam(8), environ(7).

## AUTHOR
pam_env was written by Dave Kinchlea <kinch@kinch.ark.com>.


title: pam_exec(8)

text:
# pam_exec(8)

## NAME
pam_exec - PAM module which calls an external command

## SYNOPSIS
pam_exec.so [debug] [expose_authtok] [seteuid] [quiet] [quiet_log] [stdout] [log=file] [type=type] command [...]

## DESCRIPTION
pam_exec is a PAM module that can be used to run an external command.

The child's environment is set to the current PAM environment list, as returned by pam_getenvlist(3) In addition, the following PAM items are exported as environment variables: PAM_RHOST, PAM_RUSER, PAM_SERVICE, PAM_TTY, PAM_USER and PAM_TYPE, which contains one of the module types: account, auth, password, open_session and close_session.

Commands called by pam_exec need to be aware of that the user can have control over the environment.

## OPTIONS
debug

Print debug information.

expose_authtok

During authentication and password change the calling command can read the password from stdin(3). Only first PAM_MAX_RESP_SIZE bytes of a password are provided to the command.

log=file

The output of the command is appended to file

type=type

Only run the command if the module type matches the given type.

stdout

Per default the output of the executed command is written to /dev/null. With this option, the stdout output of the executed command is redirected to the calling application. It's in the responsibility of this application what happens with the output. The log option is ignored.

quiet

Per default pam_exec.so will echo the exit status of the external command if it fails. Specifying this option will suppress the message.

quiet_log

Per default pam_exec.so will log the exit status of the external command if it fails. Specifying this option will suppress the log message.

seteuid

Per default pam_exec.so will execute the external command with the real user ID of the calling process. Specifying this option means the command is run with the effective user ID.

## MODULE TYPES PROVIDED
All module types (auth, account, password and session) are provided.

## RETURN VALUES
PAM_SUCCESS

The external command was run successfully.

PAM_BUF_ERR

Memory buffer error.

PAM_CONV_ERR

The conversation method supplied by the application failed to obtain the username.

PAM_INCOMPLETE

The conversation method supplied by the application returned PAM_CONV_AGAIN.

PAM_SERVICE_ERR

No argument or a wrong number of arguments were given.

PAM_SYSTEM_ERR

A system error occurred or the command to execute failed.

PAM_IGNORE

pam_setcred was called, which does not execute the command. Or, the value given for the type= parameter did not match the module type.

## EXAMPLES
Add the following line to /etc/pam.d/passwd to rebuild the NIS database after each local password change:

```
        password optional pam_exec.so seteuid /usr/bin/make -C /var/yp

```

This will execute the command

```
make -C /var/yp
```

with effective user ID.

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_exec was written by Thorsten Kukuk <kukuk@thkukuk.de> and Josh Triplett <josh@joshtriplett.org>.


title: pam_faildelay(8)

summary: Change the delay on failure per\-application

text:
# pam_faildelay(8)

## NAME
pam_faildelay - Change the delay on failure per-application

## SYNOPSIS
pam_faildelay.so [debug] [delay=microseconds]

## DESCRIPTION
pam_faildelay is a PAM module that can be used to set the delay on failure per-application.

If no delay is given, pam_faildelay will use the value of FAIL_DELAY from /etc/login.defs.

## OPTIONS
debug

Turns on debugging messages sent to syslog.

delay=N

Set the delay on failure to N microseconds.

## MODULE TYPES PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_IGNORE

Delay was successful adjusted.

PAM_SYSTEM_ERR

The specified delay was not valid.

## EXAMPLES
The following example will set the delay on failure to 10 seconds:

```
auth  optional  pam_faildelay.so  delay=10000000

```

## SEE ALSO
pam_fail_delay(3), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_faildelay was written by Darren Tucker <dtucker@zip.com.au>.


title: pam_faillock(8)

text:
# pam_faillock(8)

## NAME
pam_faillock - Module counting authentication failures during a specified interval

## SYNOPSIS
auth ... pam_faillock.so {preauth|authfail|authsucc} [conf=/path/to/config-file] [dir=/path/to/tally-directory] [even_deny_root] [deny=n] [fail_interval=n] [unlock_time=n] [root_unlock_time=n] [admin_group=name] [audit] [silent] [no_log_info]

account ... pam_faillock.so [dir=/path/to/tally-directory] [no_log_info]

## DESCRIPTION
This module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than deny consecutive failed authentications.

Normally, failed attempts to authenticate root will not cause the root account to become blocked, to prevent denial-of-service: if your users aren't given shell accounts and root may only login via su or at the machine console (not telnet/rsh, etc), this is safe.

## OPTIONS
{preauth|authfail|authsucc}

This argument must be set accordingly to the position of this module instance in the PAM stack. The preauth argument must be used when the module is called before the modules which ask for the user credentials such as the password. The module just examines whether the user should be blocked from accessing the service in case there were anomalous number of failed consecutive authentication attempts recently. This call is optional if authsucc is used.

The authfail argument must be used when the module is called after the modules which determine the authentication outcome, failed. Unless the user is already blocked due to previous authentication failures, the module will record the failure into the appropriate user tally file.

The authsucc argument must be used when the module is called after the modules which determine the authentication outcome, succeeded. Unless the user is already blocked due to previous authentication failures, the module will then clear the record of the failures in the respective user tally file. Otherwise it will return authentication error. If this call is not done, the pam_faillock will not distinguish between consecutive and non-consecutive failed authentication attempts. The preauth call must be used in such case. Due to complications in the way the PAM stack can be configured it is also possible to call pam_faillock as an account module. In such configuration the module must be also called in the preauth stage.

conf=/path/to/config-file

Use another configuration file instead of the default /etc/security/faillock.conf.

The options for configuring the module behavior are described in the faillock.conf(5) manual page. The options specified on the module command line override the values from the configuration file.

## MODULE TYPES PROVIDED
The auth and account module types are provided.

## RETURN VALUES
PAM_AUTH_ERR

An invalid option was given, the module was not able to retrieve the user name, no valid counter file was found, or too many failed logins.

PAM_BUF_ERR

Memory buffer error.

PAM_CONV_ERR

The conversation method supplied by the application failed to obtain the username.

PAM_INCOMPLETE

The conversation method supplied by the application returned PAM_CONV_AGAIN.

PAM_SUCCESS

Everything was successful.

PAM_IGNORE

User not present in passwd database.

## NOTES
Configuring options on the module command line is not recommend. The /etc/security/faillock.conf should be used instead.

The setup of pam_faillock in the PAM stack is different from the pam_tally2 module setup.

Individual files with the failure records are created as owned by the user. This allows pam_faillock.so module to work correctly when it is called from a screensaver.

Note that using the module in preauth without the silent option specified in /etc/security/faillock.conf or with requisite control field leaks an information about existence or non-existence of a user account in the system because the failures are not recorded for the unknown users. The message about the user account being locked is never displayed for non-existing user accounts allowing the adversary to infer that a particular account is not existing on a system.

## EXAMPLES
Here are two possible configuration examples for /etc/pam.d/login. They make pam_faillock to lock the account after 4 consecutive failed logins during the default interval of 15 minutes. Root account will be locked as well. The accounts will be automatically unlocked after 20 minutes.

In the first example the module is called only in the auth phase and the module does not print any information about the account being blocked by pam_faillock. The preauth call can be added to tell users that their logins are blocked by the module and also to abort the authentication without even asking for password in such case.

/etc/security/faillock.conf file example:

```
deny=4
unlock_time=1200
silent

```

/etc/pam.d/config file example:

```
auth     required       pam_securetty.so
auth     required       pam_env.so
auth     required       pam_nologin.so
# optionally call: auth requisite pam_faillock.so preauth
# to display the message about account being locked
auth     [success=1 default=bad] pam_unix.so
auth     [default=die]  pam_faillock.so authfail
auth     sufficient     pam_faillock.so authsucc
auth     required       pam_deny.so
account  required       pam_unix.so
password required       pam_unix.so shadow
session  required       pam_selinux.so close
session  required       pam_loginuid.so
session  required       pam_unix.so
session  required       pam_selinux.so open

```

In the second example the module is called both in the auth and account phases and the module informs the authenticating user when the account is locked if silent option is not specified in the faillock.conf.

```
auth     required       pam_securetty.so
auth     required       pam_env.so
auth     required       pam_nologin.so
auth     required       pam_faillock.so preauth
# optionally use requisite above if you do not want to prompt for the password
# on locked accounts
auth     sufficient     pam_unix.so
auth     [default=die]  pam_faillock.so authfail
auth     required       pam_deny.so
account  required       pam_faillock.so
# if you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures
account  required       pam_unix.so
password required       pam_unix.so shadow
session  required       pam_selinux.so close
session  required       pam_loginuid.so
session  required       pam_unix.so
session  required       pam_selinux.so open

```

## FILES
/var/run/faillock/*

the files logging the authentication failures for users Note: These files will disappear after reboot on systems configured with directory /var/run/faillock mounted on virtual memory. For persistent storage use the option dir= in file /etc/security/faillock.conf.

/etc/security/faillock.conf

the config file for pam_faillock options

## SEE ALSO
faillock(8), faillock.conf(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_faillock was written by Tomas Mraz.


title: pam_filter(8)

summary: PAM filter module

text:
# pam_filter(8)

## NAME
pam_filter - PAM filter module

## SYNOPSIS
pam_filter.so [debug] [new_term] [non_term] run1|run2 filter [...]

## DESCRIPTION
This module is intended to be a platform for providing access to all of the input/output that passes between the user and the application. It is only suitable for tty-based and (stdin/stdout) applications.

To function this module requires filters to be installed on the system. The single filter provided with the module simply transposes upper and lower case letters in the input and output streams. (This can be very annoying and is not kind to termcap based editors).

Each component of the module has the potential to invoke the desired filter. The filter is always execv(2) with the privilege of the calling application and not that of the user. For this reason it cannot usually be killed by the user without closing their session.

## OPTIONS
debug

Print debug information.

new_term

The default action of the filter is to set the PAM_TTY item to indicate the terminal that the user is using to connect to the application. This argument indicates that the filter should set PAM_TTY to the filtered pseudo-terminal.

non_term

don't try to set the PAM_TTY item.

runX

In order that the module can invoke a filter it should know when to invoke it. This argument is required to tell the filter when to do this. Permitted values for X are 1 and 2. These indicate the precise time that the filter is to be run. To understand this concept it will be useful to have read the pam(3) manual page. Basically, for each management group there are up to two ways of calling the module's functions. In the case of the authentication and session components there are actually two separate functions. For the case of authentication, these functions are pam_authenticate(3) and pam_setcred(3), here run1 means run the filter from the pam_authenticate function and run2 means run the filter from pam_setcred. In the case of the session modules, run1 implies that the filter is invoked at the pam_open_session(3) stage, and run2 for pam_close_session(3).

For the case of the account component. Either run1 or run2 may be used.

For the case of the password component, run1 is used to indicate that the filter is run on the first occasion of pam_chauthtok(3) (the PAM_PRELIM_CHECK phase) and run2 is used to indicate that the filter is run on the second occasion (the PAM_UPDATE_AUTHTOK phase).

filter

The full pathname of the filter to be run and any command line arguments that the filter might expect.

## MODULE TYPES PROVIDED
All module types (auth, account, password and session) are provided.

## RETURN VALUES
PAM_SUCCESS

The new filter was set successfully.

PAM_ABORT

Critical error, immediate abort.

## EXAMPLES
Add the following line to /etc/pam.d/login to see how to configure login to transpose upper and lower case letters once the user has logged in:

```
        session required pam_filter.so run1 /lib/security/pam_filter/upperLOWER

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_filter was written by Andrew G. Morgan <morgan@kernel.org>.


title: pam_ftp(8)

summary: PAM module for anonymous access module

text:
# pam_ftp(8)

## NAME
pam_ftp - PAM module for anonymous access module

## SYNOPSIS
pam_ftp.so [debug] [ignore] [users=XXX,YYY,...]

## DESCRIPTION
pam_ftp is a PAM module which provides a pluggable anonymous ftp mode of access.

This module intercepts the user's name and password. If the name is ftp or anonymous, the user's password is broken up at the @ delimiter into a PAM_RUSER and a PAM_RHOST part; these pam-items being set accordingly. The username (PAM_USER) is set to ftp. In this case the module succeeds. Alternatively, the module sets the PAM_AUTHTOK item with the entered password and fails.

This module is not safe and easily spoofable.

## OPTIONS
debug

Print debug information.

ignore

Pay no attention to the email address of the user (if supplied).

ftp=XXX,YYY,...

Instead of ftp or anonymous, provide anonymous login to the comma separated list of users: XXX,YYY,.... Should the applicant enter one of these usernames the returned username is set to the first in the list: XXX.

## MODULE TYPES PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_SUCCESS

The authentication was successful.

PAM_USER_UNKNOWN

User not known.

## EXAMPLES
Add the following line to /etc/pam.d/ftpd to handle ftp style anonymous login:

```
#
# ftpd; add ftp-specifics. These lines enable anonymous ftp over
#       standard UN*X access (the listfile entry blocks access to
#       users listed in /etc/ftpusers)
#
auth    sufficient  pam_ftp.so
auth    required    pam_unix.so use_first_pass
auth    required    pam_listfile.so \

           onerr=succeed item=user sense=deny file=/etc/ftpusers

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_ftp was written by Andrew G. Morgan <morgan@kernel.org>.


title: pam_group(8)

summary: PAM module for group access

text:
# pam_group(8)

## NAME
pam_group - PAM module for group access

## SYNOPSIS
pam_group.so

## DESCRIPTION
The pam_group PAM module does not authenticate the user, but instead it grants group memberships (in the credential setting phase of the authentication module) to the user. Such memberships are based on the service they are applying for.

By default rules for group memberships are taken from config file /etc/security/group.conf.

This module's usefulness relies on the file-systems accessible to the user. The point being that once granted the membership of a group, the user may attempt to create a setgid binary with a restricted group ownership. Later, when the user is not given membership to this group, they can recover group membership with the precompiled binary. The reason that the file-systems that the user has access to are so significant, is the fact that when a system is mounted nosuid the user is unable to create or execute such a binary file. For this module to provide any level of security, all file-systems that the user has write access to should be mounted nosuid.

The pam_group module functions in parallel with the /etc/group file. If the user is granted any groups based on the behavior of this module, they are granted in addition to those entries /etc/group (or equivalent).

## OPTIONS
This module does not recognise any options.

## MODULE TYPES PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_SUCCESS

group membership was granted.

PAM_ABORT

Not all relevant data could be gotten.

PAM_BUF_ERR

Memory buffer error.

PAM_CRED_ERR

Group membership was not granted.

PAM_IGNORE

pam_sm_authenticate was called which does nothing.

PAM_USER_UNKNOWN

The user is not known to the system.

## FILES
/etc/security/group.conf

Default configuration file

## SEE ALSO
group.conf(5), pam.d(5), pam(8).

## AUTHORS
pam_group was written by Andrew G. Morgan <morgan@kernel.org>.


title: pam_issue(8)

text:
# pam_issue(8)

## NAME
pam_issue - PAM module to add issue file to user prompt

## SYNOPSIS
pam_issue.so [noesc] [issue=issue-file-name]

## DESCRIPTION
pam_issue is a PAM module to prepend an issue file to the username prompt. It also by default parses escape codes in the issue file similar to some common getty's (using \x format).

Recognized escapes:

\d

current day

\l

name of this tty

\m

machine architecture (uname -m)

\n

machine's network node hostname (uname -n)

\o

domain name of this system

\r

release number of operating system (uname -r)

\t

current time

\s

operating system name (uname -s)

\u

number of users currently logged in

\U

same as \u except it is suffixed with "user" or "users" (eg. "1 user" or "10 users")

\v

operating system version and build date (uname -v)

## OPTIONS
noesc

Turns off escape code parsing.

issue=issue-file-name

The file to output if not using the default.

## MODULE TYPES PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_BUF_ERR

Memory buffer error.

PAM_IGNORE

The prompt was already changed.

PAM_SERVICE_ERR

A service module error occurred.

PAM_SUCCESS

The new prompt was set successfully.

## EXAMPLES
Add the following line to /etc/pam.d/login to set the user specific issue at login:

```
        auth optional pam_issue.so issue=/etc/issue

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_issue was written by Ben Collins <bcollins@debian.org>.


title: pam_keyinit(8)

text:
# pam_keyinit(8)

## NAME
pam_keyinit - Kernel session keyring initialiser module

## SYNOPSIS
pam_keyinit.so [debug] [force] [revoke]

## DESCRIPTION
The pam_keyinit PAM module ensures that the invoking process has a session keyring other than the user default session keyring.

The module checks to see if the process's session keyring is the user-session-keyring(7), and, if it is, creates a new session-keyring(7) with which to replace it. If a new session keyring is created, it will install a link to the user-keyring(7) in the session keyring so that keys common to the user will be automatically accessible through it. The session keyring of the invoking process will thenceforth be inherited by all its children unless they override it.

In order to allow other PAM modules to attach tokens to the keyring, this module provides both an auth (limited to pam_setcred(3) and a session component. The session keyring is created in the module called. Moreover this module should be included as early as possible in a PAM configuration.

This module is intended primarily for use by login processes. Be aware that after the session keyring has been replaced, the old session keyring and the keys it contains will no longer be accessible.

This module should not, generally, be invoked by programs like su, since it is usually desirable for the key set to percolate through to the alternate context. The keys have their own permissions system to manage this.

The keyutils package is used to manipulate keys more directly. This can be obtained from:

Keyutils[1]

## OPTIONS
debug

Log debug information with syslog(3).

force

Causes the session keyring of the invoking process to be replaced unconditionally.

revoke

Causes the session keyring of the invoking process to be revoked when the invoking process exits if the session keyring was created for this process in the first place.

## MODULE TYPES PROVIDED
Only the session module type is provided.

## RETURN VALUES
PAM_SUCCESS

This module will usually return this value

PAM_AUTH_ERR

Authentication failure.

PAM_BUF_ERR

Memory buffer error.

PAM_IGNORE

The return value should be ignored by PAM dispatch.

PAM_SERVICE_ERR

Cannot determine the user name.

PAM_SESSION_ERR

This module will return this value if its arguments are invalid or if a system error such as ENOMEM occurs.

PAM_USER_UNKNOWN

User not known.

## EXAMPLES
Add this line to your login entries to start each login session with its own session keyring:

```
session  required  pam_keyinit.so

```

This will prevent keys from one session leaking into another session for the same user.

## SEE ALSO
pam.conf(5), pam.d(5), pam(8), keyctl(1)

## AUTHOR
pam_keyinit was written by David Howells, <dhowells@redhat.com>.

## NOTES
1.

Keyutils

http://people.redhat.com/~dhowells/keyutils/


title: pam_lastlog(8)

text:
# pam_lastlog(8)

## NAME
pam_lastlog - PAM module to display date of last login and perform inactive account lock out

## SYNOPSIS
pam_lastlog.so [debug] [silent] [never] [nodate] [nohost] [noterm] [nowtmp] [noupdate] [showfailed] [inactive=<days>] [unlimited]

## DESCRIPTION
pam_lastlog is a PAM module to display a line of information about the last login of the user. In addition, the module maintains the /var/log/lastlog file.

Some applications may perform this function themselves. In such cases, this module is not necessary.

The module checks LASTLOG_UID_MAX option in /etc/login.defs and does not update or display last login records for users with UID higher than its value. If the option is not present or its value is invalid, no user ID limit is applied.

If the module is called in the auth or account phase, the accounts that were not used recently enough will be disallowed to log in. The check is not performed for the root account so the root is never locked out. It is also not performed for users with UID higher than the LASTLOG_UID_MAX value.

## OPTIONS
debug

Print debug information.

silent

Don't inform the user about any previous login, just update the /var/log/lastlog file. This option does not affect display of bad login attempts.

never

If the /var/log/lastlog file does not contain any old entries for the user, indicate that the user has never previously logged in with a welcome message.

nodate

Don't display the date of the last login.

noterm

Don't display the terminal name on which the last login was attempted.

nohost

Don't indicate from which host the last login was attempted.

nowtmp

Don't update the wtmp entry.

noupdate

Don't update any file.

showfailed

Display number of failed login attempts and the date of the last failed attempt from btmp. The date is not displayed when nodate is specified.

inactive=<days>

This option is specific for the auth or account phase. It specifies the number of days after the last login of the user when the user will be locked out by the module. The default value is 90.

unlimited

If the fsize limit is set, this option can be used to override it, preventing failures on systems with large UID values that lead lastlog to become a huge sparse file.

## MODULE TYPES PROVIDED
The auth and account module type allows one to lock out users who did not login recently enough. The session module type is provided for displaying the information about the last login and/or updating the lastlog and wtmp files.

## RETURN VALUES
PAM_SUCCESS

Everything was successful.

PAM_SERVICE_ERR

Internal service module error.

PAM_USER_UNKNOWN

User not known.

PAM_AUTH_ERR

User locked out in the auth or account phase due to inactivity.

PAM_IGNORE

There was an error during reading the lastlog file in the auth or account phase and thus inactivity of the user cannot be determined.

## EXAMPLES
Add the following line to /etc/pam.d/login to display the last login time of a user:

```
    session  required  pam_lastlog.so nowtmp

```

To reject users if they did not login during the previous 50 days the following line can be used:

```
    auth  required  pam_lastlog.so inactive=50

```

## FILES
/var/log/lastlog

Lastlog logging file

## SEE ALSO
limits.conf(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_lastlog was written by Andrew G. Morgan <morgan@kernel.org>.

Inactive account lock out added by Tomáš Mráz <tm@t8m.info>.


title: pam_limits(8)

summary: PAM module to limit resources

text:
# pam_limits(8)

## NAME
pam_limits - PAM module to limit resources

## SYNOPSIS
pam_limits.so [conf=/path/to/limits.conf] [debug] [set_all] [utmp_early] [noaudit]

## DESCRIPTION
The pam_limits PAM module sets limits on the system resources that can be obtained in a user-session. Users of uid=0 are affected by this limits, too.

By default limits are taken from the /etc/security/limits.conf config file. Then individual *.conf files from the /etc/security/limits.d/ directory are read. The files are parsed one after another in the order of "C" locale. The effect of the individual files is the same as if all the files were concatenated together in the order of parsing. If a config file is explicitly specified with a module option then the files in the above directory are not parsed.

The module must not be called by a multithreaded application.

If Linux PAM is compiled with audit support the module will report when it denies access based on limit of maximum number of concurrent login sessions.

## OPTIONS
conf=/path/to/limits.conf

Indicate an alternative limits.conf style configuration file to override the default.

debug

Print debug information.

set_all

Set the limits for which no value is specified in the configuration file to the one from the process with the PID 1. Please note that if the init process is systemd these limits will not be the kernel default limits and this option should not be used.

utmp_early

Some broken applications actually allocate a utmp entry for the user before the user is admitted to the system. If some of the services you are configuring PAM for do this, you can selectively use this module argument to compensate for this behavior and at the same time maintain system-wide consistency with a single limits.conf file.

noaudit

Do not report exceeded maximum logins count to the audit subsystem.

## MODULE TYPES PROVIDED
Only the session module type is provided.

## RETURN VALUES
PAM_ABORT

Cannot get current limits.

PAM_IGNORE

No limits found for this user.

PAM_PERM_DENIED

New limits could not be set.

PAM_SERVICE_ERR

Cannot read config file.

PAM_SESSION_ERR

Error recovering account name.

PAM_SUCCESS

Limits were changed.

PAM_USER_UNKNOWN

The user is not known to the system.

## FILES
/etc/security/limits.conf

Default configuration file

## EXAMPLES
For the services you need resources limits (login for example) put a the following line in /etc/pam.d/login as the last line for that service (usually after the pam_unix session line):

```
#%PAM-1.0
#
# Resource limits imposed on login sessions via pam_limits
#
session  required  pam_limits.so

```

Replace "login" for each service you are using this module.

## SEE ALSO
limits.conf(5), pam.d(5), pam(8).

## AUTHORS
pam_limits was initially written by Cristian Gafton <gafton@redhat.com>


title: pam_listfile(8)

text:
# pam_listfile(8)

## NAME
pam_listfile - deny or allow services based on an arbitrary file

## SYNOPSIS
pam_listfile.so item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file=/path/filename onerr=[succeed|fail] [apply=[user|@group]] [quiet]

## DESCRIPTION
pam_listfile is a PAM module which provides a way to deny or allow services based on an arbitrary file.

The module gets the item of the type specified -- user specifies the username, PAM_USER; tty specifies the name of the terminal (if any) over which the request has been made, PAM_TTY; rhost specifies the name of the remote host (if any) from which the request was made, PAM_RHOST; and ruser specifies the name of the remote user (if available) who made the request, PAM_RUSER -- and looks for an instance of that item in the file=filename. filename contains one line per item listed. If the item is found, then if sense=allow, PAM_SUCCESS is returned, causing the authorization request to succeed; else if sense=deny, PAM_AUTH_ERR is returned, causing the authorization request to fail.

If an error is encountered (for instance, if filename does not exist, or a poorly-constructed argument is encountered), then if onerr=succeed, PAM_SUCCESS is returned, otherwise if onerr=fail, PAM_AUTH_ERR or PAM_SERVICE_ERR (as appropriate) will be returned.

An additional argument, apply=, can be used to restrict the application of the above to a specific user (apply=username) or a given group (apply=@groupname). This added restriction is only meaningful when used with the tty, rhost and shell items.

Besides this last one, all arguments should be specified; do not count on any default behavior.

No credentials are awarded by this module.

## OPTIONS
item=[tty|user|rhost|ruser|group|shell]

What is listed in the file and should be checked for.

sense=[allow|deny]

Action to take if the item is found in the file. If the item is NOT found in the file, then the opposite action is requested.

file=/path/filename

File containing one item per line. The file needs to be a plain file and not world writable.

onerr=[succeed|fail]

What to do if something weird happens like being unable to open the file.

apply=[user|@group]

Restrict the user class for which the restriction apply. Note that with item=[user|ruser|group] this does not make sense, but for item=[tty|rhost|shell] it has a meaning.

quiet

Do not treat service refusals or missing list files as errors that need to be logged.

## MODULE TYPES PROVIDED
All module types (auth, account, password and session) are provided.

## RETURN VALUES
PAM_AUTH_ERR

Authentication failure.

PAM_BUF_ERR

Memory buffer error.

PAM_IGNORE

The rule does not apply to the apply option.

PAM_SERVICE_ERR

Error in service module.

PAM_SUCCESS

Success.

## EXAMPLES
Classic 'ftpusers' authentication can be implemented with this entry in /etc/pam.d/ftpd:

```
#
# deny ftp-access to users listed in the /etc/ftpusers file
#
auth    required       pam_listfile.so \

        onerr=succeed item=user sense=deny file=/etc/ftpusers

```

Note, users listed in /etc/ftpusers file are (counterintuitively) not allowed access to the ftp service.

To allow login access only for certain users, you can use a /etc/pam.d/login entry like this:

```
#
# permit login to users listed in /etc/loginusers
#
auth    required       pam_listfile.so \

        onerr=fail item=user sense=allow file=/etc/loginusers

```

For this example to work, all users who are allowed to use the login service should be listed in the file /etc/loginusers. Unless you are explicitly trying to lock out root, make sure that when you do this, you leave a way for root to log in, either by listing root in /etc/loginusers, or by listing a user who is able to su to the root account.

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_listfile was written by Michael K. Johnson <johnsonm@redhat.com> and Elliot Lee <sopwith@cuc.edu>.


title: pam_localuser(8)

text:
# pam_localuser(8)

## NAME
pam_localuser - require users to be listed in /etc/passwd

## SYNOPSIS
pam_localuser.so [debug] [file=/path/passwd]

## DESCRIPTION
pam_localuser is a PAM module to help implementing site-wide login policies, where they typically include a subset of the network's users and a few accounts that are local to a particular workstation. Using pam_localuser and pam_wheel or pam_listfile is an effective way to restrict access to either local users and/or a subset of the network's users.

This could also be implemented using pam_listfile.so and a very short awk script invoked by cron, but it's common enough to have been separated out.

## OPTIONS
debug

Print debug information.

file=/path/passwd

Use a file other than /etc/passwd.

## MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.

## RETURN VALUES
PAM_SUCCESS

The new localuser was set successfully.

PAM_BUF_ERR

Memory buffer error.

PAM_CONV_ERR

The conversation method supplied by the application failed to obtain the username.

PAM_INCOMPLETE

The conversation method supplied by the application returned PAM_CONV_AGAIN.

PAM_SERVICE_ERR

The user name is not valid or the passwd file is unavailable.

PAM_PERM_DENIED

The user is not listed in the passwd file.

## EXAMPLES
Add the following lines to /etc/pam.d/su to allow only local users or group wheel to use su.

```
account sufficient pam_localuser.so
account required pam_wheel.so

```

## FILES
/etc/passwd

Local user account information.

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_localuser was written by Nalin Dahyabhai <nalin@redhat.com>.


title: pam_loginuid(8)

summary: Record user\*(Aqs login uid to the process attribute

text:
# pam_loginuid(8)

## NAME
pam_loginuid - Record user's login uid to the process attribute

## SYNOPSIS
pam_loginuid.so [require_auditd]

## DESCRIPTION
The pam_loginuid module sets the loginuid process attribute for the process that was authenticated. This is necessary for applications to be correctly audited. This PAM module should only be used for entry point applications like: login, sshd, gdm, vsftpd, crond and atd. There are probably other entry point applications besides these. You should not use it for applications like sudo or su as that defeats the purpose by changing the loginuid to the account they just switched to.

## OPTIONS
require_auditd

This option, when given, will cause this module to query the audit daemon status and deny logins if it is not running.

## MODULE TYPES PROVIDED
Only the session module type is provided.

## RETURN VALUES
PAM_SUCCESS

The loginuid value is set and auditd is running if check requested.

PAM_IGNORE

The /proc/self/loginuid file is not present on the system or the login process runs inside uid namespace and kernel does not support overwriting loginuid.

PAM_SESSION_ERR

Any other error prevented setting loginuid or auditd is not running.

## EXAMPLES

```
#%PAM-1.0
auth       required     pam_unix.so
auth       required     pam_nologin.so
account    required     pam_unix.so
password   required     pam_unix.so
session    required     pam_unix.so
session    required     pam_loginuid.so

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8), auditctl(8), auditd(8)

## AUTHOR
pam_loginuid was written by Steve Grubb <sgrubb@redhat.com>


title: pam_mail(8)

summary: Inform about available mail

text:
# pam_mail(8)

## NAME
pam_mail - Inform about available mail

## SYNOPSIS
pam_mail.so [close] [debug] [dir=maildir] [empty] [hash=count] [noenv] [nopen] [quiet] [standard]

## DESCRIPTION
The pam_mail PAM module provides the "you have new mail" service to the user. It can be plugged into any application that has credential or session hooks. It gives a single message indicating the newness of any mail it finds in the user's mail folder. This module also sets the PAM environment variable, MAIL, to the user's mail directory.

If the mail spool file (be it /var/mail/$USER or a pathname given with the dir= parameter) is a directory then pam_mail assumes it is in the Maildir format.

## OPTIONS
close

Indicate if the user has any mail also on logout.

debug

Print debug information.

dir=maildir

Look for the user's mail in an alternative location defined by maildir/<login>. The default location for mail is /var/mail/<login>. Note, if the supplied maildir is prefixed by a '~', the directory is interpreted as indicating a file in the user's home directory.

empty

Also print message if user has no mail.

hash=count

Mail directory hash depth. For example, a hashcount of 2 would make the mail file be /var/spool/mail/u/s/user.

noenv

Do not set the MAIL environment variable.

nopen

Don't print any mail information on login. This flag is useful to get the MAIL environment variable set, but to not display any information about it.

quiet

Only report when there is new mail.

standard

Old style "You have..." format which doesn't show the mail spool being used. This also implies "empty".

## MODULE TYPES PROVIDED
The session and auth (on establishment and deletion of credentials) module types are provided.

## RETURN VALUES
PAM_BUF_ERR

Memory buffer error.

PAM_SERVICE_ERR

Badly formed arguments.

PAM_SUCCESS

Success.

PAM_USER_UNKNOWN

User not known.

## EXAMPLES
Add the following line to /etc/pam.d/login to indicate that the user has new mail when they login to the system.

```
session  optional  pam_mail.so standard

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_mail was written by Andrew G. Morgan <morgan@kernel.org>.


title: pam_mkhomedir(8)

text:
# pam_mkhomedir(8)

## NAME
pam_mkhomedir - PAM module to create users home directory

## SYNOPSIS
pam_mkhomedir.so [silent] [debug] [umask=mode] [skel=skeldir]

## DESCRIPTION
The pam_mkhomedir PAM module will create a users home directory if it does not exist when the session begins. This allows users to be present in central database (such as NIS, kerberos or LDAP) without using a distributed file system or pre-creating a large number of directories. The skeleton directory (usually /etc/skel/) is used to copy default files and also sets a umask for the creation.

The new users home directory will not be removed after logout of the user.

## OPTIONS
silent

Don't print informative messages.

debug

Turns on debugging via syslog(3).

umask=mask

The file mode creation mask is set to mask. The default value of mask is 0077. If this option is not specified, then the permissions of created user home directory is set to the value of HOME_MODE configuration item from /etc/login.defs. If there is no such configuration item then the value is computed from the value of UMASK in the same file. If there is no such configuration option either the default value of 0755 is used for the mode.

skel=/path/to/skel/directory

Indicate an alternative skel directory to override the default /etc/skel.

## MODULE TYPES PROVIDED
Only the session module type is provided.

## RETURN VALUES
PAM_BUF_ERR

Memory buffer error.

PAM_PERM_DENIED

Not enough permissions to create the new directory or read the skel directory.

PAM_USER_UNKNOWN

User not known to the underlying authentication module.

PAM_SUCCESS

Environment variables were set.

## FILES
/etc/skel

Default skel directory

## EXAMPLES
A sample /etc/pam.d/login file:

```
  auth       requisite   pam_securetty.so

  auth       sufficient  pam_ldap.so

  auth       required    pam_unix.so

  auth       required    pam_nologin.so

  account    sufficient  pam_ldap.so

  account    required    pam_unix.so

  password   required    pam_unix.so

  session    required    pam_mkhomedir.so skel=/etc/skel/ umask=0077

  session    required    pam_unix.so

  session    optional    pam_lastlog.so

  session    optional    pam_mail.so standard

```

## SEE ALSO
pam.d(5), pam(8).

## AUTHOR
pam_mkhomedir was written by Jason Gunthorpe <jgg@debian.org>.


title: pam_motd(8)

summary: Display the motd file

text:
# pam_motd(8)

## NAME
pam_motd - Display the motd file

## SYNOPSIS
pam_motd.so [motd=/path/filename] [motd_dir=/path/dirname.d]

## DESCRIPTION
pam_motd is a PAM module that can be used to display arbitrary motd (message of the day) files after a successful login. By default, pam_motd shows files in the following locations:

/etc/motd

/run/motd

/usr/lib/motd

/etc/motd.d/

/run/motd.d/

/usr/lib/motd.d/

Each message size is limited to 64KB.

If /etc/motd does not exist, then /run/motd is shown. If /run/motd does not exist, then /usr/lib/motd is shown.

Similar overriding behavior applies to the directories. Files in /etc/motd.d/ override files with the same name in /run/motd.d/ and /usr/lib/motd.d/. Files in /run/motd.d/ override files with the same name in /usr/lib/motd.d/.

Files in the directories listed above are displayed in lexicographic order by name. Moreover, the files are filtered by reading them with the credentials of the target user authenticating on the system.

To silence a message, a symbolic link with target /dev/null may be placed in /etc/motd.d with the same filename as the message to be silenced. Example: Creating a symbolic link as follows silences /usr/lib/motd.d/my_motd.

ln -s /dev/null /etc/motd.d/my_motd

The MOTD_SHOWN=pam environment variable is set after showing the motd files, even when all of them were silenced using symbolic links.

## OPTIONS
motd=/path/filename

The /path/filename file is displayed as message of the day. Multiple paths to try can be specified as a colon-separated list. By default this option is set to /etc/motd:/run/motd:/usr/lib/motd.

motd_dir=/path/dirname.d

The /path/dirname.d directory is scanned and each file contained inside of it is displayed. Multiple directories to scan can be specified as a colon-separated list. By default this option is set to /etc/motd.d:/run/motd.d:/usr/lib/motd.d.

When no options are given, the default behavior applies for both options. Specifying either option (or both) will disable the default behavior for both options.

## MODULE TYPES PROVIDED
Only the session module type is provided.

## RETURN VALUES
PAM_ABORT

Not all relevant data or options could be obtained.

PAM_BUF_ERR

Memory buffer error.

PAM_IGNORE

This is the default return value of this module.

## EXAMPLES
The suggested usage for /etc/pam.d/login is:

```
session  optional  pam_motd.so

```

To use a motd file from a different location:

```
session  optional  pam_motd.so motd=/elsewhere/motd

```

To use a motd file from elsewhere, along with a corresponding .d directory:

```
session  optional  pam_motd.so motd=/elsewhere/motd motd_dir=/elsewhere/motd.d

```

## SEE ALSO
motd(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_motd was written by Ben Collins <bcollins@debian.org>.

The motd_dir= option was added by Allison Karlitskaya <allison.karlitskaya@redhat.com>.


title: pam_namespace(8)

text:
# pam_namespace(8)

## NAME
pam_namespace - PAM module for configuring namespace for a session

## SYNOPSIS
pam_namespace.so [debug] [unmnt_remnt] [unmnt_only] [require_selinux] [gen_hash] [ignore_config_error] [ignore_instance_parent_mode] [unmount_on_close] [use_current_context] [use_default_context] [mount_private]

## DESCRIPTION
The pam_namespace PAM module sets up a private namespace for a session with polyinstantiated directories. A polyinstantiated directory provides a different instance of itself based on user name, or when using SELinux, user name, security context or both. If an executable script /etc/security/namespace.init exists, it is used to initialize the instance directory after it is set up and mounted on the polyinstantiated directory. The script receives the polyinstantiated directory path, the instance directory path, flag whether the instance directory was newly created (0 for no, 1 for yes), and the user name as its arguments. The script is invoked with full root privileges and accessing the instance directory in this context needs to be done with caution, as it is controlled by the unprivileged user for which it has been created.

The pam_namespace module disassociates the session namespace from the parent namespace. Any mounts/unmounts performed in the parent namespace, such as mounting of devices, are not reflected in the session namespace. To propagate selected mount/unmount events from the parent namespace into the disassociated session namespace, an administrator may use the special shared-subtree feature. For additional information on shared-subtree feature, please refer to the mount(8) man page and the shared-subtree description at http://lwn.net/Articles/159077 and http://lwn.net/Articles/159092.

## OPTIONS
debug

A lot of debug information is logged using syslog

unmnt_remnt

For programs such as su and newrole, the login session has already setup a polyinstantiated namespace. For these programs, polyinstantiation is performed based on new user id or security context, however the command first needs to undo the polyinstantiation performed by login. This argument instructs the command to first undo previous polyinstantiation before proceeding with new polyinstantiation based on new id/context

unmnt_only

For trusted programs that want to undo any existing bind mounts and process instance directories on their own, this argument allows them to unmount currently mounted instance directories

require_selinux

If selinux is not enabled, return failure

gen_hash

Instead of using the security context string for the instance name, generate and use its md5 hash.

ignore_config_error

If a line in the configuration file corresponding to a polyinstantiated directory contains format error, skip that line process the next line. Without this option, pam will return an error to the calling program resulting in termination of the session.

ignore_instance_parent_mode

Instance parent directories by default are expected to have the restrictive mode of 000. Using this option, an administrator can choose to ignore the mode of the instance parent. This option should be used with caution as it will reduce security and isolation goals of the polyinstantiation mechanism.

unmount_on_close

Explicitly unmount the polyinstantiated directories instead of relying on automatic namespace destruction after the last process in a namespace exits. This option should be used only in case it is ensured by other means that there cannot be any processes running in the private namespace left after the session close. It is also useful only in case there are multiple pam session calls in sequence from the same process.

use_current_context

Useful for services which do not change the SELinux context with setexeccon call. The module will use the current SELinux context of the calling process for the level and context polyinstantiation.

use_default_context

Useful for services which do not use pam_selinux for changing the SELinux context with setexeccon call. The module will use the default SELinux context of the user for the level and context polyinstantiation.

mount_private

This option can be used on systems where the / mount point or its submounts are made shared (for example with a mount --make-rshared / command). The module will mark the whole directory tree so any mount and unmount operations in the polyinstantiation namespace are private. Normally the pam_namespace will try to detect the shared / mount point and make the polyinstantiated directories private automatically. This option has to be used just when only a subtree is shared and / is not. Note that mounts and unmounts done in the private namespace will not affect the parent namespace if this option is used or when the shared / mount point is autodetected.

## MODULE TYPES PROVIDED
Only the session module type is provided. The module must not be called from multithreaded processes.

## RETURN VALUES
PAM_SUCCESS

Namespace setup was successful.

PAM_SERVICE_ERR

Unexpected system error occurred while setting up namespace.

PAM_SESSION_ERR

Unexpected namespace configuration error occurred.

## FILES
/etc/security/namespace.conf

Main configuration file

/etc/security/namespace.d

Directory for additional configuration files

/etc/security/namespace.init

Init script for instance directories

## EXAMPLES
For the <service>s you need polyinstantiation (login for example) put the following line in /etc/pam.d/<service> as the last line for session group:

session required pam_namespace.so [arguments]

To use polyinstantiation with graphical display manager gdm, please refer to gdm's documentation.

## SEE ALSO
namespace.conf(5), pam.d(5), mount(8), pam(8).

## AUTHORS
The namespace setup scheme was designed by Stephen Smalley, Janak Desai and Chad Sellers. The pam_namespace PAM module was developed by Janak Desai <janak@us.ibm.com>, Chad Sellers <csellers@tresys.com> and Steve Grubb <sgrubb@redhat.com>. Additional improvements by Xavier Toth <txtoth@gmail.com> and Tomas Mraz <tmraz@redhat.com>.


title: pam_namespace_helper(8)

text:
# pam_namespace_helper(8)

## NAME
pam_namespace_helper - Helper binary that creates home directories

## SYNOPSIS
pam_namespace_helper

## DESCRIPTION
pam_namespace_helper is a helper program for the pam_namespace module that sets up a private namespace for a session with polyinstantiated directories. The helper ensures that the namespace mount points exist before they are started to be used for the polyinstantiated directories. Mount points for home directories (lines with $HOME) are not created.

pam_namespace_helper should be run by systemd at system startup. It should also be run by the administrator after defining the polyinstantiated directories but before enabling them.

## SEE ALSO
pam_namespace(8)

## AUTHOR
Written by Topi Miettinen.


title: pam_nologin(8)

summary: Prevent non\-root users from login

text:
# pam_nologin(8)

## NAME
pam_nologin - Prevent non-root users from login

## SYNOPSIS
pam_nologin.so [file=/path/nologin] [successok]

## DESCRIPTION
pam_nologin is a PAM module that prevents users from logging into the system when /var/run/nologin or /etc/nologin exists. The contents of the file are displayed to the user. The pam_nologin module has no effect on the root user's ability to log in.

## OPTIONS
file=/path/nologin

Use this file instead the default /var/run/nologin or /etc/nologin.

successok

Return PAM_SUCCESS if no file exists, the default is PAM_IGNORE.

## MODULE TYPES PROVIDED
The auth and account module types are provided.

## RETURN VALUES
PAM_AUTH_ERR

The user is not root and /etc/nologin exists, so the user is not permitted to log in.

PAM_BUF_ERR

Memory buffer error.

PAM_IGNORE

This is the default return value.

PAM_SUCCESS

Success: either the user is root or the nologin file does not exist.

PAM_USER_UNKNOWN

User not known to the underlying authentication module.

## EXAMPLES
The suggested usage for /etc/pam.d/login is:

```
auth  required  pam_nologin.so

```

## NOTES
In order to make this module effective, all login methods should be secured by it. It should be used as a required method listed before any sufficient methods in order to get standard Unix nologin semantics. Note, the use of successok module argument causes the module to return PAM_SUCCESS and as such would break such a configuration - failing sufficient modules would lead to a successful login because the nologin module succeeded.

## SEE ALSO
nologin(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_nologin was written by Michael K. Johnson <johnsonm@redhat.com>.


title: pam_permit(8)

summary: The promiscuous module

text:
# pam_permit(8)

## NAME
pam_permit - The promiscuous module

## SYNOPSIS
pam_permit.so

## DESCRIPTION
pam_permit is a PAM module that always permit access. It does nothing else.

In the case of authentication, the user's name will be set to nobody if the application didn't set one. Many applications and PAM modules become confused if this name is unknown.

This module is very dangerous. It should be used with extreme caution.

## OPTIONS
This module does not recognise any options.

## MODULE TYPES PROVIDED
The auth, account, password and session module types are provided.

## RETURN VALUES
PAM_SUCCESS

This module always returns this value.

## EXAMPLES
Add this line to your other login entries to disable account management, but continue to permit users to log in.

```
account  required  pam_permit.so

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_permit was written by Andrew G. Morgan, <morgan@kernel.org>.


title: pam_pwhistory(8)

summary: PAM module to remember last passwords

text:
# pam_pwhistory(8)

## NAME
pam_pwhistory - PAM module to remember last passwords

## SYNOPSIS
pam_pwhistory.so [debug] [use_authtok] [enforce_for_root] [remember=N] [retry=N] [authtok_type=STRING] [file=/path/filename] [conf=/path/to/config-file]

## DESCRIPTION
This module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently.

This module does not work together with kerberos. In general, it does not make much sense to use this module in conjunction with NIS or LDAP, since the old passwords are stored on the local machine and are not available on another machine for password history checking.

## OPTIONS
debug

Turns on debugging via syslog(3).

use_authtok

When password changing enforce the module to use the new password provided by a previously stacked password module (this is used in the example of the stacking of the pam_passwdqc module documented below).

enforce_for_root

If this option is set, the check is enforced for root, too.

remember=N

The last N passwords for each user are saved. The default is 10. Value of 0 makes the module to keep the existing contents of the opasswd file unchanged.

retry=N

Prompt user at most N times before returning with error. The default is 1.

authtok_type=STRING

See pam_get_authtok(3) for more details.

file=/path/filename

Store password history in file /path/filename rather than the default location. The default location is /etc/security/opasswd.

conf=/path/to/config-file

Use another configuration file instead of the default /etc/security/pwhistory.conf.

The options for configuring the module behavior are described in the pwhistory.conf(5) manual page. The options specified on the module command line override the values from the configuration file.

## MODULE TYPES PROVIDED
Only the password module type is provided.

## RETURN VALUES
PAM_AUTHTOK_ERR

No new password was entered, the user aborted password change or new password couldn't be set.

PAM_IGNORE

Password history was disabled.

PAM_MAXTRIES

Password was rejected too often.

PAM_USER_UNKNOWN

User is not known to system.

## EXAMPLES
An example password section would be:

```
#%PAM-1.0
password     required       pam_pwhistory.so
password     required       pam_unix.so        use_authtok

```

In combination with pam_passwdqc:

```
#%PAM-1.0
password     required       pam_passwdqc.so    config=/etc/passwdqc.conf
password     required       pam_pwhistory.so   use_authtok
password     required       pam_unix.so        use_authtok

```

## FILES
/etc/security/opasswd

Default file with password history

/etc/security/pwhistory.conf

Config file for pam_pwhistory options

## SEE ALSO
pwhistory.conf(5), pam.conf(5), pam.d(5), pam(8) pam_get_authtok(3)

## AUTHOR
pam_pwhistory was written by Thorsten Kukuk <kukuk@thkukuk.de>


title: pam_rhosts(8)

summary: The rhosts PAM module

text:
# pam_rhosts(8)

## NAME
pam_rhosts - The rhosts PAM module

## SYNOPSIS
pam_rhosts.so

## DESCRIPTION
This module performs the standard network authentication for services, as used by traditional implementations of rlogin and rsh etc.

The authentication mechanism of this module is based on the contents of two files; /etc/hosts.equiv (or and ~/.rhosts. Firstly, hosts listed in the former file are treated as equivalent to the localhost. Secondly, entries in the user's own copy of the latter file is used to map "remote-host remote-user" pairs to that user's account on the current host. Access is granted to the user if their host is present in /etc/hosts.equiv and their remote account is identical to their local one, or if their remote account has an entry in their personal configuration file.

The module authenticates a remote user (internally specified by the item PAM_RUSER connecting from the remote host (internally specified by the item PAM_RHOST). Accordingly, for applications to be compatible this authentication module they must set these items prior to calling pam_authenticate(). The module is not capable of independently probing the network connection for such information.

## OPTIONS
debug

Print debug information.

silent

Don't print informative messages.

superuser=account

Handle account as root.

## MODULE TYPES PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_AUTH_ERR

The remote host, remote user name or the local user name couldn't be determined or access was denied by .rhosts file.

PAM_USER_UNKNOWN

User is not known to system.

## EXAMPLES
To grant a remote user access by /etc/hosts.equiv or .rhosts for rsh add the following lines to /etc/pam.d/rsh:

```
#%PAM-1.0
#
auth     required       pam_rhosts.so
auth     required       pam_nologin.so
auth     required       pam_env.so
auth     required       pam_unix.so

```

## SEE ALSO
rootok(3), hosts.equiv(5), rhosts(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_rhosts was written by Thorsten Kukuk <kukuk@thkukuk.de>