login(1)

PAM only applications

NAME

SYNOPSIS

login [-p] [-h hostname] [-f] [--] [username]

DESCRIPTION

The login application opens an interactive session with a Linux workstation. It is one of the first applications a user interacts with, but is generally not invoked by a normal user. Instead some program like getty(1m) will invoke login.

Following a successful application for service, the login application makes entries in the utmp(5) and wtmp(5) databases. In this way the number of users logged-into the system can be tracked with commands like, who(1) and w(1). Following the termination of the user's login shell, login removes the corresponding utmp(5) entry.

Login is configured to work through the Linux-PAM API. Essentially, it initializes itself as a "login" service with Linux-PAM and utilizes the configured account, authentication, password and session modules to authenticate and then invoke a session with the assumed user's identity. In the case that the accounting module reports that a user's authentication token(s) has(have) expired, the user is required to enter suitable replacements before proceeding. Such updates are performed by the password module(s).

For continuity of service, the administrator might wish to make the su(1) and login module configurations similar.

Login will timeout after 80 seconds. It will warn the user that they should type something after 65 seconds.

The arguments passed to login are generally used by other applications, and have the following meanings:

username: The prospective name of the user requesting services on the system.
-p: This argument is used by applications like telnetd(8) to instruct login to preserve the environment variables it is invoked with; these may include variables like TERM and DISPLAY, which give the system information about the remote applicant's connection. (Note, these environment variables may be over-written by those modules configured to perform authentication tasks for the login application. In particular, the following POSIX environment variables LOGNAME and HOME, are set to their appropriate values by the login application.)
-h hostname: This option is used to explicitly indicate the name of the remote host from which this login-service application originated. It is typically used by telnetd(8).
-f: Ignore the need to authenticate the user - trust that this has already been performed by a parent application. This option instructs login to not call pam_authenticate(2). However, login will call pam_acct_mgmt(2) to establish whether the user is permitted access at this time.
--: There are no more arguments. The subsequent argument is to be interpreted as the user's name. The only possible use for this flag is to allow a username to begin with a `-'. It is unclear how useful a feature this is, but it is supported to allow for certain pedantic getty(1m)s.

EXIT CODE

On successful completion of its task, login will complete with exit code 0. An exit code of 1 indicates an error occurred. Textual errors are written to the standard error stream.

FILES

By way of suggestions for modules to attach to this application, pam_lastlog(session) and pam_mail(auth) may be desired to make this application operate as it did historically.

CONFORMING TO

Linux-PAM (Pluggable Authentication modules for Linux).
Note, your distribution of Linux-PAM will likely store the modules in /usr/lib/security or /lib/security/.

BUGS

None known.