title: pam_motd(8)

summary: Display the motd file

text:
# pam_motd(8)

## NAME
pam_motd - Display the motd file

## SYNOPSIS
pam_motd.so [motd=/path/filename] [motd_dir=/path/dirname.d]

## DESCRIPTION
pam_motd is a PAM module that can be used to display arbitrary motd (message of the day) files after a successful login. By default, pam_motd shows files in the following locations:

/etc/motd

/run/motd

/usr/lib/motd

/etc/motd.d/

/run/motd.d/

/usr/lib/motd.d/

Each message size is limited to 64KB.

If /etc/motd does not exist, then /run/motd is shown. If /run/motd does not exist, then /usr/lib/motd is shown.

Similar overriding behavior applies to the directories. Files in /etc/motd.d/ override files with the same name in /run/motd.d/ and /usr/lib/motd.d/. Files in /run/motd.d/ override files with the same name in /usr/lib/motd.d/.

Files in the directories listed above are displayed in lexicographic order by name. Moreover, the files are filtered by reading them with the credentials of the target user authenticating on the system.

To silence a message, a symbolic link with target /dev/null may be placed in /etc/motd.d with the same filename as the message to be silenced. Example: Creating a symbolic link as follows silences /usr/lib/motd.d/my_motd.

ln -s /dev/null /etc/motd.d/my_motd

The MOTD_SHOWN=pam environment variable is set after showing the motd files, even when all of them were silenced using symbolic links.

## OPTIONS
motd=/path/filename

The /path/filename file is displayed as message of the day. Multiple paths to try can be specified as a colon-separated list. By default this option is set to /etc/motd:/run/motd:/usr/lib/motd.

motd_dir=/path/dirname.d

The /path/dirname.d directory is scanned and each file contained inside of it is displayed. Multiple directories to scan can be specified as a colon-separated list. By default this option is set to /etc/motd.d:/run/motd.d:/usr/lib/motd.d.

When no options are given, the default behavior applies for both options. Specifying either option (or both) will disable the default behavior for both options.

## MODULE TYPES PROVIDED
Only the session module type is provided.

## RETURN VALUES
PAM_ABORT

Not all relevant data or options could be obtained.

PAM_BUF_ERR

Memory buffer error.

PAM_IGNORE

This is the default return value of this module.

## EXAMPLES
The suggested usage for /etc/pam.d/login is:

```
session  optional  pam_motd.so

```

To use a motd file from a different location:

```
session  optional  pam_motd.so motd=/elsewhere/motd

```

To use a motd file from elsewhere, along with a corresponding .d directory:

```
session  optional  pam_motd.so motd=/elsewhere/motd motd_dir=/elsewhere/motd.d

```

## SEE ALSO
motd(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_motd was written by Ben Collins <bcollins@debian.org>.

The motd_dir= option was added by Allison Karlitskaya <allison.karlitskaya@redhat.com>.


package: pam

title: pam_namespace(8)

text:
# pam_namespace(8)

## NAME
pam_namespace - PAM module for configuring namespace for a session

## SYNOPSIS
pam_namespace.so [debug] [unmnt_remnt] [unmnt_only] [require_selinux] [gen_hash] [ignore_config_error] [ignore_instance_parent_mode] [unmount_on_close] [use_current_context] [use_default_context] [mount_private]

## DESCRIPTION
The pam_namespace PAM module sets up a private namespace for a session with polyinstantiated directories. A polyinstantiated directory provides a different instance of itself based on user name, or when using SELinux, user name, security context or both. If an executable script /etc/security/namespace.init exists, it is used to initialize the instance directory after it is set up and mounted on the polyinstantiated directory. The script receives the polyinstantiated directory path, the instance directory path, flag whether the instance directory was newly created (0 for no, 1 for yes), and the user name as its arguments. The script is invoked with full root privileges and accessing the instance directory in this context needs to be done with caution, as it is controlled by the unprivileged user for which it has been created.

The pam_namespace module disassociates the session namespace from the parent namespace. Any mounts/unmounts performed in the parent namespace, such as mounting of devices, are not reflected in the session namespace. To propagate selected mount/unmount events from the parent namespace into the disassociated session namespace, an administrator may use the special shared-subtree feature. For additional information on shared-subtree feature, please refer to the mount(8) man page and the shared-subtree description at http://lwn.net/Articles/159077 and http://lwn.net/Articles/159092.

## OPTIONS
debug

A lot of debug information is logged using syslog

unmnt_remnt

For programs such as su and newrole, the login session has already setup a polyinstantiated namespace. For these programs, polyinstantiation is performed based on new user id or security context, however the command first needs to undo the polyinstantiation performed by login. This argument instructs the command to first undo previous polyinstantiation before proceeding with new polyinstantiation based on new id/context

unmnt_only

For trusted programs that want to undo any existing bind mounts and process instance directories on their own, this argument allows them to unmount currently mounted instance directories

require_selinux

If selinux is not enabled, return failure

gen_hash

Instead of using the security context string for the instance name, generate and use its md5 hash.

ignore_config_error

If a line in the configuration file corresponding to a polyinstantiated directory contains format error, skip that line process the next line. Without this option, pam will return an error to the calling program resulting in termination of the session.

ignore_instance_parent_mode

Instance parent directories by default are expected to have the restrictive mode of 000. Using this option, an administrator can choose to ignore the mode of the instance parent. This option should be used with caution as it will reduce security and isolation goals of the polyinstantiation mechanism.

unmount_on_close

Explicitly unmount the polyinstantiated directories instead of relying on automatic namespace destruction after the last process in a namespace exits. This option should be used only in case it is ensured by other means that there cannot be any processes running in the private namespace left after the session close. It is also useful only in case there are multiple pam session calls in sequence from the same process.

use_current_context

Useful for services which do not change the SELinux context with setexeccon call. The module will use the current SELinux context of the calling process for the level and context polyinstantiation.

use_default_context

Useful for services which do not use pam_selinux for changing the SELinux context with setexeccon call. The module will use the default SELinux context of the user for the level and context polyinstantiation.

mount_private

This option can be used on systems where the / mount point or its submounts are made shared (for example with a mount --make-rshared / command). The module will mark the whole directory tree so any mount and unmount operations in the polyinstantiation namespace are private. Normally the pam_namespace will try to detect the shared / mount point and make the polyinstantiated directories private automatically. This option has to be used just when only a subtree is shared and / is not. Note that mounts and unmounts done in the private namespace will not affect the parent namespace if this option is used or when the shared / mount point is autodetected.

## MODULE TYPES PROVIDED
Only the session module type is provided. The module must not be called from multithreaded processes.

## RETURN VALUES
PAM_SUCCESS

Namespace setup was successful.

PAM_SERVICE_ERR

Unexpected system error occurred while setting up namespace.

PAM_SESSION_ERR

Unexpected namespace configuration error occurred.

## FILES
/etc/security/namespace.conf

Main configuration file

/etc/security/namespace.d

Directory for additional configuration files

/etc/security/namespace.init

Init script for instance directories

## EXAMPLES
For the <service>s you need polyinstantiation (login for example) put the following line in /etc/pam.d/<service> as the last line for session group:

session required pam_namespace.so [arguments]

To use polyinstantiation with graphical display manager gdm, please refer to gdm's documentation.

## SEE ALSO
namespace.conf(5), pam.d(5), mount(8), pam(8).

## AUTHORS
The namespace setup scheme was designed by Stephen Smalley, Janak Desai and Chad Sellers. The pam_namespace PAM module was developed by Janak Desai <janak@us.ibm.com>, Chad Sellers <csellers@tresys.com> and Steve Grubb <sgrubb@redhat.com>. Additional improvements by Xavier Toth <txtoth@gmail.com> and Tomas Mraz <tmraz@redhat.com>.


title: pam_namespace_helper(8)

text:
# pam_namespace_helper(8)

## NAME
pam_namespace_helper - Helper binary that creates home directories

## SYNOPSIS
pam_namespace_helper

## DESCRIPTION
pam_namespace_helper is a helper program for the pam_namespace module that sets up a private namespace for a session with polyinstantiated directories. The helper ensures that the namespace mount points exist before they are started to be used for the polyinstantiated directories. Mount points for home directories (lines with $HOME) are not created.

pam_namespace_helper should be run by systemd at system startup. It should also be run by the administrator after defining the polyinstantiated directories but before enabling them.

## SEE ALSO
pam_namespace(8)

## AUTHOR
Written by Topi Miettinen.


title: pam_nologin(8)

summary: Prevent non\-root users from login

text:
# pam_nologin(8)

## NAME
pam_nologin - Prevent non-root users from login

## SYNOPSIS
pam_nologin.so [file=/path/nologin] [successok]

## DESCRIPTION
pam_nologin is a PAM module that prevents users from logging into the system when /var/run/nologin or /etc/nologin exists. The contents of the file are displayed to the user. The pam_nologin module has no effect on the root user's ability to log in.

## OPTIONS
file=/path/nologin

Use this file instead the default /var/run/nologin or /etc/nologin.

successok

Return PAM_SUCCESS if no file exists, the default is PAM_IGNORE.

## MODULE TYPES PROVIDED
The auth and account module types are provided.

## RETURN VALUES
PAM_AUTH_ERR

The user is not root and /etc/nologin exists, so the user is not permitted to log in.

PAM_BUF_ERR

Memory buffer error.

PAM_IGNORE

This is the default return value.

PAM_SUCCESS

Success: either the user is root or the nologin file does not exist.

PAM_USER_UNKNOWN

User not known to the underlying authentication module.

## EXAMPLES
The suggested usage for /etc/pam.d/login is:

```
auth  required  pam_nologin.so

```

## NOTES
In order to make this module effective, all login methods should be secured by it. It should be used as a required method listed before any sufficient methods in order to get standard Unix nologin semantics. Note, the use of successok module argument causes the module to return PAM_SUCCESS and as such would break such a configuration - failing sufficient modules would lead to a successful login because the nologin module succeeded.

## SEE ALSO
nologin(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_nologin was written by Michael K. Johnson <johnsonm@redhat.com>.


title: pam_permit(8)

summary: The promiscuous module

text:
# pam_permit(8)

## NAME
pam_permit - The promiscuous module

## SYNOPSIS
pam_permit.so

## DESCRIPTION
pam_permit is a PAM module that always permit access. It does nothing else.

In the case of authentication, the user's name will be set to nobody if the application didn't set one. Many applications and PAM modules become confused if this name is unknown.

This module is very dangerous. It should be used with extreme caution.

## OPTIONS
This module does not recognise any options.

## MODULE TYPES PROVIDED
The auth, account, password and session module types are provided.

## RETURN VALUES
PAM_SUCCESS

This module always returns this value.

## EXAMPLES
Add this line to your other login entries to disable account management, but continue to permit users to log in.

```
account  required  pam_permit.so

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_permit was written by Andrew G. Morgan, <morgan@kernel.org>.


title: pam_pwhistory(8)

summary: PAM module to remember last passwords

text:
# pam_pwhistory(8)

## NAME
pam_pwhistory - PAM module to remember last passwords

## SYNOPSIS
pam_pwhistory.so [debug] [use_authtok] [enforce_for_root] [remember=N] [retry=N] [authtok_type=STRING] [file=/path/filename] [conf=/path/to/config-file]

## DESCRIPTION
This module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently.

This module does not work together with kerberos. In general, it does not make much sense to use this module in conjunction with NIS or LDAP, since the old passwords are stored on the local machine and are not available on another machine for password history checking.

## OPTIONS
debug

Turns on debugging via syslog(3).

use_authtok

When password changing enforce the module to use the new password provided by a previously stacked password module (this is used in the example of the stacking of the pam_passwdqc module documented below).

enforce_for_root

If this option is set, the check is enforced for root, too.

remember=N

The last N passwords for each user are saved. The default is 10. Value of 0 makes the module to keep the existing contents of the opasswd file unchanged.

retry=N

Prompt user at most N times before returning with error. The default is 1.

authtok_type=STRING

See pam_get_authtok(3) for more details.

file=/path/filename

Store password history in file /path/filename rather than the default location. The default location is /etc/security/opasswd.

conf=/path/to/config-file

Use another configuration file instead of the default /etc/security/pwhistory.conf.

The options for configuring the module behavior are described in the pwhistory.conf(5) manual page. The options specified on the module command line override the values from the configuration file.

## MODULE TYPES PROVIDED
Only the password module type is provided.

## RETURN VALUES
PAM_AUTHTOK_ERR

No new password was entered, the user aborted password change or new password couldn't be set.

PAM_IGNORE

Password history was disabled.

PAM_MAXTRIES

Password was rejected too often.

PAM_USER_UNKNOWN

User is not known to system.

## EXAMPLES
An example password section would be:

```
#%PAM-1.0
password     required       pam_pwhistory.so
password     required       pam_unix.so        use_authtok

```

In combination with pam_passwdqc:

```
#%PAM-1.0
password     required       pam_passwdqc.so    config=/etc/passwdqc.conf
password     required       pam_pwhistory.so   use_authtok
password     required       pam_unix.so        use_authtok

```

## FILES
/etc/security/opasswd

Default file with password history

/etc/security/pwhistory.conf

Config file for pam_pwhistory options

## SEE ALSO
pwhistory.conf(5), pam.conf(5), pam.d(5), pam(8) pam_get_authtok(3)

## AUTHOR
pam_pwhistory was written by Thorsten Kukuk <kukuk@thkukuk.de>


title: pam_rhosts(8)

summary: The rhosts PAM module

text:
# pam_rhosts(8)

## NAME
pam_rhosts - The rhosts PAM module

## SYNOPSIS
pam_rhosts.so

## DESCRIPTION
This module performs the standard network authentication for services, as used by traditional implementations of rlogin and rsh etc.

The authentication mechanism of this module is based on the contents of two files; /etc/hosts.equiv (or and ~/.rhosts. Firstly, hosts listed in the former file are treated as equivalent to the localhost. Secondly, entries in the user's own copy of the latter file is used to map "remote-host remote-user" pairs to that user's account on the current host. Access is granted to the user if their host is present in /etc/hosts.equiv and their remote account is identical to their local one, or if their remote account has an entry in their personal configuration file.

The module authenticates a remote user (internally specified by the item PAM_RUSER connecting from the remote host (internally specified by the item PAM_RHOST). Accordingly, for applications to be compatible this authentication module they must set these items prior to calling pam_authenticate(). The module is not capable of independently probing the network connection for such information.

## OPTIONS
debug

Print debug information.

silent

Don't print informative messages.

superuser=account

Handle account as root.

## MODULE TYPES PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_AUTH_ERR

The remote host, remote user name or the local user name couldn't be determined or access was denied by .rhosts file.

PAM_USER_UNKNOWN

User is not known to system.

## EXAMPLES
To grant a remote user access by /etc/hosts.equiv or .rhosts for rsh add the following lines to /etc/pam.d/rsh:

```
#%PAM-1.0
#
auth     required       pam_rhosts.so
auth     required       pam_nologin.so
auth     required       pam_env.so
auth     required       pam_unix.so

```

## SEE ALSO
rootok(3), hosts.equiv(5), rhosts(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_rhosts was written by Thorsten Kukuk <kukuk@thkukuk.de>


title: pam_rootok(8)

summary: Gain only root access

text:
# pam_rootok(8)

## NAME
pam_rootok - Gain only root access

## SYNOPSIS
pam_rootok.so [debug]

## DESCRIPTION
pam_rootok is a PAM module that authenticates the user if their UID is 0. Applications that are created setuid-root generally retain the UID of the user but run with the authority of an enhanced effective-UID. It is the real UID that is checked.

## OPTIONS
debug

Print debug information.

## MODULE TYPES PROVIDED
The auth, account and password module types are provided.

## RETURN VALUES
PAM_SUCCESS

The UID is 0.

PAM_AUTH_ERR

The UID is not 0.

## EXAMPLES
In the case of the su(1) application the historical usage is to permit the superuser to adopt the identity of a lesser user without the use of a password. To obtain this behavior with PAM the following pair of lines are needed for the corresponding entry in the /etc/pam.d/su configuration file:

```
# su authentication. Root is granted access by default.
auth  sufficient   pam_rootok.so
auth  required     pam_unix.so

```

## SEE ALSO
su(1), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_rootok was written by Andrew G. Morgan, <morgan@kernel.org>.


title: pam_sameuid(8)

text:
# pam_sameuid(8)

## NAME
pam_sameuid - Permit if PAM_USER is the same as the current user

## SYNOPSIS
pam_sameuid.so [debug]

## DESCRIPTION
The pam_sameuid is a PAM module that permit access if PAM_USER is the same as the current user.

## OPTIONS
debug

Write a message to syslog indicating success or failure.

## MODULE TYPES PROVIDED
The auth and account module types are provided.

## RETURN VALUES
PAM_USER_UNKNOWN

User not known.

PAM_SERVICE_ERR

Cannot determine the user name.

PAM_IGNORE

PAM_USER is not the same as the current user.

PAM_SUCCESS

PAM_USER is the same as the current user.

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_sameuid was written by Dmitry V. Levin <ldv@altlinux.org>.


title: pam_securetty(8)

summary: Limit root login to special devices

text:
# pam_securetty(8)

## NAME
pam_securetty - Limit root login to special devices

## SYNOPSIS
pam_securetty.so [debug]

## DESCRIPTION
pam_securetty is a PAM module that allows root logins only if the user is logging in on a "secure" tty, as defined by the listing in the securetty file. pam_securetty checks at first, if /etc/securetty exists. If not and it was built with vendordir support, it will use /securetty. pam_securetty also checks that the securetty files are plain files and not world writable. It will also allow root logins on the tty specified with console= switch on the kernel command line and on ttys from the /sys/class/tty/console/active.

This module has no effect on non-root users and requires that the application fills in the PAM_TTY item correctly.

For canonical usage, should be listed as a required authentication method before any sufficient authentication methods.

## OPTIONS
debug

Print debug information.

noconsole

Do not automatically allow root logins on the kernel console device, as specified on the kernel command line or by the sys file, if it is not also specified in the securetty file.

## MODULE TYPES PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_SUCCESS

The user is allowed to continue authentication. Either the user is not root, or the root user is trying to log in on an acceptable device.

PAM_AUTH_ERR

Authentication is rejected. Either root is attempting to log in via an unacceptable device, or the securetty file is world writable or not a normal file.

PAM_BUF_ERR

Memory buffer error.

PAM_CONV_ERR

The conversation method supplied by the application failed to obtain the username.

PAM_INCOMPLETE

The conversation method supplied by the application returned PAM_CONV_AGAIN.

PAM_SERVICE_ERR

An error occurred while the module was determining the user's name or tty, or the module could not open the securetty file.

PAM_USER_UNKNOWN

The module could not find the user name in the /etc/passwd file to verify whether the user had a UID of 0. Therefore, the results of running this module are ignored.

## EXAMPLES

```
auth  required  pam_securetty.so
auth  required  pam_unix.so

```

## SEE ALSO
securetty(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_securetty was written by Elliot Lee <sopwith@cuc.edu>.


title: pam_selinux(8)

text:
# pam_selinux(8)

## NAME
pam_selinux - PAM module to set the default security context

## SYNOPSIS
pam_selinux.so [open] [close] [restore] [nottys] [debug] [verbose] [select_context] [env_params] [use_current_range]

## DESCRIPTION
pam_selinux is a PAM module that sets up the default SELinux security context for the next executed process.

When a new session is started, the open_session part of the module computes and sets up the execution security context used for the next execve(2) call, the file security context for the controlling terminal, and the security context used for creating a new kernel keyring.

When the session is ended, the close_session part of the module restores old security contexts that were in effect before the change made by the open_session part of the module.

Adding pam_selinux into the PAM stack might disrupt behavior of other PAM modules which execute applications. To avoid that, pam_selinux.so open should be placed after such modules in the PAM stack, and pam_selinux.so close should be placed before them. When such a placement is not feasible, pam_selinux.so restore could be used to temporary restore original security contexts.

## OPTIONS
open

Only execute the open_session part of the module.

close

Only execute the close_session part of the module.

restore

In open_session part of the module, temporarily restore the security contexts as they were before the previous call of the module. Another call of this module without the restore option will set up the new security contexts again.

nottys

Do not setup security context of the controlling terminal.

debug

Turn on debug messages via syslog(3).

verbose

Attempt to inform the user when security context is set.

select_context

Attempt to ask the user for a custom security context role. If MLS is on, ask also for sensitivity level.

env_params

Attempt to obtain a custom security context role from PAM environment. If MLS is on, obtain also sensitivity level. This option and the select_context option are mutually exclusive. The respective PAM environment variables are SELINUX_ROLE_REQUESTED, SELINUX_LEVEL_REQUESTED, and SELINUX_USE_CURRENT_RANGE. The first two variables are self describing and the last one if set to 1 makes the PAM module behave as if the use_current_range was specified on the command line of the module.

use_current_range

Use the sensitivity level of the current process for the user context instead of the default level. Also suppresses asking of the sensitivity level from the user or obtaining it from PAM environment.

## MODULE TYPES PROVIDED
Only the session module type is provided.

## RETURN VALUES
PAM_SUCCESS

The security context was set successfully.

PAM_SESSION_ERR

Unable to get or set a valid context.

PAM_USER_UNKNOWN

The user is not known to the system.

PAM_BUF_ERR

Memory allocation error.

## EXAMPLES

```
auth     required  pam_unix.so
session  required  pam_permit.so
session  optional  pam_selinux.so

```

## SEE ALSO
execve(2), tty(4), pam.d(5), pam(8), selinux(8)

## AUTHOR
pam_selinux was written by Dan Walsh <dwalsh@redhat.com>.


title: pam_sepermit(8)

text:
# pam_sepermit(8)

## NAME
pam_sepermit - PAM module to allow/deny login depending on SELinux enforcement state

## SYNOPSIS
pam_sepermit.so [debug] [conf=/path/to/config/file]

## DESCRIPTION
The pam_sepermit module allows or denies login depending on SELinux enforcement state.

When the users which are logging in match an entry in the config file they are allowed access only when SELinux is in enforcing mode. Otherwise they are denied access. For users not matching any entry in the config file the pam_sepermit module returns PAM_IGNORE return value.

The config file contains a list of user names one per line with optional arguments. If the name is prefixed with @ character it means that all users in the group name match. If it is prefixed with a % character the SELinux user is used to match against the name instead of the account name. Note that when SELinux is disabled the SELinux user assigned to the account cannot be determined. This means that such entries are never matched when SELinux is disabled and pam_sepermit will return PAM_IGNORE.

See sepermit.conf(5) for details.

## OPTIONS
debug

Turns on debugging via syslog(3).

conf=/path/to/config/file

Path to alternative config file overriding the default.

## MODULE TYPES PROVIDED
The auth and account module types are provided.

## RETURN VALUES
PAM_AUTH_ERR

SELinux is disabled or in the permissive mode and the user matches.

PAM_SUCCESS

SELinux is in the enforcing mode and the user matches.

PAM_IGNORE

The user does not match any entry in the config file.

PAM_USER_UNKNOWN

The module was unable to determine the user's name.

PAM_SERVICE_ERR

Error during reading or parsing the config file.

## FILES
/etc/security/sepermit.conf

Default configuration file

## EXAMPLES

```
auth     [success=done ignore=ignore default=bad] pam_sepermit.so
auth     required  pam_unix.so
account  required  pam_unix.so
session  required  pam_permit.so

```

## SEE ALSO
sepermit.conf(5), pam.conf(5), pam.d(5), pam(8) selinux(8)

## AUTHOR
pam_sepermit and this manual page were written by Tomas Mraz <tmraz@redhat.com>.


title: pam_setquota(8)

text:
# pam_setquota(8)

## NAME
pam_setquota - PAM module to set or modify disk quotas on session start

## SYNOPSIS
pam_setquota.so [fs=/home] [overwrite=0] [debug=0] [startuid=1000] [enduid=0] [bsoftlimit=19000] [bhardlimit=20000] [isoftlimit=3000] [ihardlimit=4000]

## DESCRIPTION
pam_setquota is a PAM module to set or modify a disk quota at session start

This makes quotas usable with central user databases, such as MySQL or LDAP.

## OPTIONS
fs=/home

The device file or mountpoint the policy applies to. Defaults to the filesystem containing the users home directory.

overwrite=0

Overwrite an existing quota. Note: Enabling this will remove the ability for the admin to manually configure different quotas for users for a filesystem with edquota(8). (Defaults to 0)

debug=0

Enable debugging. A value of 1 outputs the old and new quota on a device. A value of 2 also prints out the matched and found filesystems should fs be unset. (Defaults to 0)

startuid=1000

Describe the start of the UID range the policy is applied to. (Defaults to UID_MIN from login.defs or the uidmin value defined at compile-time if UID_MIN is undefined.)

enduid=0

Describe the end of the UID range the policy is applied to. Setting enduid=0 results in an open-ended UID range (i.e. all uids greater than startuid are included). (Defaults to 0)

bsoftlimit=19000

Soft limit for disk quota blocks, as defined by quotactl(2). Note: bsoftlimit and bhardlimit must be set at the same time!

bhardlimit=20000

Hard limit for disk quota blocks, as defined by quotactl(2). Note: bsoftlimit and bhardlimit must be set at the same time!

isoftlimit=3000

Soft limit for inodes, as defined by quotactl(2). Note: isoftlimit and ihardlimit must be set at the same time!

ihardlimit=4000

Hard limit for inodes, as defined by quotactl(2). Note: isoftlimit and ihardlimit must be set at the same time!

## MODULE TYPES PROVIDED
Only the session module type is provided.

## RETURN VALUES
PAM_SUCCESS

The quota was set successfully.

PAM_IGNORE

No action was taken because either the UID of the user was outside of the specified range, a quota already existed and overwrite=1 was not configured or no limits were configured at all.

PAM_USER_UNKNOWN

The user was not found.

PAM_PERM_DENIED

/proc/mounts could not be opened. The filesystem or device specified was not found.

The limits for the user could not be retrieved. See syslog for more information.

The limits for the user could not be set. See syslog for more information.

Either isoftlimit/ihardlimit or bsoftlimit/bhardlimit were not set at the same time.

## EXAMPLES
A single invocation of `pam_setquota` applies a specific policy to a UID range. Applying different policies to specific UID ranges is done by invoking pam_setquota more than once. The last matching entry defines the resulting quota.

```
      session  required   pam_setquota.so bsoftlimit=1000 bhardlimit=2000 isoftlimit=1000 ihardlimit=2000 startuid=1000 enduid=0 fs=/home

      session  required   pam_setquota.so bsoftlimit=19000 bhardlimit=20000 isoftlimit=3000 ihardlimit=4000 startuid=2001 enduid=3000 fs=/dev/sda1

      session  required   pam_setquota.so bsoftlimit=19000 bhardlimit=20000 isoftlimit=3000 ihardlimit=4000 startuid=3001 enduid=4000 fs=/dev/sda1 overwrite=1

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_setquota was originally written by Ruslan Savchenko <savrus@mexmat.net>.

Further modifications were made by Shane Tzen <shane@ict.usc.edu>, Sven Hartge <sven@svenhartge.de> and Keller Fuchs <kellerfuchs@hashbang.sh>.


title: pam_shells(8)

text:
# pam_shells(8)

## NAME
pam_shells - PAM module to check for valid login shell

## SYNOPSIS
pam_shells.so

## DESCRIPTION
pam_shells is a PAM module that only allows access to the system if the user's shell is listed in /etc/shells.

It also checks if needed files (e.g. /etc/shells) are plain files and not world writable.

## OPTIONS
This module does not recognise any options.

## MODULE TYPES PROVIDED
The auth and account module types are provided.

## RETURN VALUES
PAM_AUTH_ERR

Access to the system was denied.

PAM_SUCCESS

The user's login shell was listed as valid shell in /etc/shells.

PAM_USER_UNKNOWN

The user does not exist or the user's login shell could not be determined.

PAM_SERVICE_ERR

The module was not able to get the name of the user.

## EXAMPLES

```
auth  required  pam_shells.so

```

## SEE ALSO
shells(5), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_shells was written by Erik Troan <ewt@redhat.com>.


title: pam_stress(8)

summary: The stress\-testing PAM module

text:
# pam_stress(8)

## NAME
pam_stress - The stress-testing PAM module

## SYNOPSIS
pam_stress.so [debug] [no_warn] [use_first_pass] [try_first_pass] [rootok] [expired] [fail_1] [fail_2] [prelim] [required]

## DESCRIPTION
The pam_stress PAM module is mainly intended to give the impression of failing as a fully functioning module might.

## OPTIONS
debug

Put lots of information in syslog. *NOTE* this option writes passwords to syslog, so don't use anything sensitive when testing.

no_warn

Do not give warnings about things (otherwise warnings are issued via the conversation function)

use_first_pass

Do not prompt for a password, for pam_sm_authentication function just use item PAM_AUTHTOK.

try_first_pass

Do not prompt for a password unless there has been no previous authentication token (item PAM_AUTHTOK is NULL)

rootok

This is intended for the pam_sm_chauthtok function and it instructs this function to permit root to change the user's password without entering the old password.

expired

An argument intended for the account and chauthtok module parts. It instructs the module to act as if the user's password has expired

fail_1

This instructs the module to make its first function fail.

fail_2

This instructs the module to make its second function (if there is one) fail.

prelim

For pam_sm_chauthtok, means fail on PAM_PRELIM_CHECK.

required

For pam_sm_chauthtok, means fail if the user hasn't already been authenticated by this module. (See stress_new_pwd data string in the NOTES.)

## MODULE TYPES PROVIDED
All module types (auth, account, password and session) are provided.

## RETURN VALUES
PAM_BUF_ERR

Memory buffer error.

PAM_PERM_DENIED

Permission denied.

PAM_AUTH_ERR

Access to the system was denied.

PAM_CONV_ERR

Conversation failure.

PAM_SUCCESS

The function passes all checks.

PAM_USER_UNKNOWN

The user is not known to the system.

PAM_CRED_ERR

Failure involving user credentials.

PAM_NEW_AUTHTOK_REQD

Authentication token is no longer valid; new one required.

PAM_SESSION_ERR

Session failure.

PAM_TRY_AGAIN

Failed preliminary check by service.

PAM_AUTHTOK_LOCK_BUSY

Authentication token lock busy.

PAM_AUTHTOK_ERR

Authentication token manipulation error.

PAM_SYSTEM_ERR

System error.

## NOTES
This module uses the stress_new_pwd data string which tells pam_sm_chauthtok that pam_sm_acct_mgmt says we need a new password. The only possible value for this data string is 'yes'.

## EXAMPLES

```
#%PAM-1.0
#
# Any of the following will suffice
account  required pam_stress.so
auth     required pam_stress.so
password required pam_stress.so
session  required pam_stress.so

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8).

## AUTHORS
The pam_stress PAM module was developed by Andrew Morgan <morgan@linux.kernel.org>. The man page for pam_stress was written by Lucas Ramage <ramage.lucas@protonmail.com>.


title: pam_succeed_if(8)

summary: test account characteristics

text:
# pam_succeed_if(8)

## NAME
pam_succeed_if - test account characteristics

## SYNOPSIS
pam_succeed_if.so [flag...] [condition...]

## DESCRIPTION
pam_succeed_if.so is designed to succeed or fail authentication based on characteristics of the account belonging to the user being authenticated or values of other PAM items. One use is to select whether to load other modules based on this test.

The module should be given one or more conditions as module arguments, and authentication will succeed only if all of the conditions are met.

## OPTIONS
The following flags are supported:

debug

Turns on debugging messages sent to syslog.

use_uid

Evaluate conditions using the account of the user whose UID the application is running under instead of the user being authenticated.

quiet

Don't log failure or success to the system log.

quiet_fail

Don't log failure to the system log.

quiet_success

Don't log success to the system log.

audit

Log unknown users to the system log.

Conditions are three words: a field, a test, and a value to test for.

Available fields are user, uid, gid, shell, home, ruser, rhost, tty and service:

field < number

Field has a value numerically less than number.

field <= number

Field has a value numerically less than or equal to number.

field eq number

Field has a value numerically equal to number.

field >= number

Field has a value numerically greater than or equal to number.

field > number

Field has a value numerically greater than number.

field ne number

Field has a value numerically different from number.

field = string

Field exactly matches the given string.

field != string

Field does not match the given string.

field =~ glob

Field matches the given glob.

field !~ glob

Field does not match the given glob.

field in item:item:...

Field is contained in the list of items separated by colons.

field notin item:item:...

Field is not contained in the list of items separated by colons.

user ingroup group[:group:....]

User is in given group(s).

user notingroup group[:group:....]

User is not in given group(s).

user innetgr netgroup

(user,host) is in given netgroup.

user notinnetgr group

(user,host) is not in given netgroup.

## MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.

## RETURN VALUES
PAM_SUCCESS

The condition was true.

PAM_AUTH_ERR

The condition was false.

PAM_SERVICE_ERR

A service error occurred or the arguments can't be parsed correctly.

## EXAMPLES
To emulate the behaviour of pam_wheel, except there is no fallback to group 0 being only approximated by checking also the root group membership:

```
auth required pam_succeed_if.so quiet user ingroup wheel:root

```

Given that the type matches, only loads the othermodule rule if the UID is over 500. Adjust the number after default to skip several rules.

```
type [default=1 success=ignore] pam_succeed_if.so quiet uid > 500
type required othermodule.so arguments...

```

## SEE ALSO
glob(7), pam(8)

## AUTHOR
Nalin Dahyabhai <nalin@redhat.com>


title: pam_time(8)

summary: PAM module for time control access

text:
# pam_time(8)

## NAME
pam_time - PAM module for time control access

## SYNOPSIS
pam_time.so [conffile=conf-file] [debug] [noaudit]

## DESCRIPTION
The pam_time PAM module does not authenticate the user, but instead it restricts access to a system and or specific applications at various times of the day and on specific days or over various terminal lines. This module can be configured to deny access to (individual) users based on their name, the time of day, the day of week, the service they are applying for and their terminal from which they are making their request.

By default rules for time/port access are taken from config file /etc/security/time.conf. An alternative file can be specified with the conffile option.

If Linux PAM is compiled with audit support the module will report when it denies access.

## OPTIONS
conffile=/path/to/time.conf

Indicate an alternative time.conf style configuration file to override the default.

debug

Some debug information is printed with syslog(3).

noaudit

Do not report logins at disallowed time to the audit subsystem.

## MODULE TYPES PROVIDED
Only the account type is provided.

## RETURN VALUES
PAM_SUCCESS

Access was granted.

PAM_ABORT

Not all relevant data could be gotten.

PAM_BUF_ERR

Memory buffer error.

PAM_PERM_DENIED

Access was not granted.

PAM_USER_UNKNOWN

The user is not known to the system.

## FILES
/etc/security/time.conf

Default configuration file

## EXAMPLES

```
#%PAM-1.0
#
# apply pam_time accounting to login requests
#
login  account  required  pam_time.so

```

## SEE ALSO
time.conf(5), pam.d(5), pam(8).

## AUTHOR
pam_time was written by Andrew G. Morgan <morgan@kernel.org>.


title: pam_tty_audit(8)

text:
# pam_tty_audit(8)

## NAME
pam_tty_audit - Enable or disable TTY auditing for specified users

## SYNOPSIS
pam_tty_audit.so [disable=patterns] [enable=patterns]

## DESCRIPTION
The pam_tty_audit PAM module is used to enable or disable TTY auditing. By default, the kernel does not audit input on any TTY.

## OPTIONS
disable=patterns

For each user matching patterns, disable TTY auditing. This overrides any previous enable option matching the same user name on the command line. See NOTES for further description of patterns.

enable=patterns

For each user matching patterns, enable TTY auditing. This overrides any previous disable option matching the same user name on the command line. See NOTES for further description of patterns.

open_only

Set the TTY audit flag when opening the session, but do not restore it when closing the session. Using this option is necessary for some services that don't fork() to run the authenticated session, such as sudo.

log_passwd

Log keystrokes when ECHO mode is off but ICANON mode is active. This is the mode in which the tty is placed during password entry. By default, passwords are not logged. This option may not be available on older kernels (3.9?).

## MODULE TYPES PROVIDED
Only the session type is supported.

## RETURN VALUES
PAM_SESSION_ERR

Error reading or modifying the TTY audit flag. See the system log for more details.

PAM_SUCCESS

Success.

## NOTES
When TTY auditing is enabled, it is inherited by all processes started by that user. In particular, daemons restarted by a user will still have TTY auditing enabled, and audit TTY input even by other users unless auditing for these users is explicitly disabled. Therefore, it is recommended to use disable=* as the first option for most daemons using PAM.

To view the data that was logged by the kernel to audit use the command aureport --tty.

The patterns are comma separated lists of glob patterns or ranges of uids. A range is specified as min_uid:max_uid where one of these values can be empty. If min_uid is empty only user with the uid max_uid will be matched. If max_uid is empty users with the uid greater than or equal to min_uid will be matched.

Please note that passwords in some circumstances may be logged by TTY auditing even if the log_passwd is not used. For example, all input to an ssh session will be logged - even if there is a password being typed into some software running at the remote host because only the local TTY state affects the local TTY auditing.

## EXAMPLES
Audit all administrative actions.

```
session	required pam_tty_audit.so disable=* enable=root

```

## SEE ALSO
aureport(8), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_tty_audit was written by Miloslav Trmač <mitr@redhat.com>. The log_passwd option was added by Richard Guy Briggs <rgb@redhat.com>.


title: pam_umask(8)

text:
# pam_umask(8)

## NAME
pam_umask - PAM module to set the file mode creation mask

## SYNOPSIS
pam_umask.so [debug] [silent] [usergroups] [nousergroups] [umask=mask]

## DESCRIPTION
pam_umask is a PAM module to set the file mode creation mask of the current environment. The umask affects the default permissions assigned to newly created files.

The PAM module tries to get the umask value from the following places in the following order:

•umask= entry in the user's GECOS field (see below for details)

•umask= argument

•UMASK entry from /etc/login.defs

•UMASK= entry from /etc/default/login

The GECOS field is split on comma ',' characters. Entries must be set in its 'other' (sub-)field (the 5th field within the GECOS field), which could be done, for example, using chfn --other. In addition to the umask= entry, the module also recognizes the pri= entry, which sets the nice priority value for the session, and the ulimit= entry, which sets the maximum size of files the processes in the session can create.

## OPTIONS
debug

Print debug information.

silent

Don't print informative messages.

usergroups

If the user is not root and the username is the same as primary group name, the umask group bits are set to be the same as owner bits (examples: 022 -> 002, 077 -> 007).

nousergroups

This is the direct opposite of the usergroups option described above, which can be useful in case pam_umask has been compiled with usergroups enabled by default and you want to disable it at runtime.

umask=mask

Sets the calling process's file mode creation mask (umask) to mask & 0777. The value is interpreted as Octal.

## MODULE TYPES PROVIDED
Only the session type is provided.

## RETURN VALUES
PAM_SUCCESS

The new umask was set successfully.

PAM_BUF_ERR

Memory buffer error.

PAM_CONV_ERR

The conversation method supplied by the application failed to obtain the username.

PAM_INCOMPLETE

The conversation method supplied by the application returned PAM_CONV_AGAIN.

PAM_SERVICE_ERR

No username was given.

PAM_USER_UNKNOWN

User not known.

## EXAMPLES
Add the following line to /etc/pam.d/login to set the user specific umask at login:

```
        session optional pam_umask.so umask=0022

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_umask was written by Thorsten Kukuk <kukuk@thkukuk.de>.


title: pam_userdb(8)

text:
# pam_userdb(8)

## NAME
pam_userdb - PAM module to authenticate against a db database

## SYNOPSIS
pam_userdb.so db=/path/database [debug] [crypt=[crypt|none]] [icase] [dump] [try_first_pass] [use_first_pass] [unknown_ok] [key_only]

## DESCRIPTION
The pam_userdb module is used to verify a username/password pair against values stored in a Berkeley DB database. The database is indexed by the username, and the data fields corresponding to the username keys are the passwords.

## OPTIONS
crypt=[crypt|none]

Indicates whether encrypted or plaintext passwords are stored in the database. If it is crypt, passwords should be stored in the database in crypt(3) form. If none is selected, passwords should be stored in the database as plaintext.

db=/path/database

Use the /path/database database for performing lookup. There is no default; the module will return PAM_IGNORE if no database is provided. Note that the path to the database file should be specified without the .db suffix.

debug

Print debug information. Note that password hashes, both from db and computed, will be printed to syslog.

dump

Dump all the entries in the database to the log. Don't do this by default!

icase

Make the password verification to be case insensitive (ie when working with registration numbers and such). Only works with plaintext password storage.

try_first_pass

Use the authentication token previously obtained by another module that did the conversation with the application. If this token can not be obtained then the module will try to converse. This option can be used for stacking different modules that need to deal with the authentication tokens.

use_first_pass

Use the authentication token previously obtained by another module that did the conversation with the application. If this token can not be obtained then the module will fail. This option can be used for stacking different modules that need to deal with the authentication tokens.

unknown_ok

Do not return error when checking for a user that is not in the database. This can be used to stack more than one pam_userdb module that will check a username/password pair in more than a database.

key_only

The username and password are concatenated together in the database hash as 'username-password' with a random value. if the concatenation of the username and password with a dash in the middle returns any result, the user is valid. this is useful in cases where the username may not be unique but the username and password pair are.

## MODULE TYPES PROVIDED
The auth and account module types are provided.

## RETURN VALUES
PAM_AUTH_ERR

Authentication failure.

PAM_AUTHTOK_RECOVERY_ERR

Authentication information cannot be recovered.

PAM_BUF_ERR

Memory buffer error.

PAM_CONV_ERR

Conversation failure.

PAM_SERVICE_ERR

Error in service module.

PAM_SUCCESS

Success.

PAM_USER_UNKNOWN

User not known to the underlying authentication module.

## EXAMPLES

```
auth  sufficient pam_userdb.so icase db=/etc/dbtest

```

## SEE ALSO
crypt(3), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_userdb was written by Cristian Gafton >gafton@redhat.com<.


title: pam_usertype(8)

text:
# pam_usertype(8)

## NAME
pam_usertype - check if the authenticated user is a system or regular account

## SYNOPSIS
pam_usertype.so [flag...] {condition}

## DESCRIPTION
pam_usertype.so is designed to succeed or fail authentication based on type of the account of the authenticated user. The type of the account is decided with help of SYS_UID_MAX settings in /etc/login.defs. One use is to select whether to load other modules based on this test.

The module should be given only one condition as module argument. Authentication will succeed only if the condition is met.

## OPTIONS
The following flags are supported:

use_uid

Evaluate conditions using the account of the user whose UID the application is running under instead of the user being authenticated.

audit

Log unknown users to the system log.

Available conditions are:

issystem

Succeed if the user is a system user.

isregular

Succeed if the user is a regular user.

## MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.

## RETURN VALUES
PAM_SUCCESS

The condition was true.

PAM_BUF_ERR

Memory buffer error.

PAM_CONV_ERR

The conversation method supplied by the application failed to obtain the username.

PAM_INCOMPLETE

The conversation method supplied by the application returned PAM_CONV_AGAIN.

PAM_AUTH_ERR

The condition was false.

PAM_SERVICE_ERR

A service error occurred or the arguments can't be parsed correctly.

PAM_USER_UNKNOWN

User was not found.

## EXAMPLES
Skip remaining modules if the user is a system user:

```
account sufficient pam_usertype.so issystem

```

## SEE ALSO
login.defs(5), pam(8)

## AUTHOR
Pavel Březina <pbrezina@redhat.com>


title: pam_warn(8)

text:
# pam_warn(8)

## NAME
pam_warn - PAM module which logs all PAM items if called

## SYNOPSIS
pam_warn.so

## DESCRIPTION
pam_warn is a PAM module that logs the service, terminal, user, remote user and remote host to syslog(3). The items are not probed for, but instead obtained from the standard PAM items. The module always returns PAM_IGNORE, indicating that it does not want to affect the authentication process.

## OPTIONS
This module does not recognise any options.

## MODULE TYPES PROVIDED
The auth, account, password and session module types are provided.

## RETURN VALUES
PAM_IGNORE

This module always returns PAM_IGNORE.

## EXAMPLES

```
#%PAM-1.0
#
# If we don't have config entries for a service, the
# OTHER entries are used. To be secure, warn and deny
# access to everything.
other auth     required       pam_warn.so
other auth     required       pam_deny.so
other account  required       pam_warn.so
other account  required       pam_deny.so
other password required       pam_warn.so
other password required       pam_deny.so
other session  required       pam_warn.so
other session  required       pam_deny.so

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_warn was written by Andrew G. Morgan <morgan@kernel.org>.


title: pam_wheel(8)

text:
# pam_wheel(8)

## NAME
pam_wheel - Only permit root access to members of group wheel

## SYNOPSIS
pam_wheel.so [debug] [deny] [group=name] [root_only] [trust] [use_uid]

## DESCRIPTION
The pam_wheel PAM module is used to enforce the so-called wheel group. By default it permits access to the target user if the applicant user is a member of the wheel group. If no group with this name exist, the module is using the group with the group-ID 0.

## OPTIONS
debug

Print debug information.

deny

Reverse the sense of the auth operation: if the user is trying to get UID 0 access and is a member of the wheel group (or the group of the group option), deny access. Conversely, if the user is not in the group, return PAM_IGNORE (unless trust was also specified, in which case we return PAM_SUCCESS).

group=name

Instead of checking the wheel or GID 0 groups, use the name group to perform the authentication.

root_only

The check for wheel membership is done only when the target user UID is 0.

trust

The pam_wheel module will return PAM_SUCCESS instead of PAM_IGNORE if the user is a member of the wheel group (thus with a little play stacking the modules the wheel members may be able to su to root without being prompted for a passwd).

use_uid

The check for wheel membership will be done against the current uid; this version of pam_wheel can only work in this way and ignores the use_uid argument.

## MODULE TYPES PROVIDED
The auth and account module types are provided.

## RETURN VALUES
PAM_AUTH_ERR

Authentication failure.

PAM_BUF_ERR

Memory buffer error.

PAM_IGNORE

The return value should be ignored by PAM dispatch.

PAM_PERM_DENY

Permission denied.

PAM_SERVICE_ERR

Cannot determine the user name.

PAM_SUCCESS

Success.

PAM_USER_UNKNOWN

User not known.

## EXAMPLES
The root account gains access by default (rootok), only wheel members can become root (wheel) but Unix authenticate non-root applicants.

```
su      auth     sufficient     pam_rootok.so
su      auth     required       pam_wheel.so
su      auth     required       pam_unix.so

```

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_wheel was written by Cristian Gafton <gafton@redhat.com>.


title: pam_xauth(8)

text:
# pam_xauth(8)

## NAME
pam_xauth - PAM module to forward xauth keys between users

## SYNOPSIS
pam_xauth.so [debug] [xauthpath=/path/to/xauth] [systemuser=UID] [targetuser=UID]

## DESCRIPTION
The pam_xauth PAM module is designed to forward xauth keys (sometimes referred to as "cookies") between users.

Without pam_xauth, when xauth is enabled and a user uses the su(1) command to assume another user's privileges, that user is no longer able to access the original user's X display because the new user does not have the key needed to access the display. pam_xauth solves the problem by forwarding the key from the user running su (the source user) to the user whose identity the source user is assuming (the target user) when the session is created, and destroying the key when the session is torn down.

This means, for example, that when you run su(1) from an xterm session, you will be able to run X programs without explicitly dealing with the xauth(1) xauth command or ~/.Xauthority files.

pam_xauth will only forward keys if xauth can list a key connected to the $DISPLAY environment variable.

Primitive access control is provided by ~/.xauth/export in the invoking user's home directory and ~/.xauth/import in the target user's home directory.

If a user has a ~/.xauth/import file, the user will only receive cookies from users listed in the file. If there is no ~/.xauth/import file, the user will accept cookies from any other user.

If a user has a .xauth/export file, the user will only forward cookies to users listed in the file. If there is no ~/.xauth/export file, and the invoking user is not root, the user will forward cookies to any other user. If there is no ~/.xauth/export file, and the invoking user is root, the user will not forward cookies to other users.

Both the import and export files support wildcards (such as *). Both the import and export files can be empty, signifying that no users are allowed.

## OPTIONS
debug

Print debug information.

xauthpath=/path/to/xauth

Specify the path the xauth program (it is expected in /usr/X11R6/bin/xauth, /usr/bin/xauth, or /usr/bin/X11/xauth by default).

systemuser=UID

Specify the highest UID which will be assumed to belong to a "system" user. pam_xauth will refuse to forward credentials to users with UID less than or equal to this number, except for root and the "targetuser", if specified.

targetuser=UID

Specify a single target UID which is exempt from the systemuser check.

## MODULE TYPES PROVIDED
Only the session type is provided.

## RETURN VALUES
PAM_BUF_ERR

Memory buffer error.

PAM_PERM_DENIED

Permission denied by import/export file.

PAM_SESSION_ERR

Cannot determine user name, UID or access users home directory.

PAM_SUCCESS

Success.

PAM_USER_UNKNOWN

User not known.

## EXAMPLES
Add the following line to /etc/pam.d/su to forward xauth keys between users when calling su:

```
session  optional  pam_xauth.so

```

## IMPLEMENTATION DETAILS
pam_xauth will work only if it is used from a setuid application in which the getuid() call returns the id of the user running the application, and for which PAM can supply the name of the account that the user is attempting to assume. The typical application of this type is su(1). The application must call both pam_open_session() and pam_close_session() with the ruid set to the uid of the calling user and the euid set to root, and must have provided as the PAM_USER item the name of the target user.

pam_xauth calls xauth(1) as the source user to extract the key for $DISPLAY, then calls xauth as the target user to merge the key into the a temporary database and later remove the database.

pam_xauth cannot be told to not remove the keys when the session is closed.

## FILES
~/.xauth/import

XXX

~/.xauth/export

XXX

## SEE ALSO
pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_xauth was written by Nalin Dahyabhai <nalin@redhat.com>, based on original version by Michael K. Johnson <johnsonm@redhat.com>.


title: pwhistory_helper(8)

text:
# pwhistory_helper(8)

## NAME
pwhistory_helper - Helper binary that transfers password hashes from passwd or shadow to opasswd

## SYNOPSIS
pwhistory_helper [...]

## DESCRIPTION
pwhistory_helper is a helper program for the pam_pwhistory module that transfers password hashes from passwd or shadow file to the opasswd file and checks a password supplied by user against the existing hashes in the opasswd file.

The purpose of the helper is to enable tighter confinement of login and password changing services. The helper is thus called only when SELinux is enabled on the system.

The interface of the helper - command line options, and input/output data format are internal to the pam_pwhistory module and it should not be called directly from applications.

## SEE ALSO
pam_pwhistory(8)

## AUTHOR
Written by Tomas Mraz based on the code originally in pam_pwhistory and pam_unix modules.


title: pam_cgfs(8)

text:
# pam_cgfs(8)

## NAME
pam_cgfs - cgroup management for unprivileged LXC containers.

## SYNOPSIS

pam_cgfs.so

{-c kernel_controller,name=named_controller}

## DESCRIPTION
LXC has supported fully unprivileged containers since LXC 1.0. Fully unprivileged containers are the safest containers and are run by normal (non-root) users. This is achieved by using user namespaces by mapping between a range of UIDs and GIDs on the host to a different (unprivileged) range of UIDs and GIDs in the container. That means the uid 0 (root) in the container is mapped to an unprivileged user id (something like 1000000) outside of the container and only has rights on resources that it owns itself.

Cgroup management of fully unprivileged containers means restricting the resources used by these containers like limiting the CPU usage of a container, or the number of processes it is allowed to spawn, or the memory it is allowed to consume. It is clear that the fully unprivileged containers are run by normal users and there is a need to limit and manage resource consumption among the containers. But unprivileged cgroup management is not easy with most init systems. So, the pam_cgfs.so came into existence.

The pam_cgfs.so module can handle pure cgroupfs v1 (/sys/fs/cgroup/$controller) and mixed mounts, where some controllers are mounted in a standard cgroupfs v1 hierarchy (/sys/fs/cgroup/$controller) and others in cgroupfs v2 hierarchy (/sys/fs/cgroup/unified). Writeable cgroups are either created for all controllers or, if specified, for only controllers listed as arguments on the command line. Pure cgroup v2 mount is not covered by the pam_cgfs.so module.

The cgroup created user/$user/n will be for the nth session under cgroup kernel controller hierarchy.

Systems with a systemd init system are treated specifically, both with respect to cgroupfs v1 and cgroupfs v2. For both, cgroupfs v1 and cgroupfs v2, the module checks whether systemd already placed the user in a cgroup it created user.slice/user-$uid/session-n.scope by checking whether $uid == login uid. If so, the login user chown the session-n.scope, else a cgroup is created as outlined above (user/$user/n) and chown it to login uid. If the init system has already placed the login user inside a session specific group, the pam_cgfs.so module is smart enough to detect it and re-use the cgroup.

In essence, the pam_cgfs.so module takes care of placing unprivileged (non-root) users into writable cgroups at login and also cleaning up these cgroup hierarchies on logout, so they are free to delegate resources to containers as needed that have been provided to them.

## OPTIONS
-c controller-list

Takes a string argument which sets the list of kernel controllers and named controllers delimited by commas in-between “,”. Named controllers need to be specified in the form “name=$namedcontroller”. Can use “all” enable all cgroup resource controller hierarchies. Specifying “all” and other controllers explicitly returns PAM_SESSION_ERR.

## MODULE TYPES PROVIDED
Only session module type is provided (and needed).

## RETURN VALUES
PAM_SUCCESS

Writeable cgroups have been created for the user.

PAM_SESSION_ERR

Failed to create writable cgroups for the user.

## FILES
/etc/pam.d/common-session{,-noninteractive}

Default configuration is added at the end of these files.

## EXAMPLE

```
session optional	pam_cgfs.so -c freezer,memory,named=systemd
# default configuration
# user writable cgroups are created under freezer, memory and named cgroup systemd hierarchies.
# /sys/fs/cgroup/$controller/user/$user/n for freezer,memory.
# /sys/fs/cgroup/systemd/user.slice/user-$uid/session-n.scope for systemd.
session optional	pam_cgfs.so -c all
# user writable cgroups are created under all cgroup controllers.
session optional	pam_cgfs.so -c all,memory,freezer
# invalid argument and returns PAM_SESSION_ERR

```

## SEE ALSO
lxc-cgroup(1), cgroups(7), user_namespaces(7), namespaces(7), pam(8)


title: pam_console(8)

text:
# pam_console(8)

## NAME
pam_console - determine user owning the system console

## SYNOPSIS
session optional pam_console.so

auth required pam_console.so

## DESCRIPTION
pam_console.so is designed to give users at the physical console (virtual terminals and local xdm-managed X sessions by default, but that is configurable) capabilities that they would not otherwise have, and to take those capabilities away when the are no longer logged in at the console. It provides two main kinds of capabilities: file permissions and authentication.

When a user logs in at the console and no other user is currently logged in at the console, pam_console.so will run handler programs specified in the file /etc/security/console.handlers such as pam_console_apply which changes permissions and ownership of files as described in the file /etc/security/console.perms. That user may then log in on other terminals that are considered part of the console, and as long as the user is still logged in at any one of those terminals, that user will own those devices. When the user logs out of the last terminal, the console may be taken by the next user to log in. Other users who have logged in at the console during the time that the first user was logged in will not be given ownership of the devices unless they log in on one of the terminals; having done so on any one terminal, the next user will own those devices until he or she has logged out of every terminal that is part of the physical console. Then the race can start for the next user. In practice, this is not a problem; the physical console is not generally in use by many people at the same time, and pam_console.so just tries to do the right thing in weird cases.

When an application attempts to authenticate the user and this user is already logged in at the console, pam_console.so checks whether there is a file in /etc/security/console.apps/ directory with the same name as the application servicename, and if such a file exists, authentication succeeds. This way pam_console may be utilized to run some system applications (reboots, config tools) without root password, or to enter user password on the first system login only.

## ARGUMENTS
debug

turns on debugging

allow_nonroot_tty

gain console locks and change permissions even if the TTY's owner is not root.

handlersfile=filename

tells pam_console.so to get the list of the handlers from a different file than /etc/security/console.handlers

## EXAMPLE
/etc/pam.d/some-system-tool:

auth sufficient pam_rootok.so

auth required pam_console.so

/etc/pam.d/some-login-service:

auth sufficient pam_console.so

auth required pam_unix.so

session required pam_unix.so

session optional pam_console.so

## FILES
/var/run/console/

/var/run/console/console.lock

/etc/security/console.apps

/etc/security/console.handlers

## SECURITY NOTES
When pam_console "auth" is used for login services which provide possibility of remote login, it is necessary to make sure the application correctly sets PAM_RHOST variable, or to deny remote logins completely. Currently, /bin/login (invoked from telnetd) and gdm is OK, others may be not.

## SEE ALSO
console.perms(5)

console.apps(5)

console.handlers(5)

pam_console_apply(8)

/usr/share/doc/pam*/html/index.html

## BUGS
Let's hope not, but if you find any, please report them via the "Bug Track" link at http://bugzilla.redhat.com/bugzilla/

## AUTHORS
Michael K. Johnson <johnsonm@redhat.com>

Support of console.handlers and other improvements by Tomas Mraz <tmraz@redhat.com>


title: pam_console_apply(8)

text:
# pam_console_apply(8)

## NAME
pam_console_apply - set or revoke permissions for users at the system console

## SYNOPSIS
pam_console_apply [-f <fstab file>] [-c <console.perms file>] [-r] [-t <tty>] [-s] [-d] [<device file> ...]

## DESCRIPTION
pam_console_apply is a helper executable which sets or resets permissions on device nodes.

If /var/run/console.lock exists, pam_console_apply will grant permissions to the user listed therein. If the lock file does not exist, permissions are reset according to defaults set in console.perms files, normally configured to set permissions on devices so that root owns them.

When initializing its configuration it first parses the /etc/security/console.perms file and then it searches for files ending with the .perms suffix in the /etc/security/console.perms.d directory. These files are parsed in the lexical order in "C" locale. Permission rules are appended to a global list, console and device class definitions override previous definitions of the same class.

## ARGUMENTS
-c

Load other console.perms file than the default one.

-f

Load other fstab file than the default one (/etc/fstab).

-r

Signals pam_console_apply to reset permissions. The default is to set permissions so that the user listed in /var/run/console.lock has access to the devices, and to reset permissions if no such file exists.

-t

Use <tty> to match console class in console.perms file. The default is tty0.

-s

Write error messages to the system log instead of stderr.

-d

Log/display messages useful for debugging.

The optional <device file> arguments constrain what files should be affected by pam_console_apply. If they aren't specified permissions are changed on all files specified in the console.perms file.

## FILES
/var/run/console.lock

/etc/security/console.perms

/etc/security/console.perms.d/50-default.perms

## SEE ALSO
pam_console(8)

console.perms(5)

## BUGS
Let's hope not, but if you find any, please report them via the "Bug Track" link at http://bugzilla.redhat.com/bugzilla/

## AUTHORS
Nalin Dahyabhai <nalin@redhat.com>, using code shamelessly stolen from parts of pam_console.

Support of console.perms.d and other improvements by Tomas Mraz <tmraz@redhat.com>.


title: pam_mkuser(8)

summary: PAM module to create users accounts

text:
# pam_mkuser(8)

## NAME
pam_mkuser - PAM module to create users accounts

## SYNOPSIS
pam_mkuser.so [silent] [shell=/bin/sh]

## DESCRIPTION
The pam_mkuser PAM module will create a user account if it does not exist when the session begins. This allows to log in absolutely new users.

The user account will not be removed after logout.

## OPTIONS
silent

Don't print informative messages.

shell=/path/to/shell

Indicate an alternative shell binary to override the default /bin/sh.

## MODULE TYPES PROVIDED
Only the session module type is provided.

## RETURN VALUES
PAM_BUF_ERR

Memory buffer error.

PAM_CRED_INSUFFICIENT

Unable to get the user name from the PAM stack.

PAM_PERM_DENIED

Not enough permissions to create the new account.

PAM_SUCCESS

Environment variables were set.

## FILES
/bin/sh

Default shell binary

## EXAMPLES
A sample /etc/pam.d/login file:

```
  auth       requisite   pam_securetty.so

  auth       sufficient  pam_ldap.so

  auth       required    pam_unix.so

  auth       required    pam_nologin.so

  account    optional    pam_mkuser.so shell=/bin/bash

  account    sufficient  pam_ldap.so

  account    required    pam_unix.so

  password   required    pam_unix.so

  session    required    pam_mkhomedir.so skel=/etc/skel/ umask=0077

  session    required    pam_unix.so

  session    optional    pam_lastlog.so

  session    optional    pam_mail.so standard

```

## SEE ALSO
pam_mkhomedir(8), pam.d(5), pam(8).

## AUTHOR
pam_mkuser is written by Paul Wolneykien <manowar@altlinux.org>.


title: pam_passwdqc(8)

summary: Password quality-control PAM module

text:
# pam_passwdqc(8)

## NAME
pam_passwdqc — Password quality-control PAM module

## SYNOPSIS
[service-name] module-type control-flag pam_passwdqc [options]

## DESCRIPTION
The pam_passwdqc module is a simple password strength checking module for PAM. In addition to checking regular passwords, it offers support for passphrases and can provide randomly generated ones.

The pam_passwdqc module provides functionality for only one PAM management group: password changing. In terms of the module-type parameter, this is the “password” feature.

The pam_chauthtok() service function may ask the user for a new password, and verify that it meets certain minimum standards. If the chosen password is unsatisfactory, the service function returns PAM_AUTHTOK_ERR.

The set of options that may be passed to the module is exactly the same as the set of options that may be specified in the configuration file (suggested location /etc/passwdqc.conf, to be specified in the config=/etc/passwdqc.conf option). These options are described in passwdqc.conf(5).

## SEE ALSO
pam.conf(5), passwdqc.conf(5), pam(8).

https://www.openwall.com/passwdqc/

## AUTHORS
The pam_passwdqc module was written for Openwall GNU/*/Linux by Solar Designer ⟨solar at openwall.com⟩. This manual page was written for the FreeBSD Project by ThinkSec AS and NAI Labs, the Security Research Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program. It has since been revised, most importantly to refer to passwdqc.conf(5) instead of describing the options right on this page.


title: pam_tcb(8)

text:
# pam_tcb(8)

## NAME
pam_tcb - authentication, account, session, and password management PAM module for Unix with support for the tcb password shadowing scheme

## DESCRIPTION
pam_tcb is a PAM module which deals with Unix accounts and provides functionality for all four PAM management groups: authentication, account management, session management, and password management. It is a successor to pam_unix and pam_pwdb.

authentication

pam_tcb relies exclusively on getpwnam(3) and getspnam(3) interfaces to obtain information necessary for user authentication. It performs password hashing with crypt_ra(3) or crypt(3). This means that pam_tcb will use NSS and will handle any password hashing method supported by the system libraries.

account management

When the account information is available via getspnam(3), the account management part of pam_tcb checks for expired accounts or passwords. It uses the shadow file entry fields as described in shadow(5). It is responsibility of applications to interpret the PAM error status and possibly invoke the password management group to get an expired password changed.

session management

By default, pam_tcb logs the opening and closing of PAM sessions via syslog(3). It uses LOG_AUTH as the syslog facility and either adds "pam_tcb: " prefix to log messages or, if the openlog option is given, sets the ident to "pam_tcb". This functionality may be disabled with the nolog option (see below).

password management

pam_chauthtok(3) performs two passes through the password management stack: PAM_PRELIM_CHECK and PAM_UPDATE_AUTHTOK. During the PAM_PRELIM_CHECK phase, pam_tcb may optionally prompt for and will always verify the old password. This allows for stacking of a password policy enforcement module such as pam_passwdqc before pam_tcb, without requiring this other module to take over performing any of the tasks of pam_tcb. The actual password change happens during the PAM_UPDATE_AUTHTOK phase. When changing passwords, pam_tcb is able to modify the following password databases:

/etc/passwd file, see passwd(5);

/etc/shadow file, see shadow(5);

/etc/tcb/ directory structure, see tcb(5).

## OPTIONS
Most of the options recognized by pam_unix or pam_pwdb are valid for pam_tcb as well and have identical meaning. There are some semantic differences though, so you are advised to browse the list below. All the boolean options are off by default. The default values of non-boolean options are given.

debug

Log debugging information via syslog(3).

audit

Log even more debugging information, including unknown usernames. This has the risk of potentially logging a password that a user could have given instead of a username.

openlog

Normally, pam_tcb will add "pam_tcb: " prefix to log messages. The openlog option disables this behavior and causes pam_tcb to call openlog(3) with ident "pam_tcb" before logging and closelog(3) afterwards.

noopenlog

If pam_tcb was compiled with ENABLE_OPENLOG, it will call openlog(3) with ident "pam_tcb" before logging and closelog(3) afterwards. The noopenlog option disables this behavior.

nolog

Suppress logging.

blank_nolog

Do not log failed authentication attempts when a blank password is tried. If this option is not used, some services, notably sshd(8), may generate false alarms.

nullok

Permit blank passwords.

use_first_pass

Don't prompt the user for passwords, take them from PAM_AUTHTOK and possibly PAM_OLDAUTHTOK items instead.

try_first_pass

Take passwords from PAM_AUTHTOK and possibly PAM_OLDAUTHTOK items, but prompt the user if the appropriate PAM item is unset.

use_authtok

Like use_first_pass, but applies to the (new) PAM_AUTHTOK only. This is intended for stacking password management modules.

authtok_type=

This option can be used to modify the password prompt when changing passwords to include the type of the password. The default is empty.

likeauth

When called as a credential setting module, return the same value as was returned during the authentication.

passwd

If set, pam_tcb may use the second field of user's "passwd" entry (usually taken from /etc/passwd) as the password hash. See below for details.

shadow

If set, pam_tcb may use the second field of user's "shadow" entry (usually taken from /etc/shadow or a tcb shadow file) as the password hash. See below for details.

write_to=

This option determines where pam_tcb should store new password hashes when changing passwords. Possible settings are: "passwd", "shadow", and "tcb". The default is "shadow".

md5

When updating a user's password, hash the new password with the obsolete FreeBSD-derived MD5-based algorithm.

prefix=

When updating a user's password, generate the salt with the specified prefix (which determines the hashing method to use). Unless the underlying libcrypt library implements a default hashing method, the default is "$2b$", which requests bcrypt, a Blowfish-based hashing method, which supports variable iteration counts.

count=

The number of iterations of an underlying cryptographic primitive to use when hashing passwords. The default is 0, which lets the selected hashing algorithm pick its default iteration count. It is highly recommended that you override this setting. Please refer to crypt(3) for information on supported hashing methods, their prefix strings, and their count settings.

plain_crypt

Use plain crypt(3) instead of crypt_ra(3). This may be required to access hashing methods for which no reentrant implementation exists in the system libraries.

nodelay

Do not delay after an unsuccessful authentication attempt.

fork

Create child processes for accessing shadow files. Using this option one can be sure that after a call to pam_end(3) there is no sensitive data left in the process' address space. However, this option may confuse some of the more complicated applications and it has some performance overhead.

helper=

If the hashed password cannot be retrieved by pam_tcb and the UID of the user being authenticated is equal to the real UID pam_tcb runs as, pam_tcb will execute a privileged helper program to perform authentication. This option determines path to the program's binary. If an empty helper path is given, no helper will be executed. The default is /usr/lib/chkpwd/tcb_chkpwd.

## OBTAINING PASSWORD HASHES
The following algorithm is used by pam_tcb to retrieve the password hash for a user:

if (passwd option is set and pw_passwd field is not equal to "x" nor "*NP*")

use pw_passwd field as the hash;

if (shadow option is set and pw_passwd field is equal to "x")

use sp_pwdp field as the hash;

if all the above failed, fail.

## BUGS
The current pam_tcb implementation is not thread-safe (just like pam_unix and pam_pwdb).

## SEE ALSO
crypt(3), crypt_ra(3), getpwnam(3), getspnam(3), shadow(3), login.defs(5), passwd(5), shadow(5), tcb(5), pam(8), tcb_convert(8)


title: pam_timestamp(8)

text:
# pam_timestamp(8)

## NAME
pam_timestamp - Authenticate using cached successful authentication attempts

## SYNOPSIS
pam_timestamp.so [timestampdir=directory] [timestamp_timeout=number] [verbose] [debug]

## DESCRIPTION
In a nutshell, pam_timestamp caches successful authentication attempts, and allows you to use a recent successful attempt as the basis for authentication. This is similar mechanism which is used in sudo.

When an application opens a session using pam_timestamp, a timestamp file is created in the timestampdir directory for the user. When an application attempts to authenticate the user, a pam_timestamp will treat a sufficiently recent timestamp file as grounds for succeeding.

## OPTIONS
timestampdir=directory

Specify an alternate directory where pam_timestamp creates timestamp files.

timestamp_timeout=number

How long should pam_timestamp treat timestamp as valid after their last modification date (in seconds). Default is 300 seconds.

verbose

Attempt to inform the user when access is granted.

debug

Turns on debugging messages sent to syslog(3).

## MODULE TYPES PROVIDED
The auth and session module types are provided.

## RETURN VALUES
PAM_AUTH_ERR

The module was not able to retrieve the user name or no valid timestamp file was found.

PAM_SUCCESS

Everything was successful.

PAM_SESSION_ERR

Timestamp file could not be created or updated.

## NOTES
Users can get confused when they are not always asked for passwords when running a given program. Some users reflexively begin typing information before noticing that it is not being asked for.

## EXAMPLES

```
auth sufficient pam_timestamp.so verbose
auth required   pam_unix.so
session required pam_unix.so
session optional pam_timestamp.so

```

## FILES
/var/run/pam_timestamp/...

timestamp files and directories

## SEE ALSO
pam_timestamp_check(8), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_timestamp was written by Nalin Dahyabhai.


title: pam_timestamp_check(8)

text:
# pam_timestamp_check(8)

## NAME
pam_timestamp_check - Check to see if the default timestamp is valid

## SYNOPSIS
pam_timestamp_check [-k] [-d] [target_user]

## DESCRIPTION
With no arguments pam_timestamp_check will check to see if the default timestamp is valid, or optionally remove it.

## OPTIONS
-k

Instead of checking the validity of a timestamp, remove it. This is analogous to sudo's -k option.

-d

Instead of returning validity using an exit status, loop indefinitely, polling regularly and printing the status on standard output.

target_user

By default pam_timestamp_check checks or removes timestamps generated by pam_timestamp when users authenticate as themselves. When the user authenticates as a different user, the name of the timestamp file changes to accommodate this. target_user allows one to specify this user name.

## RETURN VALUES
0

The timestamp is valid.

2

The binary is not setuid root.

3

Invalid invocation.

4

User is unknown.

5

Permissions error.

6

Invalid controlling tty.

7

Timestamp is not valid.

## NOTES
Users can get confused when they are not always asked for passwords when running a given program. Some users reflexively begin typing information before noticing that it is not being asked for.

## EXAMPLES

```
auth sufficient pam_timestamp.so verbose
auth required   pam_unix.so
session required pam_unix.so
session optional pam_timestamp.so

```

## FILES
/var/run/sudo/...

timestamp files and directories

## SEE ALSO
pam_timestamp_check(8), pam.conf(5), pam.d(5), pam(8)

## AUTHOR
pam_timestamp was written by Nalin Dahyabhai.


title: pam_alreadyloggedin(8)

summary: Already-logged-in PAM module

text:
# pam_alreadyloggedin(8)

## NAME
pam_alreadyloggedin — Already-logged-in PAM module

## SYNOPSIS
[service-name] module-type control-flag pam_alreadyloggedin [options]

## DESCRIPTION
The Already-logged-in authentication service module for PAM, pam_alreadyloggedin provides functionality for only one PAM category: authentication. In terms of the module-type parameter, this is the “auth” feature. It also provides null functions for other PAM categories.

### Already-logged-in Authentication Module
The Already-logged-in authentication component (pam_sm_authenticate()), returns success if and only if the target user's ID is identical to a current login specified in the utmp(5) database and verified with matching permissions on that login's respective terminal in /dev. If a user shows up in w(8) output, they will generally be allowed to authenticate using this method.

The following options may be passed to the authentication module:

debug

Enable verbose output to syslog at LOG_DEBUG level.

no_debug

Disable verbose output to syslog even it's enabled at compile time.

no_root

Never allow login with a target user ID of zero.

restrict_tty=ttyglob*

Only allow login if the terminal device currently being authenticated on matches ttyglob*. The ttyglob* argument is specified as a shell glob, and checked using the fnmatch(3) function. For example, restryct_tty=/dev/tty[1-6] allows logging from text consoles of physical terminal only.

restrict_loggedin_tty=ttyfoo*

Disallow recognition that the user is already logged in unless the terminal device logged in upon matches ttyglob*.

## EXAMPLE
Modify auth section of the /etc/pam.d/login file like following:

```
auth required   /lib/security/pam_securetty.so
auth sufficient /lib/security/pam_alreadyloggedin.so no_root
auth required   /lib/security/pam_stack.so service=system-auth
```

## BUGS
FreeBSD version expects /dev/ prefix in restryct_tty value, but value of restryct_loggedin_tty should be without them. Linux version expects /dev/ in both cases.

## SEE ALSO
fnmatch(3), getuid(2), stat(2), utmp(5), w(8), pam.conf(5), pam(8)

## AUTHORS
Adopted for Linux PAM by Ilya Evseev at Jan 2004.

The original pam_alreadyloggedin module and this manual page were developed for the FreeBSD Project by NAI Labs and ThinkSec AS, the Security Research Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.


title: pam_cifscreds(8)

text:
# pam_cifscreds(8)

## NAME
pam_cifscreds - PAM module to manage NTLM credentials in kernel keyring

## SYNOPSIS
Edit the PAM configuration files for the systems that you want to automatically register NTLM credentials for, e.g. /etc/pam.d/login, and modify as follows:

```
    ...

    auth       substack     system-auth
+++ auth       optional     pam_cifscreds.so

    auth       include      postlogin

    ...

    ...

    session    include      system-auth
+++ session    optional     pam_cifscreds.so domain=DOMAIN

    session    include      postlogin

    ...
```

Change DOMAIN to the name of you Windows domain, or use host= as described below.

## DESCRIPTION
The pam_cifscreds PAM module is a tool for automatically adding credentials (username and password) for the purpose of establishing sessions in multiuser mounts.

When a cifs filesystem is mounted with the "multiuser" option, and does not use krb5 authentication, it needs to be able to get the credentials for each user from somewhere. The pam_cifscreds module can be used to provide these credentials to the kernel automatically at login.

In the session section of the PAM configuration file, the module can either an NT domain name or a list of hostname or addresses.

## OPTIONS
pam_cifscreds supports a couple options which can be set in the PAM configuration files. You must have one (and only one) of domain= or host=.

debug

Turns on some extra debug logging.

domain=<NT domain name>

Credentials will be added for the specified NT domain name.

host=<hostname or IP address>[,...]

Credentials will be added for the specified hostnames or IP addresses.

## NOTES
The pam_cifscreds PAM module requires a kernel built with support for the login key type. That key type was added in v3.3 in mainline Linux kernels.

Since pam_cifscreds adds keys to the session keyring, it is highly recommended that one use pam_keyinit to ensure that a session keyring is established at login time.

## SEE ALSO
cifscreds(1), pam_keyinit(8)

## AUTHOR
The pam_cifscreds PAM module was developed by Orion Poplawski <orion@nwra.com>.


title: pam_fprintd(8)

text:
# pam_fprintd(8)

## NAME
pam_fprintd - PAM module to authenticate against fprintd, the fingerprint daemon

## SYNOPSIS
pam_fprintd.so [debug|debug=[on|off|true|false|1|0]] [max-tries=MAX_TRIES] [timeout=TIMEOUT]

## DESCRIPTION
The pam_fprintd module is used to verify a user's fingerprints against fingerprints enrolled using fprintd, the fingerprint management daemon.

## OPTIONS
debug

debug=[on|off|true|false|1|0]

Whether debug should be turned on or off. Debug messages will be generated using pam_syslog which means that they will be saved in the systemd journal by default.

max-tries=MAX_TRIES

The number of attempts at fingerprint authentication to try before returning an authentication failure. The minimum number of tries is 1 while the default is 3. Use a negative value to set no limit at all, so that the module won't ever error on multiple retries, but in such case it's suggested for the module loader to handle this.

timeout=TIMEOUT

The amount of time before returning an authentication failure. The default timeout is 30 seconds, with 1 second being the minimum. Use a negative value to set no limit at all, so that fingerprint authentication will be always active while this module is loaded.

## LIMITATIONS
The PAM stack is by design a serialised authentication, so it is not possible for pam_fprintd to allow authentication through passwords and fingerprints at the same time.

It is up to the application using the PAM services to implement separate PAM processes and run separate authentication stacks separately. This is the way multiple authentication methods are made available to users of gdm for example.

## AUTHOR
fprintd was written by Bastien Nocera.

## SEE ALSO
fprintd, PAM


mount.crypt

title: mount.crypt(8)

summary: crypt encrypted volume

text:
# mount.crypt(8)

## Name
mount.crypt - mount a dm-crypt encrypted volume

## Syntax
mount.crypt [-nrv] [-o options] device directory

## Options
-o options

Set further mount options. mount.crypt will take out its own options it recognizes and passes any remaining options on to the underlying mount program. See below for possible options.

-n

Do not update /etc/mtab. Note that this makes it impossible to unmount the volume by naming the container - you will have to pass the mountpoint to umount.crypt.

-r

Set up the loop device (if necessary) and crypto device in read-only mode. (The mount itself will necessarily also be read-only.) Note that doing a remount using `mount /mnt -o remount,rw` will not make the mount readwrite. The crypto and loop devices will have to be disassociated first.

-v

Turn on debugging and be a bit more verbose.

## Mount options
allow_discard

Enables discard passthrough support. This option does not cause the filesystem to be mounted with discard enabled, but does allow fstrim to be manually run.

cipher

The cryptsetup cipher used for the encrypted volume. This option is mandatory for PLAIN (non-LUKS) volumes. pmt-ehd(8) defaults to creating volumes with "aes-cbc-essiv:sha256" as a cipher.

crypto_name

Select the name for the crypto device (optional). This option is currently only usable with dm-crypt systems.

fsck

Run fsck on the container before mounting it.

fsk_cipher

The OpenSSL cipher used for the filesystem key. The special keyword "none" can be used to bypass decryption and pass the file contents directly to libcryptsetup.

fsk_hash

The OpenSSL hash used for producing key and IV.

fstype

The exact type of filesystem in the encrypted container. The default is to let the kernel autodetect.

hash

The cryptsetup hash used for the encrypted volume. This defaults to no hashing, because pam_mount assumes EHD volumes with strong and simple fskey generation.

keyfile

The path to the key file. This option is mandatory for "normal" crypto volumes and should not be used for LUKS volumes.

remount

Causes the filesystem to be remounted with new options. Note that mount.crypt cannot switch the underlying loop device (if applies) or the crypto device between read-only and read-write once it is created; only the actual filesystem mount can be changed, with limits. If the loop device is read-only, the crypto device will be read-only, and changing the mount to read-write is impossible. Similarly, going from rw to ro will only mark the mount read-only, but not the crypto or loop device, thus making it impossible to set the filesystem the crypto container is located on to read-only.

ro

Same as the -r option.

verbose

Same as the -v option.

## Obsolete mount options
This section is provided for reference.

loop

This option used to set up a loop device, because cryptsetup(8) expects a block device. The option is ignored because mount.crypt can figure this out on its own.


title: pam_mount(8)

text:
# pam_mount(8)

## Name
pam_mount - A PAM module that can mount volumes for a user session

## Overview
This module is aimed at environments with central file servers that a user wishes to mount on login and unmount on logout, such as (semi-)diskless stations where many users can logon and where statically mounting the entire /home from a server is a security risk, or listing all possible volumes in /etc/fstab is not feasible.

- Users can define their own list of volumes without having to change (possibly non-writable) global config files.

- Single sign-on feature - the user needs to type the password just once (at login)

- Transparent mount process

- No stored passwords

- Volumes are unmounted on logout, freeing system resources and not leaving data exposed.

The module also supports mounting local filesystems of any kind the normal mount utility supports, with extra code to make sure certain volumes are set up properly because often they need more than just a mount call, such as encrypted volumes. This includes SMB/CIFS, FUSE, dm-crypt and LUKS.

If you intend to use pam_mount to protect volumes on your computer using an encrypted filesystem system, please know that there are many other issues you need to consider in order to protect your data. For example, you probably want to disable or encrypt your swap partition (the cryptoswap can help you do this). Do not assume a system is secure without carefully considering potential threats.

## Configuration
The primary configuration file for the pam_mount module is pam_mount.conf.xml. On most platforms this file is read from /etc/security/pam_mount.conf.xml. On OpenBSD pam_mount reads its configuration file from /etc/pam_mount.conf.xml. See pam_mount.conf(5) documenting its use.

Individual users may define additional volumes to mount if allowed by pam_mount.conf.xml (usually ~/.pam_mount.conf.xml). The volume keyword is the only valid keyword in these per-user configuration files. If the luserconf parameter is set in pam_mount.conf.xml, allowing user-defined volume, then users may mount and unmount any volume they own at any mount point they own. On some filesystem configurations this may be a security flaw so user-defined volumes are not allowed by the example pam_mount.conf.xml distributed with pam_mount.

## PAM configuration
In addition, you must include two entries in the system's applicable /etc/pam.d/service config files, as the following example shows:

```
    auth     required  pam_securetty.so

    auth     required  pam_pwdb.so shadow nullok

    auth     required  pam_nologin.so
+++ auth     optional  pam_mount.so

    account  required  pam_pwdb.so

    password required  pam_cracklib.so

    password required  pam_pwdb.so shadow nullok use_authtok

    session  required  pam_pwdb.so

    session  optional  pam_console.so
+++ session  optional  pam_mount.so
```

When "sufficient" is used in the second column, you must make sure that pam_mount is added before this entry. Otherwise pam_mount will not get executed should a previous PAM module succeed. Also be aware of the "include" statements. These make PAM look into the specified file. If there is a "sufficient" statement, then the pam_mount entry must either be in the included file before the "sufficient" statement or before the "include" statement.

If you use pam_ldap, pam_winbind, or any other authentication services that make use of PAM's sufficient keyword, model your configuration on the following order:

```
•••
account sufficient  pam_ldap.so
auth    required    pam_mount.so
auth    sufficient  pam_ldap.so use_first_pass
auth    required    pam_unix.so use_first_pass
session optional    pam_mount.so
•••
```

This allows for:

1.

pam_mount, as the first "auth" module, will prompt for a password and export it to the PAM system.

2.

pam_ldap will use the password from the PAM system to try and authenticate the user. If this succeeds, the user will be authenticated. If it fails, pam_unix will try to authenticate.

3.

pam_unix will try to authenticate the user if pam_ldap failed. If pam_unix fails, then the authentication will be refused (due to the "required").

Alternatively, the following is possible (thanks to Andrew Morgan for the hint!):

```
auth [success=2 default=ignore] pam_unix2.so
auth [success=1 default=ignore] pam_ldap.so use_first_pass
auth requisite pam_deny.so
auth optional pam_mount.so
```

It may seem odd, but the first three lines will make it so that at least one of pam_unix2 or pam_ldap has to succeed. As you can see, pam_mount will be run after successful authentication with these subsystems.

## Encrypted disks
pam_mount supports a few types of crypto. The most common are encfs, dm-crypt and dm-crypt+LUKS.

The first one uses the FUSE layer; files within the encfs container are stored as single encrypted files on the host in a previously-existing directory. If you store lots of files, it is recommended to have a lower filesystem that is strong in this area, such as xfs, but some software and/or your partitioning decisions may force you to use a different fs. The 1:1 mapping of files also allows encrypted files to be reasonably efficiently rsync'ed for example without having to open the encrypted container. Creation is done through the encfs(1) tool.

dm-crypt provides whole-filesystem/entire-partition encryption. You can also create a container file, but the idea is that it is represented as a block device on which you still have to create a filesystem. In fact, this way you can select a filesystem of your choice. The downside is that shrinking is often not possible (there is no such issue in encfs because it uses the lower fs). Suitable dm-crypt containers (and auxiliary files), using block devices or plain files, can be created using the pmt-ehd(8) tool.

pmt-ehd creates filesystem key material which is a bunch of random bytes that will be used to en-/decrypt the volume. This material itself is encrypted with your own password - this is done so that you can change the password without having to reencrypt all of your data.

LUKS is an extension for dm-crypt to support multi-password containers. Unless you specifically need it, the above two solutions are recommended.

NOTE: The key file that pmt-ehd(8) will create represents the filesystem key material as encrypted with your password. It is thus safe to store this on an unsecured filesystem.

## Troubleshooting
To ensure that your system and, possibly, the remote server are all properly configured, you should try to mount all or some of the volumes by hand, using the same commands and mount points provided in pam_mount.conf.xml. This will save you a lot of grief, since it is more difficult to debug the mounting process via pam_mount.

If you can mount the volumes by hand but it is not happening via pam_mount, you may want to enable the "debug" option in pam_mount.conf.xml to see what is happening.

Verify if the user owns the mount point and has sufficient permissions over that. pam_mount will verify this and will refuse to mount the remote volume if the user does not own that directory.

If pam_mount is having trouble unmounting volumes upon logging out, enable the debug variable. This causes pam_mount to run ofl on logout and write its output to the system's log.

## Authors
W. Michael Petullo

Jan Engelhardt (current maintainer)

## Community Support
The following two forms of communication are available. The maintainer has no preference, though you will reach more users who could answer by means of the mailing list.

https://sf.net/projects/pam-mount/support