150472Speter# $FreeBSD: releng/10.2/etc/login.access 130151 2004-06-06 11:46:29Z schweikh $ 238738Sbrian# 31519Sguido# Login access control table. 4130151Sschweikh# 51519Sguido# When someone logs in, the table is scanned for the first entry that 61519Sguido# matches the (user, host) combination, or, in case of non-networked 71519Sguido# logins, the first entry that matches the (user, tty) combination. The 8130151Sschweikh# permissions field of that table entry determines whether the login will 91519Sguido# be accepted or refused. 10130151Sschweikh# 111519Sguido# Format of the login access control table is three fields separated by a 121519Sguido# ":" character: 13130151Sschweikh# 141519Sguido# permission : users : origins 15130151Sschweikh# 161519Sguido# The first field should be a "+" (access granted) or "-" (access denied) 171519Sguido# character. The second field should be a list of one or more login names, 181519Sguido# group names, or ALL (always matches). The third field should be a list 191519Sguido# of one or more tty names (for non-networked logins), host names, domain 201519Sguido# names (begin with "."), host addresses, internet network numbers (end 211519Sguido# with "."), ALL (always matches) or LOCAL (matches any string that does 221519Sguido# not contain a "." character). If you run NIS you can use @netgroupname 231519Sguido# in host or user patterns. 241519Sguido# 251519Sguido# The EXCEPT operator makes it possible to write very compact rules. 261519Sguido# 271519Sguido# The group file is searched only when a name does not match that of the 281519Sguido# logged-in user. Only groups are matched in which users are explicitly 291519Sguido# listed: the program does not look at a user's primary group id value. 301519Sguido# 311519Sguido############################################################################## 32130151Sschweikh# 331519Sguido# Disallow console logins to all but a few accounts. 341519Sguido# 351519Sguido#-:ALL EXCEPT wheel shutdown sync:console 361519Sguido# 371519Sguido# Disallow non-local logins to privileged accounts (group wheel). 381519Sguido# 391519Sguido#-:wheel:ALL EXCEPT LOCAL .win.tue.nl 401519Sguido# 411519Sguido# Some accounts are not allowed to login from anywhere: 421519Sguido# 431519Sguido#-:wsbscaro wsbsecr wsbspac wsbsym wscosor wstaiwde:ALL 441519Sguido# 451519Sguido# All other accounts are allowed to login from anywhere. 461519Sguido# 47