All rights reserved.
Copyright (c) 2001 Networks Associates Technology, Inc.
All rights reserved.
Portions of this software were developed for the FreeBSD Project by
ThinkSec AS and NAI Labs, the Security Research Division of Network
Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
("CBOSS"), as part of the DARPA CHATS research program.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. The name of the author may not be used to endorse or promote
products derived from this software without specific prior written
permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
$FreeBSD: stable/11/lib/libpam/modules/pam_login_access/pam_login_access.8 359117 2020-03-19 03:37:02Z cy $
.Dd January 30, 2020 .Dt PAM_LOGIN_ACCESS 8 .Os .Sh NAME .Nm pam_login_access .Nd login.access PAM module .Sh SYNOPSIS .Op Ar service-name .Ar module-type .Ar control-flag
a pam_login_access .Op Ar options .Sh DESCRIPTION The
a login.access service module for PAM, .Nm provides functionality for only one PAM category: account management. In terms of the .Ar module-type parameter, this is the .Dq Li account feature. .Ss Login.access Account Management Module The
a login.access account management component
q Fn pam_sm_acct_mgmt , returns success if and only the user is allowed to login on the specified tty (in the case of a local login) or from the specified remote host (in the case of a remote login), according to the restrictions listed in .Xr login.access 5 . l -tag -width ".Cm accessfile=pathname" t Cm accessfile Ns = Ns Ar pathname specifies a non-standard location for the
a login.access configuration file (normally located in
a /etc/login.access ) . t Cm nodefgroup makes tokens not enclosed in parentheses only match users, requiring groups to be specified in parentheses. Without .Cm nodefgroup user and group names are intermingled, with user entries taking precedence over group entries. This is not backwards compatible with legacy
a login.access configuration files. However this mitigates confusion between users and groups of the same name. t Cm fieldsep Ns = Ns Ar separators changes the field separator from the default ":". More than one separator may be specified. t Cm listsep Ns = Ns Ar separators changes the field separator from the default space (''), tab (\\t) and comma (,). More than one separator may be specified. For example, listsep=; will replace the default with a semicolon (;). This option may be useful when specifying Active Directory groupnames which typically contain spaces. .El .Sh SEE ALSO .Xr pam 3 , .Xr syslog 3 , .Xr login.access 5 , .Xr pam.conf 5 .Sh AUTHORS The .Xr login.access 5 access control scheme was designed and implemented by .An Wietse Venema .
p The .Nm module and this manual page were developed for the .Fx Project by ThinkSec AS and NAI Labs, the Security Research Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
q Dq CBOSS , as part of the DARPA CHATS research program.