e8c4b9d46b
up to par with the Linux pam_access(8). Like the Linux pam_access(8) our pam_login_access(8) is a service module for pam(3) that allows a administrator to limit access from specified remote hosts or terminals. Unlike the Linux pam_access, pam_login_access is missing some features which are added by this commit: Access file can now be specified. The default remains /etc/access.conf. The syntax is consistent with Linux pam_access. By default usernames are matched. If the username fails to match a match against a group name is attempted. The new nodefgroup module option will only match a username and no attempt to match a group name is made. Group names must be specified in brackets, "()" when nodefgroup is specified. Otherwise the old backward compatible behavior is used. This is consistent with Linux pam_access. A new field separator module option allows the replacement of the default colon (:) with any other character. This facilitates potential future specification of X displays. This is also consistent with Linux pam_access. A new list separator module option to replace the default space/comma/tab with another character. This too is consistent with Linux pam_access. Linux pam_access options not implemented in this commit are the debug and audit options. These will be implemented at a later date. Reviewed by: bjk, bcr (for manpages) Approved by: des (blanket, implicit) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D23198
123 lines
4.1 KiB
Groff
123 lines
4.1 KiB
Groff
.\" Copyright (c) 2001 Mark R V Murray
|
|
.\" All rights reserved.
|
|
.\" Copyright (c) 2001 Networks Associates Technology, Inc.
|
|
.\" All rights reserved.
|
|
.\"
|
|
.\" Portions of this software were developed for the FreeBSD Project by
|
|
.\" ThinkSec AS and NAI Labs, the Security Research Division of Network
|
|
.\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
|
|
.\" ("CBOSS"), as part of the DARPA CHATS research program.
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that the following conditions
|
|
.\" are met:
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
.\" 3. The name of the author may not be used to endorse or promote
|
|
.\" products derived from this software without specific prior written
|
|
.\" permission.
|
|
.\"
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
.\" SUCH DAMAGE.
|
|
.\"
|
|
.\" $FreeBSD$
|
|
.\"
|
|
.Dd January 30, 2020
|
|
.Dt PAM_LOGIN_ACCESS 8
|
|
.Os
|
|
.Sh NAME
|
|
.Nm pam_login_access
|
|
.Nd login.access PAM module
|
|
.Sh SYNOPSIS
|
|
.Op Ar service-name
|
|
.Ar module-type
|
|
.Ar control-flag
|
|
.Pa pam_login_access
|
|
.Op Ar options
|
|
.Sh DESCRIPTION
|
|
The
|
|
.Pa login.access
|
|
service module for PAM,
|
|
.Nm
|
|
provides functionality for only one PAM category:
|
|
account management.
|
|
In terms of the
|
|
.Ar module-type
|
|
parameter, this is the
|
|
.Dq Li account
|
|
feature.
|
|
.Ss Login.access Account Management Module
|
|
The
|
|
.Pa login.access
|
|
account management component
|
|
.Pq Fn pam_sm_acct_mgmt ,
|
|
returns success if and only the user is allowed to login on the
|
|
specified tty (in the case of a local login) or from the specified
|
|
remote host (in the case of a remote login), according to the
|
|
restrictions listed in
|
|
.Xr login.access 5 .
|
|
.Bl -tag -width ".Cm accessfile=pathname"
|
|
.It Cm accessfile Ns = Ns Ar pathname
|
|
specifies a non-standard location for the
|
|
.Pa login.access
|
|
configuration file
|
|
(normally located in
|
|
.Pa /etc/login.access ) .
|
|
.It Cm nodefgroup
|
|
makes tokens not enclosed in parentheses only match users, requiring groups
|
|
to be specified in parentheses.
|
|
Without
|
|
.Cm nodefgroup
|
|
user and group names are intermingled, with user entries taking precedence
|
|
over group entries.
|
|
This is not backwards compatible with legacy
|
|
.Pa login.access
|
|
configuration files.
|
|
However this mitigates confusion between users and
|
|
groups of the same name.
|
|
.It Cm fieldsep Ns = Ns Ar separators
|
|
changes the field separator from the default ":".
|
|
More than one separator
|
|
may be specified.
|
|
.It Cm listsep Ns = Ns Ar separators
|
|
changes the field separator from the default space (''), tab (\\t) and
|
|
comma (,).
|
|
More than one separator may be specified.
|
|
For example, listsep=;
|
|
will replace the default with a semicolon (;).
|
|
This option may be useful when specifying Active Directory groupnames which
|
|
typically contain spaces.
|
|
.El
|
|
.Sh SEE ALSO
|
|
.Xr pam 3 ,
|
|
.Xr syslog 3 ,
|
|
.Xr login.access 5 ,
|
|
.Xr pam.conf 5
|
|
.Sh AUTHORS
|
|
The
|
|
.Xr login.access 5
|
|
access control scheme was designed and implemented by
|
|
.An Wietse Venema .
|
|
.Pp
|
|
The
|
|
.Nm
|
|
module and this manual page were developed for the
|
|
.Fx
|
|
Project by
|
|
ThinkSec AS and NAI Labs, the Security Research Division of Network
|
|
Associates, Inc.\& under DARPA/SPAWAR contract N66001-01-C-8035
|
|
.Pq Dq CBOSS ,
|
|
as part of the DARPA CHATS research program.
|