206 lines
8.1 KiB
Plaintext
206 lines
8.1 KiB
Plaintext
# Configuration file for Pluggable Authentication Modules (PAM).
|
|
#
|
|
# This file controls the authentication methods that login and other
|
|
# utilities use. See pam(8) for a description of its format.
|
|
#
|
|
# $FreeBSD$
|
|
#
|
|
# service-name module-type control-flag module-path arguments
|
|
#
|
|
# module-type:
|
|
# auth: prompt for a password to authenticate that the user is
|
|
# who they say they are, and set any credentials.
|
|
# account: non-authentication based authorization, based on time,
|
|
# resources, etc.
|
|
# session: housekeeping before and/or after login.
|
|
# password: update authentication tokens.
|
|
#
|
|
# control-flag: How libpam handles success or failure of the module.
|
|
# required: success is required, and on failure all remaining
|
|
# modules are run.
|
|
# requisite: success is required, and on failure no remaining
|
|
# modules are run.
|
|
# sufficient: success is sufficient, and if no previous required
|
|
# module failed, no remaining modules are run.
|
|
# optional: ignored unless the other modules return PAM_IGNORE.
|
|
#
|
|
# arguments:
|
|
# Passed to the module; module-specific plus some generic ones:
|
|
# debug: syslog debug info.
|
|
# no_warn: return no warning messages to the application.
|
|
# Remove this to feed back to the user the
|
|
# reason(s) they are being rejected.
|
|
# use_first_pass: try authentication using password from the
|
|
# preceding auth module.
|
|
# try_first_pass: first try authentication using password from
|
|
# the preceding auth module, and if that fails
|
|
# prompt for a new password.
|
|
# use_mapped_pass: convert cleartext password to a crypto key.
|
|
# expose_account: allow printing more info about the user when
|
|
# prompting.
|
|
#
|
|
# Each final entry must say "required" -- otherwise, things don't
|
|
# work quite right. If you delete a final entry, be sure to change
|
|
# "sufficient" to "required" in the entry before it.
|
|
|
|
login auth required pam_nologin.so no_warn
|
|
#login auth sufficient pam_opie.so no_warn
|
|
#login auth sufficient pam_kerberosIV.so no_warn try_first_pass
|
|
#login auth sufficient pam_krb5.so no_warn try_first_pass
|
|
#login auth required pam_ssh.so no_warn try_first_pass
|
|
login auth required pam_unix.so no_warn try_first_pass
|
|
#login account required pam_kerberosIV.so
|
|
#login account required pam_krb5.so
|
|
login account required pam_unix.so
|
|
#login session required pam_kerberosIV.so
|
|
#login session required pam_krb5.so
|
|
#login session required pam_ssh.so
|
|
login session required pam_unix.so
|
|
#login password sufficient pam_opie.so no_warn
|
|
#login password sufficient pam_kerberosIV.so no_warn try_first_pass
|
|
#login password sufficient pam_krb5.so no_warn try_first_pass
|
|
login password required pam_unix.so no_warn try_first_pass
|
|
|
|
rsh auth required pam_nologin.so no_warn
|
|
rsh auth required pam_deny.so no_warn
|
|
rsh account required pam_unix.so
|
|
rsh session required pam_permit.so
|
|
|
|
# "Standard" su(1) policy.
|
|
su auth sufficient pam_rootok.so no_warn
|
|
su auth requisite pam_wheel.so no_warn auth_as_self noroot_ok
|
|
#su auth sufficient pam_kerberosIV.so no_warn
|
|
#su auth sufficient pam_krb5.so no_warn try_first_pass auth_as_self
|
|
#su auth required pam_opie.so no_warn
|
|
#su auth required pam_ssh.so no_warn try_first_pass
|
|
su auth required pam_unix.so no_warn try_first_pass nullok
|
|
#su account required pam_kerberosIV.so
|
|
#su account required pam_krb5.so
|
|
su account required pam_unix.so
|
|
#su session required pam_kerberosIV.so
|
|
#su session required pam_krb5.so
|
|
#su session required pam_ssh.so
|
|
su session required pam_unix.so
|
|
su password required pam_permit.so
|
|
|
|
# If you want a "WHEELSU"-type su(1), then comment out the
|
|
# above, and uncomment the below "su" entries.
|
|
#su auth sufficient pam_rootok.so no_warn
|
|
##su auth sufficient pam_kerberosIV.so no_warn
|
|
##su auth sufficient pam_krb5.so no_warn
|
|
#su auth required pam_opie.so no_warn auth_as_self
|
|
#su auth required pam_unix.so no_warn try_first_pass auth_as_self
|
|
##su account required pam_kerberosIV.so
|
|
##su account required pam_krb5.so
|
|
#su account required pam_unix.so
|
|
##su session required pam_kerberosIV.so
|
|
##su session required pam_krb5.so
|
|
##su session required pam_ssh.so
|
|
#su session required pam_unix.so
|
|
#su password required pam_permit.so
|
|
|
|
# Native ftpd.
|
|
ftpd auth required pam_nologin.so no_warn
|
|
#ftpd auth sufficient pam_kerberosIV.so no_warn
|
|
#ftpd auth sufficient pam_krb5.so no_warn
|
|
#ftpd auth sufficient pam_ssh.so no_warn try_first_pass
|
|
# Uncomment either pam_opie or pam_unix, but not both of them.
|
|
# pam_unix can't be simple chained with pam_opie, ftpd provides proper fallback
|
|
ftpd auth required pam_opie.so no_warn
|
|
#ftpd auth required pam_unix.so no_warn try_first_pass
|
|
#ftpd account required pam_kerberosIV.so
|
|
#ftpd account required pam_krb5.so
|
|
ftpd account required pam_unix.so
|
|
#ftpd session required pam_kerberosIV.so
|
|
#ftpd session required pam_krb5.so
|
|
#ftpd session required pam_ssh.so
|
|
ftpd session required pam_unix.so
|
|
|
|
# PROftpd.
|
|
ftp auth required pam_nologin.so no_warn
|
|
#ftp auth sufficient pam_kerberosIV.so no_warn
|
|
#ftp auth sufficient pam_krb5.so no_warn
|
|
#ftp auth required pam_opie.so no_warn
|
|
#ftp auth required pam_ssh.so no_warn try_first_pass
|
|
ftp auth required pam_unix.so no_warn try_first_pass
|
|
#ftp account required pam_kerberosIV.so
|
|
#ftp account required pam_krb5.so
|
|
ftp account required pam_unix.so
|
|
#ftp session required pam_kerberosIV.so
|
|
#ftp session required pam_krb5.so
|
|
#ftp session required pam_ssh.so
|
|
ftp session required pam_unix.so
|
|
|
|
# OpenSSH
|
|
sshd auth required pam_nologin.so no_warn
|
|
sshd auth required pam_unix.so no_warn try_first_pass
|
|
sshd account required pam_unix.so
|
|
sshd session required pam_permit.so
|
|
sshd password required pam_permit.so
|
|
# "csshd" is for challenge-based authentication with sshd (TIS auth, etc.)
|
|
csshd auth required pam_opie.so no_warn
|
|
|
|
# SRA telnet. Non-SRA telnet uses 'login'.
|
|
telnetd auth required pam_nologin.so no_warn
|
|
telnetd auth required pam_unix.so no_warn try_first_pass
|
|
telnetd account required pam_unix.so
|
|
|
|
# Don't break startx
|
|
xserver auth required pam_permit.so no_warn
|
|
|
|
# XDM
|
|
xdm auth required pam_nologin.so no_warn
|
|
#xdm auth sufficient pam_kerberosIV.so no_warn try_first_pass
|
|
#xdm auth sufficient pam_krb5.so no_warn try_first_pass
|
|
#xdm auth sufficient pam_ssh.so no_warn try_first_pass
|
|
xdm auth required pam_unix.so no_warn try_first_pass
|
|
#xdm account required pam_kerberosIV.so
|
|
#xdm account required pam_krb5.so
|
|
xdm account required pam_unix.so
|
|
#xdm session required pam_kerberosIV.so
|
|
#xdm session required pam_krb5.so
|
|
#xdm session required pam_ssh.so
|
|
xdm session required pam_unix.so
|
|
xdm password required pam_deny.so
|
|
|
|
# KDE (screensavers etc)
|
|
kde auth required pam_nologin.so no_warn
|
|
#kde auth sufficient pam_opie.so no_warn
|
|
#kde auth sufficient pam_kerberosIV.so no_warn try_first_pass
|
|
#kde auth sufficient pam_krb5.so no_warn try_first_pass
|
|
#kde auth required pam_ssh.so no_warn try_first_pass
|
|
kde auth required pam_unix.so no_warn try_first_pass
|
|
|
|
# GDM (GNOME Display Manager)
|
|
gdm auth required pam_nologin.so no_warn
|
|
#gdm auth sufficient pam_kerberosIV.so no_warn try_first_pass
|
|
#gdm auth sufficient pam_krb5.so no_warn try_first_pass
|
|
#gdm auth sufficient pam_ssh.so no_warn try_first_pass
|
|
gdm auth required pam_unix.so no_warn try_first_pass
|
|
#gdm account required pam_kerberosIV.so
|
|
#gdm account required pam_krb5.so
|
|
gdm account required pam_unix.so
|
|
#gdm session required pam_kerberosIV.so
|
|
#gdm session required pam_krb5.so
|
|
#gdm session required pam_ssh.so
|
|
gdm session required pam_unix.so
|
|
gdm password required pam_deny.so
|
|
|
|
# Mail services
|
|
#imap auth required pam_nologin.so no_warn
|
|
#imap auth required pam_opie.so no_warn
|
|
#imap auth required pam_ssh.so no_warn try_first_pass
|
|
#imap auth required pam_unix.so no_warn try_first_pass
|
|
#pop3 auth required pam_nologin.so no_warn
|
|
#pop3 auth required pam_opie.so no_warn
|
|
#pop3 auth required pam_ssh.so no_warn try_first_pass
|
|
#pop3 auth required pam_unix.so no_warn try_first_pass
|
|
|
|
# If we don't match anything else, default to using OPIE or getpwnam().
|
|
other auth required pam_nologin.so no_warn
|
|
#other auth required pam_opie.so no_warn
|
|
other auth required pam_unix.so no_warn try_first_pass
|
|
other account required pam_unix.so
|
|
other session required pam_unix.so
|
|
other password required pam_deny.so
|