pam_listfile.so
item=[tty|user|rhost|ruser|group|shell]
sense=[allow|deny]
file=/path/filename
onerr=[succeed|fail]
[
apply=[user
|@group
]
]
pam_listfile is a PAM module which provides a way to deny or allow services based on an arbitrary file.
The module gets the item
of the type specified --
user specifies the username,
PAM_USER; tty specifies the name of the terminal
over which the request has been made, PAM_TTY;
rhost specifies the name of the remote host (if any) from which the
request was made, PAM_RHOST; and ruser specifies
the name of the remote user (if available) who made the request,
PAM_RUSER -- and looks for an instance of that
item in the file=
.
filename
filename
contains one line per item listed. If
the item is found, then if
sense=
,
PAM_SUCCESS is returned, causing the authorization
request to succeed; else if
allow
sense=
,
PAM_AUTH_ERR is returned, causing the authorization
request to fail.
deny
If an error is encountered (for instance, if
filename
does not exist, or a poorly-constructed
argument is encountered), then if onerr=succeed,
PAM_SUCCESS is returned, otherwise if
onerr=fail, PAM_AUTH_ERR or
PAM_SERVICE_ERR (as appropriate) will be returned.
An additional argument, apply=
, can be used
to restrict the application of the above to a specific user
(apply=
)
or a given group
(username
apply=
).
This added restriction is only meaningful when used with the
tty, rhost and
shell items.
@groupname
Besides this last one, all arguments should be specified; do not count on any default behavior.
No credentials are awarded by this module.
item=[tty|user|rhost|ruser|group|shell]
What is listed in the file and should be checked for.
sense=[allow|deny]
Action to take if found in file, if the item is NOT found in the file, then the opposite action is requested.
file=/path/filename
File containing one item per line. The file needs to be a plain file and not world writeable.
onerr=[succeed|fail]
What to do if something weird happens like being unable to open the file.
apply=[user
|@group
]
Restrict the user class for which the restriction apply. Note that
with item=[user|ruser|group]
this oes not make sense,
but for item=[tty|rhost|shell]
it have a meaning.
Authentication failure.
Memory buffer error.
The rule does not apply to the apply
option.
Error in service module.
Success.
Classic 'ftpusers' authentication can be implemented with this entry
in /etc/pam.d/ftpd
:
# # deny ftp-access to users listed in the /etc/ftpusers file # auth required pam_listfile.so \ onerr=succeed item=user sense=deny file=/etc/ftpusers
To allow login access only for certain users, you can use a
/etc/pam.d/login
entry like this:
# # permit login to users listed in /etc/loginusers # auth required pam_listfile.so \ onerr=fail item=user sense=allow file=/etc/loginusers