| Server IP : 103.119.228.120 / Your IP : 3.149.253.73 Web Server : Apache System : Linux v8.techscape8.com 3.10.0-1160.119.1.el7.tuxcare.els2.x86_64 #1 SMP Mon Jul 15 12:09:18 UTC 2024 x86_64 User : nobody ( 99) PHP Version : 5.6.40 Disable Function : shell_exec,symlink,system,exec,proc_get_status,proc_nice,proc_terminate,define_syslog_variables,syslog,openlog,closelog,escapeshellcmd,passthru,ocinum cols,ini_alter,leak,listen,chgrp,apache_note,apache_setenv,debugger_on,debugger_off,ftp_exec,dl,dll,myshellexec,proc_open,socket_bind,proc_close,escapeshellarg,parse_ini_filepopen,fpassthru,exec,passthru,escapeshellarg,escapeshellcmd,proc_close,proc_open,ini_alter,popen,show_source,proc_nice,proc_terminate,proc_get_status,proc_close,pfsockopen,leak,apache_child_terminate,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,dl,symlink,shell_exec,system,dl,passthru,escapeshellarg,escapeshellcmd,myshellexec,c99_buff_prepare,c99_sess_put,fpassthru,getdisfunc,fx29exec,fx29exec2,is_windows,disp_freespace,fx29sh_getupdate,fx29_buff_prepare,fx29_sess_put,fx29shexit,fx29fsearch,fx29ftpbrutecheck,fx29sh_tools,fx29sh_about,milw0rm,imagez,sh_name,myshellexec,checkproxyhost,dosyayicek,c99_buff_prepare,c99_sess_put,c99getsource,c99sh_getupdate,c99fsearch,c99shexit,view_perms,posix_getpwuid,posix_getgrgid,posix_kill,parse_perms,parsesort,view_perms_color,set_encoder_input,ls_setcheckboxall,ls_reverse_all,rsg_read,rsg_glob,selfURL,dispsecinfo,unix2DosTime,addFile,system,get_users,view_size,DirFiles,DirFilesWide,DirPrintHTMLHeaders,GetFilesTotal,GetTitles,GetTimeTotal,GetMatchesCount,GetFileMatchesCount,GetResultFiles,fs_copy_dir,fs_copy_obj,fs_move_dir,fs_move_obj,fs_rmdir,SearchText,getmicrotime MySQL : ON | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /usr/local/ssl/local/ssl/local/ssl/local/ssl/share/doc/pam-1.1.8/txts/ |
Upload File : |
pam_listfile — deny or allow services based on an arbitrary file
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DESCRIPTION
pam_listfile is a PAM module which provides a way to deny or allow services
based on an arbitrary file.
The module gets the item of the type specified -- user specifies the username,
PAM_USER; tty specifies the name of the terminal over which the request has
been made, PAM_TTY; rhost specifies the name of the remote host (if any) from
which the request was made, PAM_RHOST; and ruser specifies the name of the
remote user (if available) who made the request, PAM_RUSER -- and looks for an
instance of that item in the file=filename. filename contains one line per item
listed. If the item is found, then if sense=allow, PAM_SUCCESS is returned,
causing the authorization request to succeed; else if sense=deny, PAM_AUTH_ERR
is returned, causing the authorization request to fail.
If an error is encountered (for instance, if filename does not exist, or a
poorly-constructed argument is encountered), then if onerr=succeed, PAM_SUCCESS
is returned, otherwise if onerr=fail, PAM_AUTH_ERR or PAM_SERVICE_ERR (as
appropriate) will be returned.
An additional argument, apply=, can be used to restrict the application of the
above to a specific user (apply=username) or a given group (apply=@groupname).
This added restriction is only meaningful when used with the tty, rhost and
shell items.
Besides this last one, all arguments should be specified; do not count on any
default behavior.
No credentials are awarded by this module.
OPTIONS
item=[tty|user|rhost|ruser|group|shell]
What is listed in the file and should be checked for.
sense=[allow|deny]
Action to take if found in file, if the item is NOT found in the file, then
the opposite action is requested.
file=/path/filename
File containing one item per line. The file needs to be a plain file and
not world writable.
onerr=[succeed|fail]
What to do if something weird happens like being unable to open the file.
apply=[user|@group]
Restrict the user class for which the restriction apply. Note that with
item=[user|ruser|group] this does not make sense, but for item=[tty|rhost|
shell] it have a meaning.
quiet
Do not treat service refusals or missing list files as errors that need to
be logged.
EXAMPLES
Classic 'ftpusers' authentication can be implemented with this entry in /etc/
pam.d/ftpd:
#
# deny ftp-access to users listed in the /etc/ftpusers file
#
auth required pam_listfile.so \
onerr=succeed item=user sense=deny file=/etc/ftpusers
Note, users listed in /etc/ftpusers file are (counterintuitively) not allowed
access to the ftp service.
To allow login access only for certain users, you can use a /etc/pam.d/login
entry like this:
#
# permit login to users listed in /etc/loginusers
#
auth required pam_listfile.so \
onerr=fail item=user sense=allow file=/etc/loginusers
For this example to work, all users who are allowed to use the login service
should be listed in the file /etc/loginusers. Unless you are explicitly trying
to lock out root, make sure that when you do this, you leave a way for root to
log in, either by listing root in /etc/loginusers, or by listing a user who is
able to su to the root account.
AUTHOR
pam_listfile was written by Michael K. Johnson <johnsonm@redhat.com> and Elliot
Lee <sopwith@cuc.edu>.