Page MenuHomeFreeBSD
Differential D23198 Diff 67499 lib/libpam/modules/pam_login_access/pam_login_access.8

Changeset View

Standalone View

View Options

lib/libpam/modules/pam_login_access/pam_login_access.8

Show All 28 Lines
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE. .\" SUCH DAMAGE.
.\" .\"
.\" $FreeBSD$ .\" $FreeBSD$
.\" .\"
.Dd January 24, 2002 .Dd January 30, 2020
.Dt PAM_LOGIN_ACCESS 8 .Dt PAM_LOGIN_ACCESS 8
.Os .Os
.Sh NAME .Sh NAME
.Nm pam_login_access .Nm pam_login_access
.Nd login.access PAM module .Nd login.access PAM module
.Sh SYNOPSIS .Sh SYNOPSIS
.Op Ar service-name .Op Ar service-name
.Ar module-type .Ar module-type
Show All 12 Lines
parameter, this is the parameter, this is the
.Dq Li account .Dq Li account
feature. feature.
.Ss Login.access Account Management Module .Ss Login.access Account Management Module
The The
.Pa login.access .Pa login.access
account management component account management component
.Pq Fn pam_sm_acct_mgmt , .Pq Fn pam_sm_acct_mgmt ,
returns success if and only the user is allowed to log in on the returns success if and only the user is allowed to login on the
specified tty (in the case of a local login) or from the specified specified tty (in the case of a local login) or from the specified
remote host (in the case of a remote login), according to the remote host (in the case of a remote login), according to the
restrictions listed in restrictions listed in
.Xr login.access 5 . .Xr login.access 5 .
bcrUnsubmitted
Done
Inline Actions

Another line break is needed here after the sentence stop.

bcr: Another line break is needed here after the sentence stop.
.Bl -tag -width ".Cm nodefgroup"
bjkUnsubmitted
Done
Inline Actions

The width is supposed to be of the widest element, which is now IIUC "accessfile=pathname".
It degrades gracefully, though, so most people wouldn't complain.

bjk: The width is supposed to be of the widest element, which is now IIUC "accessfile=pathname". It…
.It Cm accessfile Ns = Ns Ar pathname
bcrUnsubmitted
Done
Inline Actions

Another line break needed here.
s/However/However,/

bcr: Another line break needed here. s/However/However,/
specifies a non-standard location for the
.Pa login.access
configuration file
(normally located in
.Pa /etc/login.access ) .
bjkUnsubmitted
Not Done
Inline Actions

There are Po and Pc macros for open- and close-parenthesis, though style takes no stance on their use versus the literal characters.

bjk: There are Po and Pc macros for open- and close-parenthesis, though style takes no stance on…
cyAuthorUnsubmitted
Done
Inline Actions

There are a number of parentheses in both man pages. If these are to be changed I should have a commit that converts the existing parentheses before this commit. I'm leaning toward not changing them.

cy: There are a number of parentheses in both man pages. If these are to be changed I should have a…
.It Cm nodefgroup
bcrUnsubmitted
Done
Inline Actions

Sentence stop = break the line.

bcr: Sentence stop = break the line.
makes tokens not enclosed in parentheses only match users, requiring groups
bjkUnsubmitted
Done
Inline Actions

I think this could be misinterpreted. Perhaps "makes tokens not enclosed in parentheses only match users, requiring groups to be specified in parentheses. This is not [...], which intermingle user and group names, with user entries taking precedence over group entries." is better, at the risk of being verbose.

bjk: I think this could be misinterpreted. Perhaps "makes tokens not enclosed in parentheses only…
to be specified in parentheses.
Without
.Cm nodefgroup
bcrUnsubmitted
Done
Inline Actions

Line break needed here after the sentence stop.

bcr: Line break needed here after the sentence stop.
user and group names are intermingled, with user entries taking precedence
bcrUnsubmitted
Done
Inline Actions

... and one more time here.

bcr: ... and one more time here.
over group entries.
This is not backwards compatible with legacy
.Pa login.access
bjkUnsubmitted
Done
Inline Actions

I'm not sure what this is doing here.

bjk: I'm not sure what this is doing here.
cyAuthorUnsubmitted
Done
Inline Actions

That was due to a git mismerge. Thanks for catching this. This as originally one large commit but I've separated it out into smaller commits.

cy: That was due to a git mismerge. Thanks for catching this. This as originally one large commit…
configuration files.
However this mitigates confusion between users and
groups of the same name.
.It Cm fieldsep Ns = Ns Ar separators
changes the field separator from the default ":".
More than one separator
may be specified.
.It Cm listsep Ns = Ns Ar separators
changes the field separator from the default space (''), tab (\\t) and
comma (,).
More than one separator may be specified.
For example, listsep=;
will replace the default with a semicolon (;).
This option may be useful when specifying Active Directory groupnames which
typically contain spaces.
.El
.Sh SEE ALSO .Sh SEE ALSO
.Xr pam 3 ,
.Xr syslog 3 ,
.Xr login.access 5 , .Xr login.access 5 ,
.Xr pam.conf 5 , .Xr pam.conf 5
.Xr pam 8
.Sh AUTHORS .Sh AUTHORS
The The
.Xr login.access 5 .Xr login.access 5
access control scheme was designed and implemented by access control scheme was designed and implemented by
.An Wietse Venema . .An Wietse Venema .
.Pp .Pp
The The
.Nm .Nm
module and this manual page were developed for the module and this manual page were developed for the
.Fx .Fx
Project by Project by
ThinkSec AS and NAI Labs, the Security Research Division of Network ThinkSec AS and NAI Labs, the Security Research Division of Network
Associates, Inc.\& under DARPA/SPAWAR contract N66001-01-C-8035 Associates, Inc.\& under DARPA/SPAWAR contract N66001-01-C-8035
.Pq Dq CBOSS , .Pq Dq CBOSS ,
as part of the DARPA CHATS research program. as part of the DARPA CHATS research program.