pam_listfile.so
item=[tty|user|rhost|ruser|group|shell]
sense=[allow|deny]
file=/path/filename
onerr=[succeed|fail]
[
apply=[user|@group]
] [
quiet
]
pam_listfile is a PAM module which provides a way to deny or allow services based on an arbitrary file.
The module gets the item of the type specified --
user specifies the username,
PAM_USER; tty specifies the name of the terminal
over which the request has been made, PAM_TTY;
rhost specifies the name of the remote host (if any) from which the
request was made, PAM_RHOST; and ruser specifies
the name of the remote user (if available) who made the request,
PAM_RUSER -- and looks for an instance of that
item in the file=.
filenamefilename contains one line per item listed. If
the item is found, then if
sense=,
PAM_SUCCESS is returned, causing the authorization
request to succeed; else if
allowsense=,
PAM_AUTH_ERR is returned, causing the authorization
request to fail.
deny
If an error is encountered (for instance, if
filename does not exist, or a poorly-constructed
argument is encountered), then if onerr=succeed,
PAM_SUCCESS is returned, otherwise if
onerr=fail, PAM_AUTH_ERR or
PAM_SERVICE_ERR (as appropriate) will be returned.
An additional argument, apply=, can be used
to restrict the application of the above to a specific user
(apply=)
or a given group
(usernameapply=).
This added restriction is only meaningful when used with the
tty, rhost and
shell items.
@groupname
Besides this last one, all arguments should be specified; do not count on any default behavior.
No credentials are awarded by this module.
-
item=[tty|user|rhost|ruser|group|shell] What is listed in the file and should be checked for.
-
sense=[allow|deny] Action to take if found in file, if the item is NOT found in the file, then the opposite action is requested.
-
file=/path/filename File containing one item per line. The file needs to be a plain file and not world writable.
-
onerr=[succeed|fail] What to do if something weird happens like being unable to open the file.
-
apply=[user|@group] Restrict the user class for which the restriction apply. Note that with
item=[user|ruser|group]this does not make sense, but foritem=[tty|rhost|shell]it have a meaning.-
quiet Do not treat service refusals or missing list files as errors that need to be logged.
- PAM_AUTH_ERR
Authentication failure.
- PAM_BUF_ERR
Memory buffer error.
- PAM_IGNORE
The rule does not apply to the
applyoption.- PAM_SERVICE_ERR
Error in service module.
- PAM_SUCCESS
Success.
Classic 'ftpusers' authentication can be implemented with this entry
in /etc/pam.d/ftpd:
#
# deny ftp-access to users listed in the /etc/ftpusers file
#
auth required pam_listfile.so \
onerr=succeed item=user sense=deny file=/etc/ftpusers
Note, users listed in /etc/ftpusers file are
(counterintuitively) not allowed access to
the ftp service.
To allow login access only for certain users, you can use a
/etc/pam.d/login entry like this:
#
# permit login to users listed in /etc/loginusers
#
auth required pam_listfile.so \
onerr=fail item=user sense=allow file=/etc/loginusers
For this example to work, all users who are allowed to use the
login service should be listed in the file
/etc/loginusers. Unless you are explicitly
trying to lock out root, make sure that when you do this, you leave
a way for root to log in, either by listing root in
/etc/loginusers, or by listing a user who is
able to su to the root account.