Section 8: administration and privileged commands
pam_sge_authorize – PAM module to control access to SGE hosts Synopsis pam_sge_authorize [options] Description This PAM module limits access via etc. to xxQS_NAMExx hosts only to users who currently have a job running on the host. The expectation is that this limits their impact on any other users of the host. Options execd_spool_dir=dir Specify the…
pam_sge-qrsh-setup – PAM module for tight integration with xxQS_NAMExx Synopsis pam_sge-qrsh-setup Description This PAM module provides tight integration of SSH communication into xxQS_NAMExx when is used with qrsh etc. It may also work with other communication methods that run daemons which use PAM. See It provides to the spawned processes the group id from $SGE_ROOT/default/spool/hostname/active_jobs/job_id/addgrpid…
pam_setquota – PAM module to set or modify disk quotas on session start Synopsis pam_setquota.so [fs=/home] [overwrite=0] [debug=0] [startuid=1000] [enduid=0] [bsoftlimit=19000] [bhardlimit=20000] [isoftlimit=3000] [ihardlimit=4000] Description pam_setquota is a PAM module to set or modify a disk quota at session start This makes quotas usable with central user databases, such as MySQL or LDAP. Options fs=/home…
pam_set_items – A PAM test module to set module-specific PAM items Synopsis pam_set_items.so Description PAM modules store data in PAM items. These items are only accessible from module context, not application context as they might include private data (PAM_AUTHTOK normally contains the password). But when testing PAM modules, it’s often nice to make sure a…
pam_sepermit – PAM module to allow/deny login depending on SELinux enforcement state Synopsis pam_sepermit.so [debug] [conf=/path/to/config/file] Description The pam_sepermit module allows or denies login depending on SELinux enforcement state. When the user which is logging in matches an entry in the config file he is allowed access only when the SELinux is in enforcing mode….
pam_selinux – PAM module to set the default security context Synopsis pam_selinux.so [open] [close] [restore] [nottys] [debug] [verbose] [select_context] [env_params] [use_current_range] Description pam_selinux is a PAM module that sets up the default SELinux security context for the next executed process. When a new session is started, the open_session part of the module computes and sets…
pam_securetty – Limit root login to special devices Synopsis pam_securetty.so [debug] Description pam_securetty is a PAM module that allows root logins only if the user is logging in on a "secure" tty, as defined by the listing in the securetty file. pam_securetty checks at first, if /etc/securetty exists. If not and it was built with…
pam_rootok – Gain only root access Synopsis pam_rootok.so [debug] Description pam_rootok is a PAM module that authenticates the user if their UID is 0. Applications that are created setuid-root generally retain the UID of the user but run with the authority of an enhanced effective-UID. It is the real UID that is checked. Options debug…
pam_rhosts – The rhosts PAM module Synopsis pam_rhosts.so Description This module performs the standard network authentication for services, as used by traditional implementations of rlogin and rsh etc. The authentication mechanism of this module is based on the contents of two files; /etc/hosts.equiv (or and ~/.rhosts. Firstly, hosts listed in the former file are treated…
pam_pwquality – PAM module to perform password quality checking Synopsis pam_pwquality.so […] Description This module can be plugged into the password stack of a given service to provide some plug-in strength-checking for passwords. The code was originally based on pam_cracklib module and the module is backwards compatible with its options. The action of this module…
pam_pwhistory – PAM module to remember last passwords Synopsis pam_pwhistory.so [debug] [use_authtok] [enforce_for_root] [remember=N] [retry=N] [authtok_type=STRING] Description This module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently. This module does not work together with kerberos. In general,…
pam_postgresok – simple check of real UID and corresponding account name Synopsis auth sufficient pam_postgresok.so Description pam_postgresok.so is designed to check that the real UID of the calling process belongs to the "postgres" user and equal to 26 (the value assigned to that user on Red Hat Linux systems). Arguments debug Enable module debugging. The…
pam_pkcs11 – PAM Authentication Module for PKCS#11 token libraries Synopsis pam_pkcs11.so [debug] [configfile=<configfile>] Description This Linux-PAM login module allows a X.509 certificate based user login. The certificate and its dedicated private key are thereby accessed by means of an appropriate PKCS #11 module. For the verification of the users’ certificates, locally stored CA certificates as…
pam_permit – The promiscuous module Synopsis pam_permit.so Description pam_permit is a PAM module that always permit access. It does nothing else. In the case of authentication, the user’s name will be set to nobody if the application didn’t set one. Many applications and PAM modules become confused if this name is unknown. This module is…
pam_passwdqc – Password quality-control PAM module Synopsis [service-name ] module-type control-flag pam_passwdqc [options ] Description The module is a simple password strength checking module for PAM. In addition to checking regular passwords, it offers support for passphrases and can provide randomly generated ones. The module provides functionality for only one PAM management group: password changing….
pam_oddjob_mkhomedir.so – PAM module to create users home directory via oddjob Synopsis session optional /lib/security/pam_oddjob_mkhomedir.so Description The pam_oddjob_mkhomedir.so module checks if the user’s home directory exists, and if it does not, it invokes the mkhomedirfor method of the com.redhat.oddjob_mkhomedir service for the PAM_USER if the module is running with superuser privileges. Otherwise, it invokes the…
pam_nologin – Prevent non-root users from login Synopsis pam_nologin.so [file=/path/nologin] [successok] Description pam_nologin is a PAM module that prevents users from logging into the system when /var/run/nologin or /etc/nologin exists. The contents of the file are displayed to the user. The pam_nologin module has no effect on the root user’s ability to log in. Options…
pam_namespace_helper – Helper binary that creates home directories Synopsis pam_namespace_helper Description pam_namespace_helper is a helper program for the pam_namespace module that sets up a private namespace for a session with polyinstantiated directories. The helper ensures that the namespace mount points exist before they are started to be used for the polyinstantiated directories. Mount points for…
pam_namespace – PAM module for configuring namespace for a session Synopsis pam_namespace.so [debug] [unmnt_remnt] [unmnt_only] [require_selinux] [gen_hash] [ignore_config_error] [ignore_instance_parent_mode] [unmount_on_close] [use_current_context] [use_default_context] [mount_private] Description The pam_namespace PAM module sets up a private namespace for a session with polyinstantiated directories. A polyinstantiated directory provides a different instance of itself based on user name, or when using…
pam_mount – A PAM module that can mount volumes for a user session Overview This module is aimed at environments with central file servers that a user wishes to mount on login and unmount on logout, such as (semi-)diskless stations where many users can logon and where statically mounting the entire /home from a server…