Section 8: administration and privileged commands
pam_motd – Display the motd file Synopsis pam_motd.so [motd=/path/filename] [motd_dir=/path/dirname.d] Description pam_motd is a PAM module that can be used to display arbitrary motd (message of the day) files after a successful login. By default, pam_motd shows files in the following locations: /etc/motd /run/motd /usr/lib/motd /etc/motd.d/ /run/motd.d/ /usr/lib/motd.d/ Each message size is limited to 64KB….
pam_mkhomedir – PAM module to create users home directory Synopsis pam_mkhomedir.so [silent] [debug] [umask=mode] [skel=skeldir] Description The pam_mkhomedir PAM module will create a users home directory if it does not exist when the session begins. This allows users to be present in central database (such as NIS, kerberos or LDAP) without using a distributed file…
pam_matrix – A PAM test module to retrieve module-specific PAM items Synopsis pam_matrix.so […] Description Testing PAM application often requires to set up an authentication backend with as little effort as possible. The pam_matrix module allows to authenticate against a key-value text file, provided by an option or with an environment variable. Important pam_matrix is…
pam_mapi – Module for authentication via MAPI against a Kopano or Zarafa server Synopsis pam_mapi.so [socket=http://localhost:236/kopano] [socket=http://localhost:236/zarafa] [service=pop3|imap|mobile|outlook] [try_first_pass] [use_first_pass] [quiet] [debug] Description The pam_mapi module is used to verify a username/password pair via MAPI in SOAP against a Kopano server of Kopano Core and a Zarafa server of the Zarafa Collaboration Platform, respectively. Options…
pam_mail – Inform about available mail Synopsis pam_mail.so [close] [debug] [dir=maildir] [empty] [hash=count] [noenv] [nopen] [quiet] [standard] Description The pam_mail PAM module provides the "you have new mail" service to the user. It can be plugged into any application that has credential or session hooks. It gives a single message indicating the newness of any…
pam_loginuid – Record user’s login uid to the process attribute Synopsis pam_loginuid.so [require_auditd] Description The pam_loginuid module sets the loginuid process attribute for the process that was authenticated. This is necessary for applications to be correctly audited. This PAM module should only be used for entry point applications like: login, sshd, gdm, vsftpd, crond and…
pam_localuser – require users to be listed in /etc/passwd Synopsis pam_localuser.so [debug] [file=/path/passwd] Description pam_localuser is a PAM module to help implementing site-wide login policies, where they typically include a subset of the network’s users and a few accounts that are local to a particular workstation. Using pam_localuser and pam_wheel or pam_listfile is an effective…
pam_listfile – deny or allow services based on an arbitrary file Synopsis pam_listfile.so item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file=/path/filename onerr=[succeed|fail] [apply=[user|@group]] [quiet] Description pam_listfile is a PAM module which provides a way to deny or allow services based on an arbitrary file. The module gets the item of the type specified — user specifies the username, PAM_USER; tty…
pam_limits – PAM module to limit resources Synopsis pam_limits.so [conf=/path/to/limits.conf] [debug] [set_all] [utmp_early] [noaudit] Description The pam_limits PAM module sets limits on the system resources that can be obtained in a user-session. Users of uid=0 are affected by this limits, too. By default limits are taken from the /etc/security/limits.conf config file. Then individual *.conf files…
pam_ldap – PAM module for LDAP-based authentication Synopsis pam_ldap.so […] Description This is a PAM module that uses an LDAP server to verify user access rights and credentials. Options use_first_pass Specifies that the PAM module should use the first password provided in the authentication stack and not prompt the user for a password. try_first_pass Specifies…
pam_lastlog – PAM module to display date of last login and perform inactive account lock out Synopsis pam_lastlog.so [debug] [silent] [never] [nodate] [nohost] [noterm] [nowtmp] [noupdate] [showfailed] [inactive=<days>] [unlimited] Description pam_lastlog is a PAM module to display a line of information about the last login of the user. In addition, the module maintains the /var/log/lastlog…
/$LIB/security/pam_krb5/pam_krb5_storetmp – Temporary file helper Synopsis pam_krb5_storetmp pattern [uid] [gid] Description The pam_krb5.so module uses pam_krb5_storetmp to create and remove temporary files. It is not intended for any other use. Arguments pattern A filename pattern of the form /tmp/fooXXXXXX. A temporary file will be created using mkstemp(3) and any data provided to standard input will…
//usr/$LIB/security/pam_krb5/pam_krb5_cchelper – Credential cache helper Synopsis pam_krb5_cchelper [-c|-u|-d] [ccname] [uid] [gid] Description The pam_krb5.so module uses pam_krb5_cchelper to create, update, and remove credential caches. Arguments -c|-u|-d A flag indicating whether the helper is expected to create, update, or destroy a ccache. When creating a ccache, the ccname argument should be a name or a pattern…
pam_krb5 – Kerberos 5 authentication Synopsis auth required //usr/$LIB/security/pam_krb5.so session optional //usr/$LIB/security/pam_krb5.so account sufficient //usr/$LIB/security/pam_krb5.so password sufficient //usr/$LIB/security/pam_krb5.so Description The pam_krb5.so module is designed to allow smooth integration of Kerberos 5 password-checking for applications which use PAM. It creates session-specific credential caches. If the system is an AFS client, it will also attempt to obtain…
pam_keyinit – Kernel session keyring initialiser module Synopsis pam_keyinit.so [debug] [force] [revoke] Description The pam_keyinit PAM module ensures that the invoking process has a session keyring other than the user default session keyring. The module checks to see if the process’s session keyring is the user-session-keyring(7), and, if it is, creates a new session-keyring(7) with…
pam_issue – PAM module to add issue file to user prompt Synopsis pam_issue.so [noesc] [issue=issue-file-name] Description pam_issue is a PAM module to prepend an issue file to the username prompt. It also by default parses escape codes in the issue file similar to some common getty’s (using ormat). Recognized escapes: \d current day \l name…
pam_group – PAM module for group access Synopsis pam_group.so Description The pam_group PAM module does not authenticate the user, but instead it grants group memberships (in the credential setting phase of the authentication module) to the user. Such memberships are based on the service they are applying for. By default rules for group memberships are…
pam_getenv – get environment variables from /etc/environment Synopsis pam_getenv [-l] [-s] env_var Description This tool will print out the value of env_var from /etc/environment. It will attempt to expand environment variable references in the definition of env_var but will fail if PAM items are expanded. The -l option indicates the script should return an environment…
pam_get_items – A PAM test module to retrieve module-specific PAM items Synopsis pam_get_items.so Description PAM modules store data in PAM items. These items are only accessible from module context, not application context as they might include private data (PAM_AUTHTOK normally contains the password). But when testing PAM modules, it’s often nice to make sure a…
pam_ftp – PAM module for anonymous access module Synopsis pam_ftp.so [debug] [ignore] [users=XXX,YYY,…] Description pam_ftp is a PAM module which provides a pluggable anonymous ftp mode of access. This module intercepts the user’s name and password. If the name is ftp or anonymous, the user’s password is broken up at the @ delimiter into a…