Linux Manuals session 8

pam_fprintd – PAM module to authenticate against fprintd, the fingerprint daemon Synopsis pam_fprintd.so [debug|debug=[on|off|true|false|1|0]] [max-tries=MAX_TRIES] [timeout=TIMEOUT] Description The pam_fprintd module is used to verify a user’s fingerprints against fingerprints enrolled using fprintd, the fingerprint management daemon. Options debug debug=[on|off|true|false|1|0] Whether debug should be turned on or off. Debug messages will be generated using pam_syslog which…

pam_filter – PAM filter module Synopsis pam_filter.so [debug] [new_term] [non_term] run1|run2 filter […] Description This module is intended to be a platform for providing access to all of the input/output that passes between the user and the application. It is only suitable for tty-based and (stdin/stdout) applications. To function this module requires filters to be…

pam_faillock – Module counting authentication failures during a specified interval Synopsis auth … pam_faillock.so {preauth|authfail|authsucc} [conf=/path/to/config-file] [dir=/path/to/tally-directory] [even_deny_root] [deny=n] [fail_interval=n] [unlock_time=n] [root_unlock_time=n] [admin_group=name] [audit] [silent] [no_log_info] account … pam_faillock.so [dir=/path/to/tally-directory] [no_log_info] Description This module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were…

pam_faildelay – Change the delay on failure per-application Synopsis pam_faildelay.so [debug] [delay=microseconds] Description pam_faildelay is a PAM module that can be used to set the delay on failure per-application. If no delay is given, pam_faildelay will use the value of FAIL_DELAY from /etc/login.defs. Options debug Turns on debugging messages sent to syslog. delay=N Set the…

pam_extrausers – Module for libnss-extrausers authentication Synopsis pam_extrausers.so […] Description This is similar to the standard Unix authentication module pam_unix. But instead of using /etc/passwd and /etc/shadow, it uses /var/lib/extrausers/passwd and /var/lib/extrausers/shadow. The account component performs the task of establishing the status of the user’s account and password based on the following shadow elements: expire,…

pam_exec – PAM module which calls an external command Synopsis pam_exec.so [debug] [expose_authtok] [seteuid] [quiet] [stdout] [log=file] [type=type] command […] Description pam_exec is a PAM module that can be used to run an external command. The child’s environment is set to the current PAM environment list, as returned by pam_getenvlist(3) In addition, the following PAM…

pam_env – PAM module to set/unset environment variables Synopsis pam_env.so [debug] [conffile=conf-file] [envfile=env-file] [readenv=0|1] [user_envfile=env-file] [user_readenv=0|1] Description The pam_env PAM module allows the (un)setting of environment variables. Supported is the use of previously set environment variables as well as PAM_ITEMs such as PAM_RHOST. By default rules for (un)setting of variables is taken from the config…

pam_ecryptfs – PAM module for eCryptfs Synopsis pam_ecryptfs.so [unwrap] Description pam_ecryptfs is a PAM module that can use the login password to unwrap an ecryptfs mount passphrase stored in ~/.ecryptfs/wrapped-passphrase, and automatically mount a private cryptographic directory. Options unwrap Use the login passphrase to unwrap an eCryptfs mount passphrase. Module Services Provided The services auth,…

pam_echo – PAM module for printing text messages Synopsis pam_echo.so [file=/path/message] Description The pam_echo PAM module is for printing text messages to inform user about special things. Sequences starting with the % character are interpreted in the following way: %H The name of the remote host (PAM_RHOST). %h The name of the local host. %s…

pam_deny – The locking-out PAM module Synopsis pam_deny.so Description This module can be used to deny access. It always indicates a failure to the application through the PAM framework. It might be suitable for using for default (the OTHER) entries. Options This module does not recognise any options. Module Types Provided All module types (account,…

pam_debug – PAM module to debug the PAM stack Synopsis pam_debug.so [auth=value] [cred=value] [acct=value] [prechauthtok=value] [chauthtok=value] [auth=value] [open_session=value] [close_session=value] Description The pam_debug PAM module is intended as a debugging aide for determining how the PAM stack is operating. This module returns what its module arguments tell it to return. Options auth=value The pam_sm_authenticate(3) function will…

pam_cracklib – PAM module to check the password against dictionary words Synopsis pam_cracklib.so […] Description This module can be plugged into the password stack of a given application to provide some plug-in strength-checking for passwords. The action of this module is to prompt the user for a password and check its strength against a system…

pam_console_selinux – Security Enhanced Linux Policy for the pam_console processes Description Security-Enhanced Linux secures the pam_console processes via flexible mandatory access control. The pam_console processes execute with the pam_console_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…

pam_console_apply – set or revoke permissions for users at the system console Synopsis pam_console_apply [-f <fstab file>] [-c <console.perms file>] [-r] [-t <tty>] [-s] [-d] [<device file> …] Description pam_console_apply is a helper executable which sets or resets permissions on device nodes. If /var/run/console.lock exists, pam_console_apply will grant permissions to the user listed therein. If…

pam_console – determine user owning the system console Synopsis session optional pam_console.so auth required pam_console.so Description pam_console.so is designed to give users at the physical console (virtual terminals and local xdm-managed X sessions by default, but that is configurable) capabilities that they would not otherwise have, and to take those capabilities away when the are…

pam_ck_connector – Register session with ConsoleKit Synopsis pam_ck_connector.so [debug] Description The pam_ck_connector PAM module registers a login session with the system-wide ConsoleKit daemon. This PAM module should be used with caution; only local login managers such as login(1) should use this. Since the ConsoleKit daemon can accept both an tty and an X11 display the…

pam_cap – PAM module to set inheritable capabilities Synopsis pam_cap.so [config=/path/to/capability.conf] [debug] Description The pam_cap PAM module sets the current process’ inheritable capabilities. Capabilities are read from the /etc/security/capability.conf config file, or alternate file specified with the config= option. The module must not be called by a multithreaded application. Options config=/path/to/capability.conf Indicate an alternative capability.conf…

pam_access – PAM module for logdaemon style login access control Synopsis pam_access.so [debug] [nodefgroup] [noaudit] [accessfile=file] [fieldsep=sep] [listsep=sep] Description The pam_access PAM module is mainly for access management. It provides logdaemon style login access control based on login names, host or domain names, internet addresses or network numbers, or on terminal line names, X $DISPLAY…

pam-auth-update – manage PAM configuration using packaged profiles Synopsis pam-auth-update [–package [–remove profile [profile…]]] [–force] Description pam-auth-update is a utility that permits configuring the central authentication policy for the system using pre-defined profiles as supplied by PAM module packages. Profiles shipped in the /usr/share/pam-configs/ directory specify the modules, with options, to enable; the preferred ordering…

pads_selinux – Security Enhanced Linux Policy for the pads processes Description Security-Enhanced Linux secures the pads processes via flexible mandatory access control. The pads processes execute with the pads_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…