Section 8: administration and privileged commands
pam_warn – PAM module which logs all PAM items if called Synopsis pam_warn.so Description pam_warn is a PAM module that logs the service, terminal, user, remote user and remote host to syslog(3). The items are not probed for, but instead obtained from the standard PAM items. The module always returns PAM_IGNORE, indicating that it does…
pam_usertype – check if the authenticated user is a system or regular account Synopsis pam_usertype.so [flag…] {condition} Description pam_usertype.so is designed to succeed or fail authentication based on type of the account of the authenticated user. The type of the account is decided with help of SYS_UID_MIN and SYS_UID_MAX settings in /etc/login.defs. One use is…
pam_userdb – PAM module to authenticate against a db database Synopsis pam_userdb.so db=/path/database [debug] [crypt=[crypt|none]] [icase] [dump] [try_first_pass] [use_first_pass] [unknown_ok] [key_only] Description The pam_userdb module is used to verify a username/password pair against values stored in a Berkeley DB database. The database is indexed by the username, and the data fields corresponding to the username…
pam_unix – Module for traditional password authentication Synopsis pam_unix.so […] Description This is the standard Unix authentication module. It uses standard calls from the system’s libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and the /etc/shadow file as well if shadow is enabled. The account…
pam_umask – PAM module to set the file mode creation mask Synopsis pam_umask.so [debug] [silent] [usergroups] [nousergroups] [umask=mask] Description pam_umask is a PAM module to set the file mode creation mask of the current environment. The umask affects the default permissions assigned to newly created files. The PAM module tries to get the umask value…
pam_tty_audit – Enable or disable TTY auditing for specified users Synopsis pam_tty_audit.so [disable=patterns] [enable=patterns] Description The pam_tty_audit PAM module is used to enable or disable TTY auditing. By default, the kernel does not audit input on any TTY. Options disable=patterns For each user matching patterns, disable TTY auditing. This overrides any previous enable option matching…
pam_timestamp_selinux – Security Enhanced Linux Policy for the pam_timestamp processes Description Security-Enhanced Linux secures the pam_timestamp processes via flexible mandatory access control. The pam_timestamp processes execute with the pam_timestamp_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example: ps -eZ | grep…
pam_timestamp_check – Check to see if the default timestamp is valid Synopsis pam_timestamp_check [-k] [-d] [target_user] Description With no arguments pam_timestamp_check will check to see if the default timestamp is valid, or optionally remove it. Options -k Instead of checking the validity of a timestamp, remove it. This is analogous to sudo’s -k option. -d…
pam_timestamp – Authenticate using cached successful authentication attempts Synopsis pam_timestamp.so [timestampdir=directory] [timestamp_timeout=number] [verbose] [debug] Description In a nutshell, pam_timestamp caches successful authentication attempts, and allows you to use a recent successful attempt as the basis for authentication. This is similar mechanism which is used in sudo. When an application opens a session using pam_timestamp, a…
pam_time – PAM module for time control access Synopsis pam_time.so [conffile=conf-file] [debug] [noaudit] Description The pam_time PAM module does not authenticate the user, but instead it restricts access to a system and or specific applications at various times of the day and on specific days or over various terminal lines. This module can be configured…
pam_tally2 – The login counter (tallying) module Synopsis pam_tally2.so [file=/path/to/counter] [onerr=[fail|succeed]] [magic_root] [even_deny_root] [deny=n] [lock_time=n] [unlock_time=n] [root_unlock_time=n] [serialize] [audit] [silent] [no_log_info] [debug] pam_tally2 [–file /path/to/counter] [–user username] [–reset[=n]] [–quiet] Description This module maintains a count of attempted accesses, can reset count on success, can deny access if too many attempts fail. pam_tally2 comes in two parts: pam_tally2.so…
pam_tally – The login counter (tallying) module Synopsis pam_tally.so [file=/path/to/counter] [onerr=[fail|succeed]] [magic_root] [even_deny_root_account] [deny=n] [lock_time=n] [unlock_time=n] [per_user] [no_lock_time] [no_reset] [audit] [silent] [no_log_info] pam_tally [–file /path/to/counter] [–user username] [–reset[=n]] [–quiet] Description This module maintains a count of attempted accesses, can reset count on success, can deny access if too many attempts fail. pam_tally has several limitations, which are…
pam_systemd – Register user sessions in the systemd login manager Synopsis pam_systemd.so Description pam_systemd registers user sessions with the systemd login manager systemd-logind.service(8), and hence the systemd control group hierarchy. The module also applies various resource management and runtime parameters to the new session, as configured in the m[blue]JSON User Recordsm[][1] of the user, when…
pam_succeed_if – test account characteristics Synopsis pam_succeed_if.so [flag…] [condition…] Description pam_succeed_if.so is designed to succeed or fail authentication based on characteristics of the account belonging to the user being authenticated or values of other PAM items. One use is to select whether to load other modules based on this test. The module should be given…
pam_sss – PAM module for SSSD Synopsis pam_sss.so [quiet] [forward_pass] [use_first_pass] [use_authtok] [retry=N] [ignore_unknown_user] [ignore_authinfo_unavail] [domains=X] [allow_missing_name] [prompt_always] Description pam_sss.so is the PAM interface to the System Security Services daemon (SSSD). Errors and results are logged through syslog(3) with the LOG_AUTHPRIV facility. Options quiet Suppress log messages for unknown users. forward_pass If forward_pass is set…
pam_ssh_agent_auth – PAM module for granting permissions based on SSH agent requests Description This module provides authentication via ssh-agent. If an ssh-agent listening at SSH_AUTH_SOCK can successfully authenticate that it has the secret key for a public key in the specified file, authentication is granted, otherwise authentication fails. Configuration /etc/pam.d/sudo: auth sufficient pam_ssh_agent_auth.so file=/etc/security/authorized_keys /etc/sudoers: In older…
pam_ssh_add – PAM module to auto load ssh keys into an agent Description pam_ssh_add provides authentication and session modules that allow users to start their session with a running ssh-agent with as many ssh keys loaded as possible. If used, the authentication module simply stores the authentication token for later use by the session module….
pam_ssh – authentication and session management with SSH private keys Synopsis [service-name ] module-type control-flag pam_ssh [options ] Description The SSH authentication service module for PAM, provides functionality for two PAM categories: authentication and session management. In terms of the module-type parameter, they are the “auth ” and “session ” features. It also provides null…
pam_snapper – PAM module which creates filesystem snapshots via "snapper" Synopsis pam_snapper.so [debug] [homeprefix=prefix] [ignoreservices=services] [ignoreusers=users] [rootasroot] [ignoreroot] [openonly] [closeonly] [cleanup=algorithm] Description Create a snapshot at every login of a user, thus he or she always has a save starting point. As many users do not logout for some time, it is a good idea…
pam_shells – PAM module to check for valid login shell Synopsis pam_shells.so Description pam_shells is a PAM module that only allows access to the system if the user’s shell is listed in /etc/shells. It also checks if /etc/shells is a plain file and not world writable. Options This module does not recognise any options. Module…