Content-type: text/html
pam_list.so.1
The pam_list module implements pam_sm_acct_mgmt(3PAM), which provides functionality to the PAM account management stack. The module provides functions to validate that the user's account is valid on this host based on a list of users and/or netgroups in the given file. The users and netgroups are separated by newline character. Netgroups are specified with character '@' as prefix before name of netgroup in the list. The maximum line lenght is 1023 characters.
The username is the value of PAM_USER. The host is the value of PAM_RHOST or, if PAM_RHOST is not set, the value of the localhost as returned by gethostname(3C) is used.
If neither of the allow or deny options are specified then the module will look for +/- entries in the local /etc/passwd file. If this style is used, nsswitch.conf(4) must not be configured with compat for the passwd database. If no relevant +/- entry exists for the user, pam_list is not participating in result.
The following options can be passed to the module:
allow=
deny=
debug
user
nouser
host
nohost
user_host_exact
The following error values are returned:
PAM_SERVICE_ERR
PAM_BUF_ERR
PAM_IGNORE
PAM_PERM_DENIED
PAM_SUCCESS
PAM_USER_UNKNOWN
Example 1 Using pam_list in default mode
/etc/pam.conf modification looks like:
other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 other account required pam_list.so.1
In the case of default mode, the important lines in /etc/passwd appear as follows:
+loginname - user is approved -loginname - user is disapproved +@netgroup - netgroup members are approved -@netgroup - netgroup members are disapproved
Example 2 Using pam_list with allow file
/etc/pam.conf modification looks like:
other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 other account required pam_list.so.1 allow=etc/user.allow
/etc/users.allow contains:
root localloginname remoteloginname @netgroup
See attributes(5) for descriptions of the following attributes:
|
The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multithreaded application uses its own PAM handle.
pam(3PAM), pam_authenticate(3PAM), pam_sm_acct_mgmt(3PAM), syslog(3C), libpam(3LIB), nsswitch.conf(4), pam.conf(4), attributes(5)