123 lines
4.5 KiB
Plaintext
123 lines
4.5 KiB
Plaintext
|
# Login access control table.
|
||
|
|
#
|
||
|
|
# Comment line must start with "#", no space at front.
|
||
|
|
# Order of lines is important.
|
||
|
|
#
|
||
|
|
# When someone logs in, the table is scanned for the first entry that
|
||
|
|
# matches the (user, host) combination, or, in case of non-networked
|
||
|
|
# logins, the first entry that matches the (user, tty) combination. The
|
||
|
|
# permissions field of that table entry determines whether the login will
|
||
|
|
# be accepted or refused.
|
||
|
|
#
|
||
|
|
# Format of the login access control table is three fields separated by a
|
||
|
|
# ":" character:
|
||
|
|
#
|
||
|
|
# [Note, if you supply a 'fieldsep=|' argument to the pam_access.so
|
||
|
|
# module, you can change the field separation character to be
|
||
|
|
# '|'. This is useful for configurations where you are trying to use
|
||
|
|
# pam_access with X applications that provide PAM_TTY values that are
|
||
|
|
# the display variable like "host:0".]
|
||
|
|
#
|
||
|
|
# permission : users : origins
|
||
|
|
#
|
||
|
|
# The first field should be a "+" (access granted) or "-" (access denied)
|
||
|
|
# character.
|
||
|
|
#
|
||
|
|
# The second field should be a list of one or more login names, group
|
||
|
|
# names, or ALL (always matches). A pattern of the form user@host is
|
||
|
|
# matched when the login name matches the "user" part, and when the
|
||
|
|
# "host" part matches the local machine name.
|
||
|
|
#
|
||
|
|
# The third field should be a list of one or more tty names (for
|
||
|
|
# non-networked logins), host names, domain names (begin with "."), host
|
||
|
|
# addresses, internet network numbers (end with "."), ALL (always
|
||
|
|
# matches), NONE (matches no tty on non-networked logins) or
|
||
|
|
# LOCAL (matches any string that does not contain a "." character).
|
||
|
|
#
|
||
|
|
# You can use @netgroupname in host or user patterns; this even works
|
||
|
|
# for @usergroup@@hostgroup patterns.
|
||
|
|
#
|
||
|
|
# The EXCEPT operator makes it possible to write very compact rules.
|
||
|
|
#
|
||
|
|
# The group file is searched only when a name does not match that of the
|
||
|
|
# logged-in user. Both the user's primary group is matched, as well as
|
||
|
|
# groups in which users are explicitly listed.
|
||
|
|
# To avoid problems with accounts, which have the same name as a group,
|
||
|
|
# you can use brackets around group names '(group)' to differentiate.
|
||
|
|
# In this case, you should also set the "nodefgroup" option.
|
||
|
|
#
|
||
|
|
# TTY NAMES: Must be in the form returned by ttyname(3) less the initial
|
||
|
|
# "/dev" (e.g. tty1 or vc/1)
|
||
|
|
#
|
||
|
|
##############################################################################
|
||
|
|
#
|
||
|
|
# Disallow non-root logins on tty1
|
||
|
|
#
|
||
|
|
#-:ALL EXCEPT root:tty1
|
||
|
|
#
|
||
|
|
# Disallow console logins to all but a few accounts.
|
||
|
|
#
|
||
|
|
#-:ALL EXCEPT wheel shutdown sync:LOCAL
|
||
|
|
#
|
||
|
|
# Same, but make sure that really the group wheel and not the user
|
||
|
|
# wheel is used (use nodefgroup argument, too):
|
||
|
|
#
|
||
|
|
#-:ALL EXCEPT (wheel) shutdown sync:LOCAL
|
||
|
|
#
|
||
|
|
# Disallow non-local logins to privileged accounts (group wheel).
|
||
|
|
#
|
||
|
|
#-:wheel:ALL EXCEPT LOCAL .win.tue.nl
|
||
|
|
#
|
||
|
|
# Some accounts are not allowed to login from anywhere:
|
||
|
|
#
|
||
|
|
#-:wsbscaro wsbsecr wsbspac wsbsym wscosor wstaiwde:ALL
|
||
|
|
#
|
||
|
|
# All other accounts are allowed to login from anywhere.
|
||
|
|
#
|
||
|
|
##############################################################################
|
||
|
|
# All lines from here up to the end are building a more complex example.
|
||
|
|
##############################################################################
|
||
|
|
#
|
||
|
|
# User "root" should be allowed to get access via cron .. tty5 tty6.
|
||
|
|
#+ : root : cron crond :0 tty1 tty2 tty3 tty4 tty5 tty6
|
||
|
|
#
|
||
|
|
# User "root" should be allowed to get access from hosts with ip addresses.
|
||
|
|
#+ : root : 192.168.200.1 192.168.200.4 192.168.200.9
|
||
|
|
#+ : root : 127.0.0.1
|
||
|
|
#
|
||
|
|
# User "root" should get access from network 192.168.201.
|
||
|
|
# This term will be evaluated by string matching.
|
||
|
|
# comment: It might be better to use network/netmask instead.
|
||
|
|
# The same is 192.168.201.0/24 or 192.168.201.0/255.255.255.0
|
||
|
|
#+ : root : 192.168.201.
|
||
|
|
#
|
||
|
|
# User "root" should be able to have access from domain.
|
||
|
|
# Uses string matching also.
|
||
|
|
#+ : root : .foo.bar.org
|
||
|
|
#
|
||
|
|
# User "root" should be denied to get access from all other sources.
|
||
|
|
#- : root : ALL
|
||
|
|
#
|
||
|
|
# User "foo" and members of netgroup "nis_group" should be
|
||
|
|
# allowed to get access from all sources.
|
||
|
|
# This will only work if netgroup service is available.
|
||
|
|
#+ : @nis_group foo : ALL
|
||
|
|
#
|
||
|
|
# User "john" should get access from ipv4 net/mask
|
||
|
|
#+ : john : 127.0.0.0/24
|
||
|
|
#
|
||
|
|
# User "john" should get access from ipv4 as ipv6 net/mask
|
||
|
|
#+ : john : ::ffff:127.0.0.0/127
|
||
|
|
#
|
||
|
|
# User "john" should get access from ipv6 host address
|
||
|
|
#+ : john : 2001:4ca0:0:101::1
|
||
|
|
#
|
||
|
|
# User "john" should get access from ipv6 host address (same as above)
|
||
|
|
#+ : john : 2001:4ca0:0:101:0:0:0:1
|
||
|
|
#
|
||
|
|
# User "john" should get access from ipv6 net/mask
|
||
|
|
#+ : john : 2001:4ca0:0:101::/64
|
||
|
|
#
|
||
|
|
# All other users should be denied to get access from all sources.
|
||
|
|
#- : ALL : ALL
|