deny or allow services based on an arbitrary file
' pam_listfile.so 'u pam_listfile.so item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file= /path/filename onerr=[succeed|fail] [apply=[ user | @group ]][quiet]
pam_listfile is a PAM module which provides a way to deny or allow services based on an arbitrary file .
The module gets the item of the type specified -- user specifies the username, PAM_USER ;tty specifies the name of the terminal over which the request has been made, PAM_TTY ;rhost specifies the name of the remote host (if any) from which the request was made, PAM_RHOST ;and ruser specifies the name of the remote user (if available) who made the request, PAM_RUSER --and looks for an instance of that item in the file= filename . filename contains one line per item listed . If the item is found, then if sense= allow , PAM_SUCCESS is returned, causing the authorization request to succeed; else if sense= deny , PAM_AUTH_ERR is returned, causing the authorization request to fail .
If an error is encountered (for instance, if filename does not exist, or a poorly -constructed argument is encountered), then if onerr=succeed , PAM_SUCCESS is returned, otherwise if onerr=fail , PAM_AUTH_ERR or PAM_SERVICE_ERR (as appropriate) will be returned .
An additional argument, apply= ,can be used to restrict the application of the above to a specific user ( apply= username )or a given group ( apply= @groupname ). This added restriction is only meaningful when used with the tty , rhost and shell items .
Besides this last one, all arguments should be specified; do not count on any default behavior .
No credentials are awarded by this module .
item=[tty|user|rhost|ruser|group|shell] What is listed in the file and should be checked for .
sense=[allow|deny] Action to take if found in file, if the item is NOT found in the file, then the opposite action is requested .
file= /path/filename File containing one item per line . The file needs to be a plain file and not world writable .
onerr=[succeed|fail] What to do if something weird happens like being unable to open the file .
apply=[ user | @group ] Restrict the user class for which the restriction apply . Note that with item=[user|ruser|group] this does not make sense, but for item=[tty|rhost|shell] it have a meaning .
quiet Do not treat service refusals or missing list files as errors that need to be logged .
All module types ( auth , account , password and session )are provided .
PAM_AUTH_ERR Authentication failure .
PAM_BUF_ERR Memory buffer error .
PAM_IGNORE The rule does not apply to the apply option .
PAM_SERVICE_ERR Error in service module .
PAM_SUCCESS Success .
Classic (Aqftpusers (Aq authentication can be implemented with this entry in /etc/pam .d/ftpd:.RS 4
# # deny ftp -access to users listed in the /etc/ftpusers file # auth required pam_listfile .so \ onerr=succeed item=user sense=deny file=/etc/ftpusers
.RE Note, users listed in /etc/ftpusers file are (counterintuitively) not allowed access to the ftp service .
To allow login access only for certain users, you can use a /etc/pam .d/login entry like this: .RS 4
# # permit login to users listed in /etc/loginusers # auth required pam_listfile .so \ onerr=fail item=user sense=allow file=/etc/loginusers
.RE For this example to work, all users who are allowed to use the login service should be listed in the file /etc/loginusers . Unless you are explicitly trying to lock out root, make sure that when you do this, you leave a way for root to log in, either by listing root in /etc/loginusers, or by listing a user who is able to su to the root account .
pam.conf(5), pam.d(5), pam(8)
pam_listfile was written by Michael K . Johnson <johnsonm@redhat .com> and Elliot Lee <sopwith@cuc .edu> .