LinuxCommandLibrary

pam_succeed_if

Grant access based on a condition

SYNOPSIS

pam_succeed_if.so [debug] [quiet] [audit]

PARAMETERS

debug
    Enables debug messages in the system log.

quiet
    Suppresses error messages.

audit
    Logs success and failure events to the audit log.

uid >=
    Checks if the user's UID is greater than or equal to the specified number.

uid <=
    Checks if the user's UID is less than or equal to the specified number.

gid >=
    Checks if the user's GID is greater than or equal to the specified number.

gid <=
    Checks if the user's GID is less than or equal to the specified number.

user =
    Checks if the username matches the specified username.

user !=
    Checks if the username does not matches the specified username.

group =
    Checks if the user is a member of the specified group.

group !=
    Checks if the user is not a member of the specified group.

tty =
    Checks if the login is from the specified TTY.

host =
    Checks if the login is from the specified hostname (resolved via DNS).

host !=
    Checks if the login is not from the specified hostname (resolved via DNS).

rhost =
    Checks if the login is from the specified remote hostname or IP address.

rhost !=
    Checks if the login is not from the specified remote hostname or IP address.

service =
    Checks if the service matches the specified service name.

service !=
    Checks if the service does not matches the specified service name.

user_unknown
    Checks if the user is unknown.

user_present
    Checks if the user is present.

addr =

/
    Checks if the remote address is in the network

addr !=
/
    Checks if the remote address is not in the network

env = =
    Checks if the ENV variable exists

env != =
    Checks if the ENV variable does not exists

DESCRIPTION

The pam_succeed_if module is a PAM (Pluggable Authentication Modules) module that conditionally returns success based on various criteria. It allows administrators to create flexible authentication policies by evaluating conditions related to user attributes, environment variables, or other PAM modules. If the specified condition is met, pam_succeed_if returns a PAM_SUCCESS status, effectively allowing the authentication process to continue. If the condition is not met, the module's behavior depends on the use_debug, quiet, and audit options. It's often used to bypass password prompts for specific users, groups, or under certain network conditions. It's a powerful tool for tailoring authentication behavior to specific security needs, enabling more granular control over the login process. The module can be used in authentication, account management, session management, and password management module stacks. However, improper configuration can lead to unexpected authentication behavior, so careful planning and testing are crucial.

CAVEATS

Improper configuration can easily lock users out of the system. Careful testing is crucial before deploying changes to production systems.
Host name resolution can be unreliable. Using IP addresses or network ranges via the addr parameter for rhost is preferable where possible.

RETURN VALUES

PAM_SUCCESS: The condition was met.
PAM_IGNORE: The condition was not met, and the module should be ignored.
PAM_AUTH_ERR: An error occurred.

SEE ALSO

pam(8), pam.conf(5), pam_unix(8)

Copied to clipboard