1d3bb1208SEmmanuel Vadot# 2d3bb1208SEmmanuel Vadot# Login access control table. 3d3bb1208SEmmanuel Vadot# 4d3bb1208SEmmanuel Vadot# When someone logs in, the table is scanned for the first entry that 5d3bb1208SEmmanuel Vadot# matches the (user, host) combination, or, in case of non-networked 6d3bb1208SEmmanuel Vadot# logins, the first entry that matches the (user, tty) combination. The 7d3bb1208SEmmanuel Vadot# permissions field of that table entry determines whether the login will 8d3bb1208SEmmanuel Vadot# be accepted or refused. 9d3bb1208SEmmanuel Vadot# 10d3bb1208SEmmanuel Vadot# Format of the login access control table is three fields separated by a 11d3bb1208SEmmanuel Vadot# ":" character: 12d3bb1208SEmmanuel Vadot# 13d3bb1208SEmmanuel Vadot# permission : users : origins 14d3bb1208SEmmanuel Vadot# 15d3bb1208SEmmanuel Vadot# The first field should be a "+" (access granted) or "-" (access denied) 16d3bb1208SEmmanuel Vadot# character. The second field should be a list of one or more login names, 17d3bb1208SEmmanuel Vadot# group names, or ALL (always matches). The third field should be a list 18d3bb1208SEmmanuel Vadot# of one or more tty names (for non-networked logins), host names, domain 19d3bb1208SEmmanuel Vadot# names (begin with "."), host addresses, internet network numbers (end 20d3bb1208SEmmanuel Vadot# with "."), ALL (always matches) or LOCAL (matches any string that does 21d3bb1208SEmmanuel Vadot# not contain a "." character). If you run NIS you can use @netgroupname 22d3bb1208SEmmanuel Vadot# in host or user patterns. 23d3bb1208SEmmanuel Vadot# 24d3bb1208SEmmanuel Vadot# The EXCEPT operator makes it possible to write very compact rules. 25d3bb1208SEmmanuel Vadot# 26d3bb1208SEmmanuel Vadot# The group file is searched only when a name does not match that of the 27d3bb1208SEmmanuel Vadot# logged-in user. Only groups are matched in which users are explicitly 28d3bb1208SEmmanuel Vadot# listed: the program does not look at a user's primary group id value. 29d3bb1208SEmmanuel Vadot# 30d3bb1208SEmmanuel Vadot############################################################################## 31d3bb1208SEmmanuel Vadot# 32d3bb1208SEmmanuel Vadot# Disallow console logins to all but a few accounts. 33d3bb1208SEmmanuel Vadot# 34d3bb1208SEmmanuel Vadot#-:ALL EXCEPT wheel shutdown sync:console 35d3bb1208SEmmanuel Vadot# 36d3bb1208SEmmanuel Vadot# Disallow non-local logins to privileged accounts (group wheel). 37d3bb1208SEmmanuel Vadot# 38d3bb1208SEmmanuel Vadot#-:wheel:ALL EXCEPT LOCAL .win.tue.nl 39d3bb1208SEmmanuel Vadot# 40d3bb1208SEmmanuel Vadot# Some accounts are not allowed to login from anywhere: 41d3bb1208SEmmanuel Vadot# 42d3bb1208SEmmanuel Vadot#-:wsbscaro wsbsecr wsbspac wsbsym wscosor wstaiwde:ALL 43d3bb1208SEmmanuel Vadot# 44d3bb1208SEmmanuel Vadot# All other accounts are allowed to login from anywhere. 45d3bb1208SEmmanuel Vadot# 46