1.\" Copyright (c) 1996 David Nugent <davidn@blaze.net.au> 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, is permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice immediately at the beginning of the file, without modification, 9.\" this list of conditions, and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 3. This work was done expressly for inclusion into FreeBSD. Other use 14.\" is permitted provided this notation is included. 15.\" 4. Absolutely no warranty of function or purpose is made by the author 16.\" David Nugent. 17.\" 5. Modifications may be freely made to this file providing the above 18.\" conditions are met. 19.\" 20.\" $FreeBSD: src/lib/libutil/login.conf.5,v 1.22.2.18 2003/05/10 23:30:54 murray Exp $ 21.\" $DragonFly: src/lib/libutil/login.conf.5,v 1.6 2007/12/23 15:31:28 swildner Exp $ 22.\" 23.Dd November 22, 1996 24.Dt LOGIN.CONF 5 25.Os 26.Sh NAME 27.Nm login.conf 28.Nd login class capability database 29.Sh SYNOPSIS 30.Pa /etc/login.conf , 31.Pa ~/.login_conf 32.Sh DESCRIPTION 33.Nm 34contains various attributes and capabilities of login classes. 35A login class (an optional annotation against each record in the user 36account database, 37.Pa /etc/master.passwd ) 38determines session accounting, resource limits and user environment settings. 39It is used by various programs in the system to set up a user's login 40environment and to enforce policy, accounting and administrative restrictions. 41It also provides the means by which users are able to be 42authenticated to the system and the types of authentication available. 43.Pp 44A special record "default" in the system user class capability database 45.Pa /etc/login.conf 46is used automatically for any 47non-root user without a valid login class in 48.Pa /etc/master.passwd . 49A user with a uid of 0 without a valid login class will use the record 50"root" if it exists, or "default" if not. 51.Pp 52In 53.Dx , 54users may individually create a file called 55.Pa .login_conf 56in their home directory using the same format, consisting of a single 57entry with a record id of "me". 58If present, this file is used by 59.Xr login 1 60to set user-defined environment settings which override those specified 61in the system login capabilities database. 62Only a subset of login capabilities may be overridden, typically those 63which do not involve authentication, resource limits and accounting. 64.Pp 65Records in a class capabilities database consist of a number of 66colon-separated fields. 67The first entry for each record gives one or more names that a record is 68to be known by, each separated by a '|' character. 69The first name is the most common abbreviation. 70The last name given should be a long name that is more descriptive 71of the capability entry, and all others are synonyms. 72All names but the last should be in lower case and contain no blanks; 73the last name may contain upper case characters and blanks for 74readability. 75.Pp 76See 77.Xr getcap 3 78for a more in-depth description of the format of a capability database. 79.Sh CAPABILITIES 80Fields within each record in the database follow the 81.Xr getcap 3 82conventions for boolean, type string 83.Ql \&= 84and type numeric 85.Ql \&# , 86although type numeric is deprecated in favour of the string format and 87either form is accepted for a numeric datum. 88Values fall into the following categories: 89.Bl -tag -width "program" 90.It bool 91If the name is present, then the boolean value is true; otherwise, it is 92false 93.It file 94Path name to a data file 95.It program 96Path name to an executable file 97.It list 98A list of values (or pairs of values) separated by commas or spaces 99.It path 100A space or comma separated list of path names, following the usual csh 101conventions (leading tilde with and without username being expanded to 102home directories etc.) 103.It number 104A numeric value, either decimal (default), hexadecimal (with leading 0x), 105or octal (with a leading 0). 106With a numeric type, only one numeric value is allowed. 107Numeric types may also be specified in string format (ie. the capability 108tag being delimited from the value by '=' instead of '#'). 109Whichever method is used, then all records in the database must use the 110same method to allow values to be correctly overridden in interpolated 111records. 112.It size 113A number which expresses a size. 114The default interpretation of a value is the number of bytes, but a 115suffix may specify alternate units: 116.Bl -tag -offset indent -compact -width xxxx 117.It b 118explicitly selects 512-byte blocks 119.It k 120selects kilobytes (1024 bytes) 121.It m 122specifies a multiplier of 1 megabyte (1048576 bytes), 123.It g 124specifies units of gigabytes, and 125.It t 126represents terabytes. 127.El 128A size value is a numeric quantity and case of the suffix is not significant. 129Concatenated values are added together. 130.It time 131A period of time, by default in seconds. 132A prefix may specify a different unit: 133.Bl -tag -offset indent -compact -width xxxx 134.It y 135indicates the number of 365 day years, 136.It w 137indicates the number of weeks, 138.It d 139the number of days, 140.It h 141the number of hours, 142.It m 143the number of minutes, and 144.It s 145the number of seconds. 146.El 147Concatenated values are added together. 148For example, 2 hours and 40 minutes may be written either as 1499600s, 160m or 2h40m. 150.El 151.Pp 152The usual convention to interpolate capability entries using the special 153.Em tc=value 154notation may be used. 155.Sh RESOURCE LIMITS 156.Bl -column coredumpsize indent indent 157.It Sy "Name Type Notes Description 158.It "coredumpsize size Maximum coredump size limit. 159.It "cputime time CPU usage limit. 160.It "datasize size Maximum data size limit. 161.It "filesize size Maximum file size limit. 162.It "maxproc number Maximum number of processes. 163.It "memorylocked size Maximum locked in core memory size limit. 164.It "memoryuse size Maximum of core memory use size limit. 165.It "openfiles number Maximum number of open files per process. 166.It "sbsize size Maximum permitted socketbuffer size. 167.It "vmemoryuse size Maximum permitted total VM usage per process. 168.It "stacksize size Maximum stack size limit. 169.It "posixlocks size Maximum number of POSIX-type advisory-mode locks. 170.El 171.Pp 172These resource limit entries actually specify both the maximum 173and current limits (see 174.Xr getrlimit 2 ) . 175The current (soft) limit is the one normally used, although the user is 176permitted to increase the current limit to the maximum (hard) limit. 177The maximum and current limits may be specified individually by appending a 178-max or -cur to the capability name. 179.Sh ENVIRONMENT 180.Bl -column ignorenologin indent xbinxxusrxbin 181.It Sy "Name Type Notes Description 182.It "charset string Set $MM_CHARSET environment variable to the specified 183value. 184.It "hushlogin bool false Same as having a ~/.hushlogin file. 185.It "ignorenologin bool false Login not prevented by nologin. 186.It "lang string Set $LANG environment variable to the specified value. 187.It "manpath path Default search path for manpages. 188.It "nologin file If the file exists it will be displayed and 189the login session will be terminated. 190.It "path path /bin /usr/bin Default search path. 191.It "priority number Initial priority (nice) level. 192.It "requirehome bool false Require a valid home directory to login. 193.It "setenv list A comma-separated list of environment variables and 194values to which they are to be set. 195.It "shell prog Session shell to execute rather than the 196shell specified in the passwd file. 197The SHELL environment variable will 198contain the shell specified in the password file. 199.It "term string Default terminal type if not able to determine 200from other means. 201.It "timezone string Default value of $TZ environment variable. 202.It "umask number 022 Initial umask. Should always have a leading 0 to 203ensure octal interpretation. 204.It "welcome file /etc/motd File containing welcome message. 205.El 206.Sh AUTHENTICATION 207.Bl -column minpasswordlen indent indent 208.It Sy "Name Type Notes Description 209.\" .It "approve program Program to approve login. 210.It "copyright file File containing additional copyright information 211.It "host.allow list List of remote host wildcards from which users in 212the class may access. 213.It "host.deny list List of remote host wildcards from which users 214in the class may not access. 215.It "login_prompt string The login prompt given by 216.Xr login 1 217.It "minpasswordlen number 6 The minimum length a local password 218may be. 219.It "mixpasswordcase bool true Whether 220.Xr passwd 1 221will warn the user if an all lower case password is entered. 222.It "login-backoff number 3 The number of login attempts 223allowed before the backoff delay is inserted after each subsequent 224attempt. 225.It "login-retries number 10 The number of login attempts 226allowed before the login fails. 227.It "passwd_format string md5 The encryption format that new or 228changed passwords will use. 229Valid values include "des", "md5" and "blf". 230NIS clients using a 231.No non- Ns Dx Ns / Ns Fx 232NIS server should probably use "des". 233.It "passwd_prompt string The password prompt presented by 234.Xr login 1 235.It "times.allow list List of time periods during which 236logins are allowed. 237.It "times.deny list List of time periods during which logins are 238disallowed. 239.It "ttys.allow list List of ttys and ttygroups which users 240in the class may use for access. 241.It "ttys.deny list List of ttys and ttygroups which users 242in the class may not use for access. 243.\".It "widepasswords bool false Use the wide password format. The wide password 244.\" format allows up to 128 significant characters in the password. 245.El 246.Pp 247These fields are intended to be used by 248.Xr passwd 1 249and other programs in the login authentication system. 250.Pp 251Capabilities that set environment variables are scanned for both 252.Ql \&~ 253and 254.Ql \&$ 255characters, which are substituted for a user's home directory and name 256respectively. 257To pass these characters literally into the environment variable, escape 258the character by preceding it with a backslash '\\'. 259.Pp 260The 261.Em host.allow 262and 263.Em host.deny 264entries are comma separated lists used for checking remote access to the system, 265and consist of a list of hostnames and/or IP addresses against which remote 266network logins are checked. 267Items in these lists may contain wildcards in the form used by shell programs 268for wildcard matching (See 269.Xr fnmatch 3 270for details on the implementation). 271The check on hosts is made against both the remote system's Internet address 272and hostname (if available). 273If both lists are empty or not specified, then logins from any remote host 274are allowed. 275If host.allow contains one or more hosts, then only remote systems matching 276any of the items in that list are allowed to log in. 277If host.deny contains one or more hosts, then a login from any matching hosts 278will be disallowed. 279.Pp 280The 281.Em times.allow 282and 283.Em times.deny 284entries consist of a comma-separated list of time periods during which the users 285in a class are allowed to be logged in. 286These are expressed as one or more day codes followed by a start and end times 287expressed in 24 hour format, separated by a hyphen or dash. 288For example, MoThSa0200-1300 translates to Monday, Thursday and Saturday between 289the hours of 2 am and 1 p.m.. 290If both of these time lists are empty, users in the class are allowed access at 291any time. 292If 293.Em times.allow 294is specified, then logins are only allowed during the periods given. 295If 296.Em times.deny 297is specified, then logins are denied during the periods given, regardless of whether 298one of the periods specified in 299.Em times.allow 300applies. 301.Pp 302Note that 303.Xr login 1 304enforces only that the actual login falls within periods allowed by these entries. 305Further enforcement over the life of a session requires a separate daemon to 306monitor transitions from an allowed period to a non-allowed one. 307.Pp 308The 309.Em ttys.allow 310and 311.Em ttys.deny 312entries contain a comma-separated list of tty devices (without the /dev/ prefix) 313that a user in a class may use to access the system, and/or a list of ttygroups 314(See 315.Xr getttyent 3 316and 317.Xr ttys 5 318for information on ttygroups). 319If neither entry exists, then the choice of login device used by the user is 320unrestricted. 321If only 322.Em ttys.allow 323is specified, then the user is restricted only to ttys in the given 324group or device list. 325If only 326.Em ttys.deny 327is specified, then the user is prevented from using the specified devices or 328devices in the group. 329If both lists are given and are non-empty, the user is restricted to those 330devices allowed by ttys.allow that are not available by ttys.deny. 331.Sh ACCOUNTING LIMITS 332.Bl -column host.accounted indent indent 333.It Sy "Name Type Notes Description 334.It "accounted bool false Enable session time accounting for all users 335in this class. 336.It "autodelete time Time after expiry when account is auto-deleted. 337.It "bootfull bool false Enable 'boot only if ttygroup is full' strategy 338when terminating sessions. 339.It "daytime time Maximum login time per day. 340.It "expireperiod time Time for expiry allocation. 341.It "graceexpire time Grace days for expired account. 342.It "gracetime time Additional grace login time allowed. 343.It "host.accounted list List of remote host wildcards from which 344login sessions will be accounted. 345.It "host.exempt list List of remote host wildcards from which 346login session accounting is exempted. 347.It "idletime time Maximum idle time before logout (unused). 348.It "monthtime time Maximum login time per month. 349.It "passwordtime time Used by 350.Xr passwd 1 351to set next password expiry date. 352.It "refreshtime time New time allowed on account refresh. 353.It "refreshperiod str How often account time is refreshed. 354.It "sessiontime time Maximum login time per session. 355.It "sessionlimit number Maximum number of concurrent 356login sessions on ttys in any group. 357.It "ttys.accounted list List of ttys and ttygroups for which 358login accounting is active. 359.It "ttys.exempt list List of ttys and ttygroups for which login accounting 360is exempt. 361.It "warnexpire time Advance notice for pending account expiry. 362.It "warnpassword time Advance notice for pending password expiry. 363.It "warntime time Advance notice for pending out-of-time. 364.It "weektime time Maximum login time per week. 365.El 366.Pp 367These fields are used by the time accounting system, which regulates, 368controls and records user login access. 369.Pp 370The 371.Em ttys.accounted 372and 373.Em ttys.exempt 374fields operate in a similar manner to 375.Em ttys.allow 376and 377.Em ttys.deny 378as explained 379above. 380Similarly with the 381.Em host.accounted 382and 383.Em host.exempt 384lists. 385.Sh SEE ALSO 386.Xr cap_mkdb 1 , 387.Xr login 1 , 388.Xr getcap 3 , 389.Xr getttyent 3 , 390.Xr login_cap 3 , 391.Xr login_class 3 , 392.Xr passwd 5 , 393.Xr ttys 5 394.Sh BUGS 395The 396.Em idletime 397setting is not enforced. 398