1.\" Copyright (c) 1995 David Nugent <davidn@blaze.net.au> 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, is permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice immediately at the beginning of the file, without modification, 9.\" this list of conditions, and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 3. This work was done expressly for inclusion into FreeBSD. Other use 14.\" is permitted provided this notation is included. 15.\" 4. Absolutely no warranty of function or purpose is made by the author 16.\" David Nugent. 17.\" 5. Modifications may be freely made to this file providing the above 18.\" conditions are met. 19.\" 20.\" $FreeBSD: head/lib/libutil/login_ok.3 206622 2010-04-14 19:08:06Z uqs $ 21.\" 22.Dd January 2, 1997 23.Dt LOGIN_OK 3 24.Os 25.Sh NAME 26.Nm auth_ttyok , 27.Nm auth_hostok , 28.Nm auth_timeok 29.Nd functions for checking login class based login restrictions 30.Sh LIBRARY 31.Lb libutil 32.Sh SYNOPSIS 33.In sys/types.h 34.In time.h 35.In login_cap.h 36.Ft int 37.Fn auth_ttyok "login_cap_t *lc" "const char *tty" 38.Ft int 39.Fn auth_hostok "login_cap_t *lc" "const char *host" "char const *ip" 40.Ft int 41.Fn auth_timeok "login_cap_t *lc" "time_t t" 42.Sh DESCRIPTION 43This set of functions checks to see if login is allowed based on login 44class capability entries in the login database, 45.Xr login.conf 5 . 46.Pp 47The 48.Fn auth_ttyok 49function checks to see if the named tty is available to users of a specific 50class, and is either in the 51.Em ttys.allow 52access list, and not in 53the 54.Em ttys.deny 55access list. 56An empty 57.Em ttys.allow 58list (or if no such capability exists for 59the given login class) logins via any tty device are allowed unless 60the 61.Em ttys.deny 62list exists and is non-empty, and the device or its 63tty group (see 64.Xr ttys 5 ) 65is not in the list. 66Access to ttys may be allowed or restricted specifically by tty device 67name, a device name which includes a wildcard (e.g.\& ttyD* or cuaD*), 68or may name a ttygroup, when group=<name> tags have been assigned in 69.Pa /etc/ttys . 70Matching of ttys and ttygroups is case sensitive. 71Passing a 72.Dv NULL 73or empty string as the 74.Ar tty 75parameter causes the function to return a non-zero value. 76.Pp 77The 78.Fn auth_hostok 79function checks for any host restrictions for remote logins. 80The function checks on both a host name and IP address (given in its 81text form, typically n.n.n.n) against the 82.Em host.allow 83and 84.Em host.deny 85login class capabilities. 86As with ttys and their groups, wildcards and character classes may be 87used in the host allow and deny capability records. 88The 89.Xr fnmatch 3 90function is used for matching, and the matching on hostnames is case 91insensitive. 92Note that this function expects that the hostname is fully expanded 93(i.e., the local domain name added if necessary) and the IP address 94is in its canonical form. 95No hostname or address lookups are attempted. 96.Pp 97It is possible to call this function with either the hostname or 98the IP address missing (i.e.\& 99.Dv NULL ) 100and matching will be performed 101only on the basis of the parameter given. 102Passing 103.Dv NULL 104or empty strings in both parameters will result in 105a non-zero return value. 106.Pp 107The 108.Fn auth_timeok 109function checks to see that a given time value is within the 110.Em times.allow 111login class capability and not within the 112.Em times.deny 113access lists. 114An empty or non-existent 115.Em times.allow 116list allows access at any 117time, except if a given time is falls within a period in the 118.Em times.deny 119list. 120The format of time period records contained in both 121.Em times.allow 122and 123.Em times.deny 124capability fields is explained in detail in the 125.Xr login_times 3 126manual page. 127.Sh RETURN VALUES 128A non-zero return value from any of these functions indicates that 129login access is granted. 130A zero return value means either that the item being tested is not 131in the 132.Em allow 133access list, or is within the 134.Em deny 135access list. 136.Sh SEE ALSO 137.Xr getcap 3 , 138.Xr login_cap 3 , 139.Xr login_class 3 , 140.Xr login_times 3 , 141.Xr login.conf 5 , 142.Xr termcap 5 143