1.\" Copyright (c) 2001 Mark R V Murray 2.\" All rights reserved. 3.\" Copyright (c) 2001 Networks Associates Technology, Inc. 4.\" All rights reserved. 5.\" 6.\" Portions of this software were developed for the FreeBSD Project by 7.\" ThinkSec AS and NAI Labs, the Security Research Division of Network 8.\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 9.\" ("CBOSS"), as part of the DARPA CHATS research program. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 3. The name of the author may not be used to endorse or promote 20.\" products derived from this software without specific prior written 21.\" permission. 22.\" 23.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 24.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 27.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33.\" SUCH DAMAGE. 34.\" 35.\" $FreeBSD$ 36.\" 37.Dd January 30, 2020 38.Dt PAM_LOGIN_ACCESS 8 39.Os 40.Sh NAME 41.Nm pam_login_access 42.Nd login.access PAM module 43.Sh SYNOPSIS 44.Op Ar service-name 45.Ar module-type 46.Ar control-flag 47.Pa pam_login_access 48.Op Ar options 49.Sh DESCRIPTION 50The 51.Pa login.access 52service module for PAM, 53.Nm 54provides functionality for only one PAM category: 55account management. 56In terms of the 57.Ar module-type 58parameter, this is the 59.Dq Li account 60feature. 61.Ss Login.access Account Management Module 62The 63.Pa login.access 64account management component 65.Pq Fn pam_sm_acct_mgmt , 66returns success if and only the user is allowed to login on the 67specified tty (in the case of a local login) or from the specified 68remote host (in the case of a remote login), according to the 69restrictions listed in 70.Xr login.access 5 . 71.Bl -tag -width ".Cm accessfile=pathname" 72.It Cm accessfile Ns = Ns Ar pathname 73specifies a non-standard location for the 74.Pa login.access 75configuration file 76(normally located in 77.Pa /etc/login.access ) . 78.It Cm nodefgroup 79makes tokens not enclosed in parentheses only match users, requiring groups 80to be specified in parentheses. 81Without 82.Cm nodefgroup 83user and group names are intermingled, with user entries taking precedence 84over group entries. 85This is not backwards compatible with legacy 86.Pa login.access 87configuration files. 88However this mitigates confusion between users and 89groups of the same name. 90.It Cm fieldsep Ns = Ns Ar separators 91changes the field separator from the default ":". 92More than one separator 93may be specified. 94.It Cm listsep Ns = Ns Ar separators 95changes the field separator from the default space (''), tab (\\t) and 96comma (,). 97More than one separator may be specified. 98For example, listsep=; 99will replace the default with a semicolon (;). 100This option may be useful when specifying Active Directory groupnames which 101typically contain spaces. 102.El 103.Sh SEE ALSO 104.Xr pam 3 , 105.Xr syslog 3 , 106.Xr login.access 5 , 107.Xr pam.conf 5 108.Sh AUTHORS 109The 110.Xr login.access 5 111access control scheme was designed and implemented by 112.An Wietse Venema . 113.Pp 114The 115.Nm 116module and this manual page were developed for the 117.Fx 118Project by 119ThinkSec AS and NAI Labs, the Security Research Division of Network 120Associates, Inc.\& under DARPA/SPAWAR contract N66001-01-C-8035 121.Pq Dq CBOSS , 122as part of the DARPA CHATS research program. 123