6.16. pam_listfile - deny or allow services based on an arbitrary file

pam_listfile.so item=[tty|user|rhost|ruser|group|shell] sense=[allow|deny] file= /path/filename onerr=[succeed|fail] [ apply=[ user | @group ] ] [ quiet ]

6.16.1. DESCRIPTION

pam_listfile is a PAM module which provides a way to deny or allow services based on an arbitrary file.

The module gets the item of the type specified -- user specifies the username, PAM_USER ; tty specifies the name of the terminal over which the request has been made, PAM_TTY ; rhost specifies the name of the remote host (if any) from which the request was made, PAM_RHOST ; and ruser specifies the name of the remote user (if available) who made the request, PAM_RUSER -- and looks for an instance of that item in the file=filename . filename contains one line per item listed. If the item is found, then if sense=allow , PAM_SUCCESS is returned, causing the authorization request to succeed; else if sense=deny , PAM_AUTH_ERR is returned, causing the authorization request to fail.

If an error is encountered (for instance, if filename does not exist, or a poorly-constructed argument is encountered), then if onerr=succeed , PAM_SUCCESS is returned, otherwise if onerr=fail , PAM_AUTH_ERR or PAM_SERVICE_ERR (as appropriate) will be returned.

An additional argument, apply= , can be used to restrict the application of the above to a specific user ( apply=username ) or a given group ( apply=@groupname ). This added restriction is only meaningful when used with the tty , rhost and shell items.

Besides this last one, all arguments should be specified; do not count on any default behavior.

No credentials are awarded by this module.

6.16.2. OPTIONS

  • item=[tty|user|rhost|ruser|group|shell]

    • What is listed in the file and should be checked for.
  • sense=[allow|deny]

    • Action to take if found in file, if the item is NOT found in the file, then the opposite action is requested.
  • file=/path/filename

    • File containing one item per line. The file needs to be a plain file and not world writable.
  • onerr=[succeed|fail]

    • What to do if something weird happens like being unable to open the file.
  • apply=[user|@group]

    • Restrict the user class for which the restriction apply. Note that with item=[user|ruser|group] this does not make sense, but for item=[tty|rhost|shell] it have a meaning.
  • quiet

    • Do not treat service refusals or missing list files as errors that need to be logged.

6.16.3. MODULE TYPES PROVIDED

All module types ( auth , account , password and session ) are provided.

6.16.4. RETURN VALUES

  • PAM_AUTH_ERR

    • Authentication failure.
  • PAM_BUF_ERR

    • Memory buffer error.
  • PAM_IGNORE

    • The rule does not apply to the apply option.
  • PAM_SERVICE_ERR

    • Error in service module.
  • PAM_SUCCESS

    • Success.

6.16.5. EXAMPLES

Classic 'ftpusers' authentication can be implemented with this entry in /etc/pam.d/ftpd :

#
# deny ftp-access to users listed in the /etc/ftpusers file
#
auth    required       pam_listfile.so \
        onerr=succeed item=user sense=deny file=/etc/ftpusers

Note, users listed in /etc/ftpusers file are (counterintuitively) not allowed access to the ftp service.

To allow login access only for certain users, you can use a /etc/pam.d/login entry like this:

#
# permit login to users listed in /etc/loginusers
#
auth    required       pam_listfile.so \
        onerr=fail item=user sense=allow file=/etc/loginusers

For this example to work, all users who are allowed to use the login service should be listed in the file /etc/loginusers . Unless you are explicitly trying to lock out root, make sure that when you do this, you leave a way for root to log in, either by listing root in /etc/loginusers , or by listing a user who is able to su to the root account.

6.16.6. AUTHOR

pam_listfile was written by Michael K. Johnson <johnsonm@redhat.com> and Elliot Lee <sopwith@cuc.edu>.