1242be47eSzrj.\" 2*c98db407SSascha Wildner.\" $FreeBSD: head/lib/libpam/modules/pam_login_access/login.access.5 162287 2006-09-13 18:34:32Z joel $ 3242be47eSzrj.\" 4242be47eSzrj.Dd September 13, 2006 5242be47eSzrj.Dt LOGIN.ACCESS 5 6242be47eSzrj.Os 7242be47eSzrj.Sh NAME 8242be47eSzrj.Nm login.access 9242be47eSzrj.Nd login access control table 10242be47eSzrj.Sh DESCRIPTION 11242be47eSzrjThe 12242be47eSzrj.Nm 13242be47eSzrjfile specifies (user, host) combinations and/or (user, tty) 14242be47eSzrjcombinations for which a login will be either accepted or refused. 15242be47eSzrj.Pp 16242be47eSzrjWhen someone logs in, the 17242be47eSzrj.Nm 18242be47eSzrjis scanned for the first entry that 19242be47eSzrjmatches the (user, host) combination, or, in case of non-networked 20242be47eSzrjlogins, the first entry that matches the (user, tty) combination. 21242be47eSzrjThe 22242be47eSzrjpermissions field of that table entry determines whether the login will 23242be47eSzrjbe accepted or refused. 24242be47eSzrj.Pp 25242be47eSzrjEach line of the login access control table has three fields separated by a 26242be47eSzrj.Ql \&: 27242be47eSzrjcharacter: 28242be47eSzrj.Ar permission : Ns Ar users : Ns Ar origins 29242be47eSzrj.Pp 30242be47eSzrjThe first field should be a "+" (access granted) or "-" (access denied) 31242be47eSzrjcharacter. 32242be47eSzrjThe second field should be a list of one or more login names, 33242be47eSzrjgroup names, or ALL (always matches). 34242be47eSzrjThe third field should be a list 35242be47eSzrjof one or more tty names (for non-networked logins), host names, domain 36242be47eSzrjnames (begin with "."), host addresses, internet network numbers (end 37242be47eSzrjwith "."), ALL (always matches) or LOCAL (matches any string that does 38242be47eSzrjnot contain a "." character). 39242be47eSzrjIf you run NIS you can use @netgroupname 40242be47eSzrjin host or user patterns. 41242be47eSzrj.Pp 42242be47eSzrjThe EXCEPT operator makes it possible to write very compact rules. 43242be47eSzrj.Pp 44242be47eSzrjThe group file is searched only when a name does not match that of the 45242be47eSzrjlogged-in user. 46242be47eSzrjOnly groups are matched in which users are explicitly 47242be47eSzrjlisted: the program does not look at a user's primary group id value. 48242be47eSzrj.Sh FILES 49242be47eSzrj.Bl -tag -width /etc/login.access -compact 50242be47eSzrj.It Pa /etc/login.access 51242be47eSzrjlogin access control table 52242be47eSzrj.El 53242be47eSzrj.Sh SEE ALSO 54242be47eSzrj.Xr login 1 , 55242be47eSzrj.Xr pam_login_access 8 56242be47eSzrj.Sh AUTHORS 57242be47eSzrj.An Guido van Rooij 58