FM / html

/usr/share/doc/pam/html

Name	Size	Mode	Actions
Linux-PAM_SAG.html	9196	0644	edit dl rm
sag-author.html	3111	0644	edit dl rm
sag-configuration-directory.html	2966	0644	edit dl rm
sag-configuration-example.html	5522	0644	edit dl rm
sag-configuration-file.html	17519	0644	edit dl rm
sag-configuration.html	3065	0644	edit dl rm
sag-copyright.html	3617	0644	edit dl rm
sag-introduction.html	4446	0644	edit dl rm
sag-module-reference.html	38152	0644	edit dl rm
sag-overview.html	7995	0644	edit dl rm
sag-pam_access.html	18120	0644	edit dl rm
sag-pam_cracklib.html	20271	0644	edit dl rm
sag-pam_debug.html	8087	0644	edit dl rm
sag-pam_deny.html	4704	0644	edit dl rm
sag-pam_echo.html	5752	0644	edit dl rm
sag-pam_env.html	12796	0644	edit dl rm
sag-pam_exec.html	8371	0644	edit dl rm
sag-pam_faildelay.html	4590	0644	edit dl rm
sag-pam_filter.html	9342	0644	edit dl rm
sag-pam_ftp.html	6203	0644	edit dl rm
sag-pam_group.html	10136	0644	edit dl rm
sag-pam_issue.html	6378	0644	edit dl rm
sag-pam_keyinit.html	7015	0644	edit dl rm
sag-pam_lastlog.html	8524	0644	edit dl rm
sag-pam_limits.html	18114	0644	edit dl rm
sag-pam_listfile.html	10534	0644	edit dl rm
sag-pam_localuser.html	5446	0644	edit dl rm
sag-pam_loginuid.html	5209	0644	edit dl rm
sag-pam_mail.html	7762	0644	edit dl rm
sag-pam_mkhomedir.html	6196	0644	edit dl rm
sag-pam_motd.html	7753	0644	edit dl rm
sag-pam_namespace.html	20640	0644	edit dl rm
sag-pam_nologin.html	5332	0644	edit dl rm
sag-pam_permit.html	4304	0644	edit dl rm
sag-pam_pwhistory.html	8476	0644	edit dl rm
sag-pam_rhosts.html	6404	0644	edit dl rm
sag-pam_rootok.html	5109	0644	edit dl rm
sag-pam_securetty.html	6480	0644	edit dl rm
sag-pam_selinux.html	8313	0644	edit dl rm
sag-pam_shells.html	4261	0644	edit dl rm
sag-pam_succeed_if.html	9154	0644	edit dl rm
sag-pam_time.html	9725	0644	edit dl rm
sag-pam_timestamp.html	6889	0644	edit dl rm
sag-pam_umask.html	6318	0644	edit dl rm
sag-pam_unix.html	15056	0644	edit dl rm
sag-pam_userdb.html	8585	0644	edit dl rm
sag-pam_warn.html	4569	0644	edit dl rm
sag-pam_wheel.html	7181	0644	edit dl rm
sag-pam_xauth.html	8420	0644	edit dl rm
sag-security-issues-other.html	2993	0644	edit dl rm
sag-security-issues-wrong.html	2963	0644	edit dl rm
sag-security-issues.html	2161	0644	edit dl rm
sag-see-also.html	2283	0644	edit dl rm
sag-text-conventions.html	3187	0644	edit dl rm

Edit: /usr/share/doc/pam/html/sag-pam_exec.html (8371B)

<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>6.7. pam_exec - call an external command</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="up" href="sag-module-reference.html" title="Chapter 6. A reference guide for available modules"><link rel="prev" href="sag-pam_env.html" title="6.6. pam_env - set/unset environment variables"><link rel="next" href="sag-pam_faildelay.html" title="6.8. pam_faildelay - change the delay on failure per-application"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">6.7. pam_exec - call an external command</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="sag-pam_env.html">Prev</a> </td><th width="60%" align="center">Chapter 6. A reference guide for available modules</th><td width="20%" align="right"> <a accesskey="n" href="sag-pam_faildelay.html">Next</a></td></tr></table><hr></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sag-pam_exec"></a>6.7. pam_exec - call an external command</h2></div></div></div><div class="cmdsynopsis"><p><code class="command">pam_exec.so</code>  [
	debug
      ] [
         expose_authtok
      ] [
        seteuid
      ] [
        quiet
      ] [
        stdout
      ] [
        log=<em class="replaceable"><code>file</code></em>
      ] [
        type=<em class="replaceable"><code>type</code></em>
      ]  
       <em class="replaceable"><code>command</code></em>
        [
        <em class="replaceable"><code>...</code></em>
      ]</p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_exec-description"></a>6.7.1. DESCRIPTION</h3></div></div></div><p>
      pam_exec is a PAM module that can be used to run
      an external command.
    </p><p>
     The child's environment is set to the current PAM environment list, as
     returned by
     <span class="citerefentry"><span class="refentrytitle">pam_getenvlist</span>(3)</span>
     In addition, the following PAM items are
     exported as environment variables: <span class="emphasis"><em>PAM_RHOST</em></span>,
     <span class="emphasis"><em>PAM_RUSER</em></span>, <span class="emphasis"><em>PAM_SERVICE</em></span>,
     <span class="emphasis"><em>PAM_TTY</em></span>, <span class="emphasis"><em>PAM_USER</em></span> and
     <span class="emphasis"><em>PAM_TYPE</em></span>, which contains one of the module
     types: <code class="option">account</code>, <code class="option">auth</code>,
     <code class="option">password</code>, <code class="option">open_session</code> and
     <code class="option">close_session</code>.
    </p><p>
      Commands called by pam_exec need to be aware of that the user
      can have controll over the environment.
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_exec-options"></a>6.7.2. OPTIONS</h3></div></div></div><p>
      </p><div class="variablelist"><dl class="variablelist"><dt><span class="term">
            <code class="option">debug</code>
          </span></dt><dd><p>
	      Print debug information.
            </p></dd><dt><span class="term">
            <code class="option">expose_authtok</code>
          </span></dt><dd><p>
              During authentication the calling command can read
              the password from <span class="citerefentry"><span class="refentrytitle">stdin</span>(3)</span>. Only first <span class="emphasis"><em>PAM_MAX_RESP_SIZE</em></span>
              bytes of a password are provided to the command.
            </p></dd><dt><span class="term">
            <code class="option">log=<em class="replaceable"><code>file</code></em></code>
          </span></dt><dd><p>
	      The output of the command is appended to
              <code class="filename">file</code>
            </p></dd><dt><span class="term">
            <code class="option">type=<em class="replaceable"><code>type</code></em></code>
          </span></dt><dd><p>
              Only run the command if the module type matches the given type.
            </p></dd><dt><span class="term">
            <code class="option">stdout</code>
          </span></dt><dd><p>
              Per default the output of the executed command is written to <code class="filename">/dev/null</code>. With this option, the stdout output of the executed command is redirected to the calling application. It's in the responsibility of this application what happens with the output. The <code class="option">log</code> option is ignored.
            </p></dd><dt><span class="term">
            <code class="option">quiet</code>
          </span></dt><dd><p>
              Per default pam_exec.so will echo the exit status of the
              external command if it fails.
              Specifying this option will suppress the message.
            </p></dd><dt><span class="term">
            <code class="option">seteuid</code>
          </span></dt><dd><p>
              Per default pam_exec.so will execute the external command
              with the real user ID of the calling process.
              Specifying this option means the command is run
              with the effective user ID.
            </p></dd></dl></div><p>

</p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_exec-types"></a>6.7.3. MODULE TYPES PROVIDED</h3></div></div></div><p>
      All module types (<code class="option">auth</code>, <code class="option">account</code>,
      <code class="option">password</code> and <code class="option">session</code>) are provided.
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_exec-return_values"></a>6.7.4. RETURN VALUES</h3></div></div></div><p>
      </p><div class="variablelist"><dl class="variablelist"><dt><span class="term">PAM_SUCCESS</span></dt><dd><p>
              The external command was run successfully.
            </p></dd><dt><span class="term">PAM_SERVICE_ERR</span></dt><dd><p>
	      No argument or a wrong number of arguments were given.
            </p></dd><dt><span class="term">PAM_SYSTEM_ERR</span></dt><dd><p>
	      A system error occurred or the command to execute failed.
            </p></dd><dt><span class="term">PAM_IGNORE</span></dt><dd><p>
	      <code class="function">pam_setcred</code> was called, which
	      does not execute the command.  Or, the value given for the type=
	      parameter did not match the module type.
            </p></dd></dl></div><p>
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_exec-examples"></a>6.7.5. EXAMPLES</h3></div></div></div><p>
      Add the following line to <code class="filename">/etc/pam.d/passwd</code> to
      rebuild the NIS database after each local password change:
      </p><pre class="programlisting">
        password optional pam_exec.so seteuid /usr/bin/make -C /var/yp
      </pre><p>

This will execute the command
      </p><pre class="programlisting">make -C /var/yp</pre><p>
       with effective user ID.
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_exec-author"></a>6.7.6. AUTHOR</h3></div></div></div><p>
        pam_exec was written by Thorsten Kukuk &lt;kukuk@thkukuk.de&gt; and
        Josh Triplett &lt;josh@joshtriplett.org&gt;.
      </p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="sag-pam_env.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="sag-module-reference.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="sag-pam_faildelay.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">6.6. pam_env - set/unset environment variables </td><td width="20%" align="center"><a accesskey="h" href="Linux-PAM_SAG.html">Home</a></td><td width="40%" align="right" valign="top"> 6.8. pam_faildelay - change the delay on failure per-application</td></tr></table></div></body></html>

6.7. pam_exec - call an external command

6.7. pam_exec - call an external command
Prev	Chapter 6. A reference guide for available modules	Next

6.7. pam_exec - call an external command

pam_exec.so [ debug ] [ expose_authtok ] [ seteuid ] [ quiet ] [ stdout ] [ log=file ] [ type=type ] command [ ... ]

6.7.1. DESCRIPTION

pam_exec is a PAM module that can be used to run an external command.

The child's environment is set to the current PAM environment list, as returned by pam_getenvlist(3) In addition, the following PAM items are exported as environment variables: PAM_RHOST, PAM_RUSER, PAM_SERVICE, PAM_TTY, PAM_USER and PAM_TYPE, which contains one of the module types: account, auth, password, open_session and close_session.

Commands called by pam_exec need to be aware of that the user can have controll over the environment.

6.7.2. OPTIONS

debug: Print debug information.
expose_authtok: During authentication the calling command can read the password from stdin(3). Only first PAM_MAX_RESP_SIZE bytes of a password are provided to the command.
log=file: The output of the command is appended to file
type=type: Only run the command if the module type matches the given type.
stdout: Per default the output of the executed command is written to /dev/null. With this option, the stdout output of the executed command is redirected to the calling application. It's in the responsibility of this application what happens with the output. The log option is ignored.
quiet: Per default pam_exec.so will echo the exit status of the external command if it fails. Specifying this option will suppress the message.
seteuid: Per default pam_exec.so will execute the external command with the real user ID of the calling process. Specifying this option means the command is run with the effective user ID.

6.7.3. MODULE TYPES PROVIDED

All module types (auth, account, password and session) are provided.

6.7.4. RETURN VALUES

PAM_SUCCESS: The external command was run successfully.
PAM_SERVICE_ERR: No argument or a wrong number of arguments were given.
PAM_SYSTEM_ERR: A system error occurred or the command to execute failed.
PAM_IGNORE: pam_setcred was called, which does not execute the command. Or, the value given for the type= parameter did not match the module type.

6.7.5. EXAMPLES

Add the following line to /etc/pam.d/passwd to rebuild the NIS database after each local password change:

        password optional pam_exec.so seteuid /usr/bin/make -C /var/yp

This will execute the command

make -C /var/yp

with effective user ID.

6.7.6. AUTHOR

pam_exec was written by Thorsten Kukuk <kukuk@thkukuk.de> and Josh Triplett <josh@joshtriplett.org>.

Prev	Up	Next
6.6. pam_env - set/unset environment variables	Home	6.8. pam_faildelay - change the delay on failure per-application