FM / html

/usr/share/doc/pam/html

Name	Size	Mode	Actions
Linux-PAM_SAG.html	9196	0644	edit dl rm
sag-author.html	3111	0644	edit dl rm
sag-configuration-directory.html	2966	0644	edit dl rm
sag-configuration-example.html	5522	0644	edit dl rm
sag-configuration-file.html	17519	0644	edit dl rm
sag-configuration.html	3065	0644	edit dl rm
sag-copyright.html	3617	0644	edit dl rm
sag-introduction.html	4446	0644	edit dl rm
sag-module-reference.html	38152	0644	edit dl rm
sag-overview.html	7995	0644	edit dl rm
sag-pam_access.html	18120	0644	edit dl rm
sag-pam_cracklib.html	20271	0644	edit dl rm
sag-pam_debug.html	8087	0644	edit dl rm
sag-pam_deny.html	4704	0644	edit dl rm
sag-pam_echo.html	5752	0644	edit dl rm
sag-pam_env.html	12796	0644	edit dl rm
sag-pam_exec.html	8371	0644	edit dl rm
sag-pam_faildelay.html	4590	0644	edit dl rm
sag-pam_filter.html	9342	0644	edit dl rm
sag-pam_ftp.html	6203	0644	edit dl rm
sag-pam_group.html	10136	0644	edit dl rm
sag-pam_issue.html	6378	0644	edit dl rm
sag-pam_keyinit.html	7015	0644	edit dl rm
sag-pam_lastlog.html	8524	0644	edit dl rm
sag-pam_limits.html	18114	0644	edit dl rm
sag-pam_listfile.html	10534	0644	edit dl rm
sag-pam_localuser.html	5446	0644	edit dl rm
sag-pam_loginuid.html	5209	0644	edit dl rm
sag-pam_mail.html	7762	0644	edit dl rm
sag-pam_mkhomedir.html	6196	0644	edit dl rm
sag-pam_motd.html	7753	0644	edit dl rm
sag-pam_namespace.html	20640	0644	edit dl rm
sag-pam_nologin.html	5332	0644	edit dl rm
sag-pam_permit.html	4304	0644	edit dl rm
sag-pam_pwhistory.html	8476	0644	edit dl rm
sag-pam_rhosts.html	6404	0644	edit dl rm
sag-pam_rootok.html	5109	0644	edit dl rm
sag-pam_securetty.html	6480	0644	edit dl rm
sag-pam_selinux.html	8313	0644	edit dl rm
sag-pam_shells.html	4261	0644	edit dl rm
sag-pam_succeed_if.html	9154	0644	edit dl rm
sag-pam_time.html	9725	0644	edit dl rm
sag-pam_timestamp.html	6889	0644	edit dl rm
sag-pam_umask.html	6318	0644	edit dl rm
sag-pam_unix.html	15056	0644	edit dl rm
sag-pam_userdb.html	8585	0644	edit dl rm
sag-pam_warn.html	4569	0644	edit dl rm
sag-pam_wheel.html	7181	0644	edit dl rm
sag-pam_xauth.html	8420	0644	edit dl rm
sag-security-issues-other.html	2993	0644	edit dl rm
sag-security-issues-wrong.html	2963	0644	edit dl rm
sag-security-issues.html	2161	0644	edit dl rm
sag-see-also.html	2283	0644	edit dl rm
sag-text-conventions.html	3187	0644	edit dl rm

Edit: /usr/share/doc/pam/html/sag-pam_succeed_if.html (9154B)

<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>6.31. pam_succeed_if - test account characteristics</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="up" href="sag-module-reference.html" title="Chapter 6. A reference guide for available modules"><link rel="prev" href="sag-pam_shells.html" title="6.30. pam_shells - check for valid login shell"><link rel="next" href="sag-pam_tally.html" title="6.32. pam_tally - login counter (tallying) module"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">6.31. pam_succeed_if - test account characteristics</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="sag-pam_shells.html">Prev</a> </td><th width="60%" align="center">Chapter 6. A reference guide for available modules</th><td width="20%" align="right"> <a accesskey="n" href="sag-pam_tally.html">Next</a></td></tr></table><hr></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sag-pam_succeed_if"></a>6.31. pam_succeed_if - test account characteristics</h2></div></div></div><div class="cmdsynopsis"><p><code class="command">pam_succeed_if.so</code>  [<em class="replaceable"><code>flag</code></em>...] [<em class="replaceable"><code>condition</code></em>...]</p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_succeed_if-description"></a>6.31.1. DESCRIPTION</h3></div></div></div><p>
      pam_succeed_if.so is designed to succeed or fail authentication
      based on characteristics of the account belonging to the user being
      authenticated or values of other PAM items. One use is to select whether
      to load other modules based on this test.
    </p><p>
      The module should be given one or more conditions as module arguments,
      and authentication will succeed only if all of the conditions are met.
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_succeed_if-options"></a>6.31.2. OPTIONS</h3></div></div></div><p>
      The following <span class="emphasis"><em>flag</em></span>s are supported:
    </p><div class="variablelist"><dl class="variablelist"><dt><span class="term"><code class="option">debug</code></span></dt><dd><p>Turns on debugging messages sent to syslog.</p></dd><dt><span class="term"><code class="option">use_uid</code></span></dt><dd><p>
            Evaluate conditions using the account of the user whose UID
            the application is running under instead of the user being
            authenticated.
          </p></dd><dt><span class="term"><code class="option">quiet</code></span></dt><dd><p>Don't log failure or success to the system log.</p></dd><dt><span class="term"><code class="option">quiet_fail</code></span></dt><dd><p>
            Don't log failure to the system log.
          </p></dd><dt><span class="term"><code class="option">quiet_success</code></span></dt><dd><p>
            Don't log success to the system log.
          </p></dd><dt><span class="term"><code class="option">audit</code></span></dt><dd><p>
            Log unknown users to the system log.
          </p></dd></dl></div><p>
      <span class="emphasis"><em>Condition</em></span>s are three words: a field, a test,
      and a value to test for.
    </p><p>
      Available fields are <span class="emphasis"><em>user</em></span>,
      <span class="emphasis"><em>uid</em></span>, <span class="emphasis"><em>gid</em></span>,
      <span class="emphasis"><em>shell</em></span>, <span class="emphasis"><em>home</em></span>,
      <span class="emphasis"><em>ruser</em></span>, <span class="emphasis"><em>rhost</em></span>,
      <span class="emphasis"><em>tty</em></span> and <span class="emphasis"><em>service</em></span>:
    </p><div class="variablelist"><dl class="variablelist"><dt><span class="term"><code class="option">field &lt; number</code></span></dt><dd><p>Field has a value numerically less than number.</p></dd><dt><span class="term"><code class="option">field &lt;= number</code></span></dt><dd><p>
            Field has a value numerically less than or equal to number.
          </p></dd><dt><span class="term"><code class="option">field eq number</code></span></dt><dd><p>
            Field has a value numerically equal to number.
          </p></dd><dt><span class="term"><code class="option">field &gt;= number</code></span></dt><dd><p>
            Field has a value numerically greater than or equal to number.
          </p></dd><dt><span class="term"><code class="option">field &gt; number</code></span></dt><dd><p>
            Field has a value numerically greater than number.
          </p></dd><dt><span class="term"><code class="option">field ne number</code></span></dt><dd><p>
            Field has a value numerically different from number.
          </p></dd><dt><span class="term"><code class="option">field = string</code></span></dt><dd><p>
            Field exactly matches the given string.
          </p></dd><dt><span class="term"><code class="option">field != string</code></span></dt><dd><p>
            Field does not match the given string.
          </p></dd><dt><span class="term"><code class="option">field =~ glob</code></span></dt><dd><p>Field matches the given glob.</p></dd><dt><span class="term"><code class="option">field !~ glob</code></span></dt><dd><p>Field does not match the given glob.</p></dd><dt><span class="term"><code class="option">field in item:item:...</code></span></dt><dd><p>Field is contained in the list of items separated by colons.</p></dd><dt><span class="term"><code class="option">field notin item:item:...</code></span></dt><dd><p>Field is not contained in the list of items separated by colons.</p></dd><dt><span class="term"><code class="option">user ingroup group</code></span></dt><dd><p>User is in given group.</p></dd><dt><span class="term"><code class="option">user notingroup group</code></span></dt><dd><p>User is not in given group.</p></dd><dt><span class="term"><code class="option">user innetgr netgroup</code></span></dt><dd><p>(user,host) is in given netgroup.</p></dd><dt><span class="term"><code class="option">user notinnetgr group</code></span></dt><dd><p>(user,host) is not in given netgroup.</p></dd></dl></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_succeed_if-types"></a>6.31.3. MODULE TYPES PROVIDED</h3></div></div></div><p>
      All module types (<code class="option">account</code>, <code class="option">auth</code>,
      <code class="option">password</code> and <code class="option">session</code>) are provided.
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_succeed_if-return_values"></a>6.31.4. RETURN VALUES</h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt><span class="term">PAM_SUCCESS</span></dt><dd><p>
              The condition was true.
            </p></dd><dt><span class="term">PAM_AUTH_ERR</span></dt><dd><p>
              The condition was false.
            </p></dd><dt><span class="term">PAM_SERVICE_ERR</span></dt><dd><p>
              A service error occurred or the arguments can't be
              parsed correctly.
            </p></dd></dl></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_succeed_if-examples"></a>6.31.5. EXAMPLES</h3></div></div></div><p>
      To emulate the behaviour of <span class="emphasis"><em>pam_wheel</em></span>, except
      there is no fallback to group 0:
    </p><pre class="programlisting">
auth required pam_succeed_if.so quiet user ingroup wheel
    </pre><p>
      Given that the type matches, only loads the othermodule rule if
      the UID is over 500. Adjust the number after default to skip
      several rules.
    </p><pre class="programlisting">
type [default=1 success=ignore] pam_succeed_if.so quiet uid &gt; 500
type required othermodule.so arguments...
    </pre></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_succeed_if-author"></a>6.31.6. AUTHOR</h3></div></div></div><p>Nalin Dahyabhai &lt;nalin@redhat.com&gt;</p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="sag-pam_shells.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="sag-module-reference.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="sag-pam_tally.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">6.30. pam_shells - check for valid login shell </td><td width="20%" align="center"><a accesskey="h" href="Linux-PAM_SAG.html">Home</a></td><td width="40%" align="right" valign="top"> 6.32. pam_tally - login counter (tallying) module</td></tr></table></div></body></html>

6.31. pam_succeed_if - test account characteristics

6.31. pam_succeed_if - test account characteristics
Prev	Chapter 6. A reference guide for available modules	Next

6.31. pam_succeed_if - test account characteristics

pam_succeed_if.so [flag...] [condition...]

6.31.1. DESCRIPTION

pam_succeed_if.so is designed to succeed or fail authentication based on characteristics of the account belonging to the user being authenticated or values of other PAM items. One use is to select whether to load other modules based on this test.

The module should be given one or more conditions as module arguments, and authentication will succeed only if all of the conditions are met.

6.31.2. OPTIONS

The following flags are supported:

debug: Turns on debugging messages sent to syslog.
use_uid: Evaluate conditions using the account of the user whose UID the application is running under instead of the user being authenticated.
quiet: Don't log failure or success to the system log.
quiet_fail: Don't log failure to the system log.
quiet_success: Don't log success to the system log.
audit: Log unknown users to the system log.

Conditions are three words: a field, a test, and a value to test for.

Available fields are user, uid, gid, shell, home, ruser, rhost, tty and service:

field < number: Field has a value numerically less than number.
field <= number: Field has a value numerically less than or equal to number.
field eq number: Field has a value numerically equal to number.
field >= number: Field has a value numerically greater than or equal to number.
field > number: Field has a value numerically greater than number.
field ne number: Field has a value numerically different from number.
field = string: Field exactly matches the given string.
field != string: Field does not match the given string.
field =~ glob: Field matches the given glob.
field !~ glob: Field does not match the given glob.
field in item:item:...: Field is contained in the list of items separated by colons.
field notin item:item:...: Field is not contained in the list of items separated by colons.
user ingroup group: User is in given group.
user notingroup group: User is not in given group.
user innetgr netgroup: (user,host) is in given netgroup.
user notinnetgr group: (user,host) is not in given netgroup.

6.31.3. MODULE TYPES PROVIDED

All module types (account, auth, password and session) are provided.

6.31.4. RETURN VALUES

PAM_SUCCESS: The condition was true.
PAM_AUTH_ERR: The condition was false.
PAM_SERVICE_ERR: A service error occurred or the arguments can't be parsed correctly.

6.31.5. EXAMPLES

To emulate the behaviour of pam_wheel, except there is no fallback to group 0:

auth required pam_succeed_if.so quiet user ingroup wheel

Given that the type matches, only loads the othermodule rule if the UID is over 500. Adjust the number after default to skip several rules.

type [default=1 success=ignore] pam_succeed_if.so quiet uid > 500
type required othermodule.so arguments...

6.31.6. AUTHOR

Nalin Dahyabhai <nalin@redhat.com>

Prev	Up	Next
6.30. pam_shells - check for valid login shell	Home	6.32. pam_tally - login counter (tallying) module