FM / html

/usr/share/doc/pam/html

Name	Size	Mode	Actions
Linux-PAM_SAG.html	9196	0644	edit dl rm
sag-author.html	3111	0644	edit dl rm
sag-configuration-directory.html	2966	0644	edit dl rm
sag-configuration-example.html	5522	0644	edit dl rm
sag-configuration-file.html	17519	0644	edit dl rm
sag-configuration.html	3065	0644	edit dl rm
sag-copyright.html	3617	0644	edit dl rm
sag-introduction.html	4446	0644	edit dl rm
sag-module-reference.html	38152	0644	edit dl rm
sag-overview.html	7995	0644	edit dl rm
sag-pam_access.html	18120	0644	edit dl rm
sag-pam_cracklib.html	20271	0644	edit dl rm
sag-pam_debug.html	8087	0644	edit dl rm
sag-pam_deny.html	4704	0644	edit dl rm
sag-pam_echo.html	5752	0644	edit dl rm
sag-pam_env.html	12796	0644	edit dl rm
sag-pam_exec.html	8371	0644	edit dl rm
sag-pam_faildelay.html	4590	0644	edit dl rm
sag-pam_filter.html	9342	0644	edit dl rm
sag-pam_ftp.html	6203	0644	edit dl rm
sag-pam_group.html	10136	0644	edit dl rm
sag-pam_issue.html	6378	0644	edit dl rm
sag-pam_keyinit.html	7015	0644	edit dl rm
sag-pam_lastlog.html	8524	0644	edit dl rm
sag-pam_limits.html	18114	0644	edit dl rm
sag-pam_listfile.html	10534	0644	edit dl rm
sag-pam_localuser.html	5446	0644	edit dl rm
sag-pam_loginuid.html	5209	0644	edit dl rm
sag-pam_mail.html	7762	0644	edit dl rm
sag-pam_mkhomedir.html	6196	0644	edit dl rm
sag-pam_motd.html	7753	0644	edit dl rm
sag-pam_namespace.html	20640	0644	edit dl rm
sag-pam_nologin.html	5332	0644	edit dl rm
sag-pam_permit.html	4304	0644	edit dl rm
sag-pam_pwhistory.html	8476	0644	edit dl rm
sag-pam_rhosts.html	6404	0644	edit dl rm
sag-pam_rootok.html	5109	0644	edit dl rm
sag-pam_securetty.html	6480	0644	edit dl rm
sag-pam_selinux.html	8313	0644	edit dl rm
sag-pam_shells.html	4261	0644	edit dl rm
sag-pam_succeed_if.html	9154	0644	edit dl rm
sag-pam_time.html	9725	0644	edit dl rm
sag-pam_timestamp.html	6889	0644	edit dl rm
sag-pam_umask.html	6318	0644	edit dl rm
sag-pam_unix.html	15056	0644	edit dl rm
sag-pam_userdb.html	8585	0644	edit dl rm
sag-pam_warn.html	4569	0644	edit dl rm
sag-pam_wheel.html	7181	0644	edit dl rm
sag-pam_xauth.html	8420	0644	edit dl rm
sag-security-issues-other.html	2993	0644	edit dl rm
sag-security-issues-wrong.html	2963	0644	edit dl rm
sag-security-issues.html	2161	0644	edit dl rm
sag-see-also.html	2283	0644	edit dl rm
sag-text-conventions.html	3187	0644	edit dl rm

Edit: /usr/share/doc/pam/html/sag-pam_wheel.html (7181B)

<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>6.40. pam_wheel - only permit root access to members of group wheel</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="Linux-PAM_SAG.html" title="The Linux-PAM System Administrators' Guide"><link rel="up" href="sag-module-reference.html" title="Chapter 6. A reference guide for available modules"><link rel="prev" href="sag-pam_warn.html" title="6.39. pam_warn - logs all PAM items"><link rel="next" href="sag-pam_xauth.html" title="6.41. pam_xauth - forward xauth keys between users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">6.40. pam_wheel - only permit root access to members of group wheel</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="sag-pam_warn.html">Prev</a> </td><th width="60%" align="center">Chapter 6. A reference guide for available modules</th><td width="20%" align="right"> <a accesskey="n" href="sag-pam_xauth.html">Next</a></td></tr></table><hr></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sag-pam_wheel"></a>6.40. pam_wheel - only permit root access to members of group wheel</h2></div></div></div><div class="cmdsynopsis"><p><code class="command">pam_wheel.so</code>  [
	debug
      ] [
        deny
      ] [
	group=<em class="replaceable"><code>name</code></em>
      ] [
	root_only
      ] [
	trust
      ] [
	use_uid
      ]</p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_wheel-description"></a>6.40.1. DESCRIPTION</h3></div></div></div><p>
      The pam_wheel PAM module is used to enforce the so-called
      <span class="emphasis"><em>wheel</em></span> group. By default it permits root
      access to the system if the applicant user is a member of the
      <span class="emphasis"><em>wheel</em></span> group. If no group with this name exist,
      the module is using the group with the group-ID
      <span class="emphasis"><em>0</em></span>.
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_wheel-options"></a>6.40.2. OPTIONS</h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt><span class="term">
          <code class="option">debug</code>
        </span></dt><dd><p>
            Print debug information.
          </p></dd><dt><span class="term">
          <code class="option">deny</code>
        </span></dt><dd><p>
            Reverse the sense of the auth operation: if the user
            is trying to get UID 0 access and is a member of the
            wheel group (or the group of the <code class="option">group</code> option),
            deny access. Conversely, if the user is not in the group, return
            PAM_IGNORE (unless <code class="option">trust</code> was also specified,
            in which case we return PAM_SUCCESS).
          </p></dd><dt><span class="term">
          <code class="option">group=<em class="replaceable"><code>name</code></em></code>
        </span></dt><dd><p>
            Instead of checking the wheel or GID 0 groups, use
            the <code class="option"><em class="replaceable"><code>name</code></em></code> group
            to perform the authentication.
          </p></dd><dt><span class="term">
          <code class="option">root_only</code>
        </span></dt><dd><p>
            The check for wheel membership is done only when the target user
            UID is 0.
          </p></dd><dt><span class="term">
          <code class="option">trust</code>
        </span></dt><dd><p>
            The pam_wheel module will return PAM_SUCCESS instead
            of PAM_IGNORE if the user is a member of the wheel group
            (thus with a little play stacking the modules the wheel
            members may be able to su to root without being prompted
            for a passwd).
          </p></dd><dt><span class="term">
          <code class="option">use_uid</code>
        </span></dt><dd><p>
            The check will be done against the real uid of the calling process,
            instead of trying to obtain the user from the login session
            associated with the terminal in use.
          </p></dd></dl></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_wheel-types"></a>6.40.3. MODULE TYPES PROVIDED</h3></div></div></div><p>
      The <span class="emphasis"><em>auth</em></span> and
      <span class="emphasis"><em>account</em></span> module types are provided.
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_wheel-return_values"></a>6.40.4. RETURN VALUES</h3></div></div></div><div class="variablelist"><dl class="variablelist"><dt><span class="term">PAM_AUTH_ERR</span></dt><dd><p>
             Authentication failure.
          </p></dd><dt><span class="term">PAM_BUF_ERR</span></dt><dd><p>
             Memory buffer error.
          </p></dd><dt><span class="term">PAM_IGNORE</span></dt><dd><p>
            The return value should be ignored by PAM dispatch.
          </p></dd><dt><span class="term">PAM_PERM_DENY</span></dt><dd><p>
            Permission denied.
          </p></dd><dt><span class="term">PAM_SERVICE_ERR</span></dt><dd><p>
	    Cannot determine the user name.
          </p></dd><dt><span class="term">PAM_SUCCESS</span></dt><dd><p>
            Success.
          </p></dd><dt><span class="term">PAM_USER_UNKNOWN</span></dt><dd><p>
            User not known.
          </p></dd></dl></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_wheel-examples"></a>6.40.5. EXAMPLES</h3></div></div></div><p>
      The root account gains access by default (rootok), only wheel
      members can become root (wheel) but Unix authenticate non-root
      applicants.
      </p><pre class="programlisting">
su      auth     sufficient     pam_rootok.so
su      auth     required       pam_wheel.so
su      auth     required       pam_unix.so
      </pre><p>
    </p></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="sag-pam_wheel-author"></a>6.40.6. AUTHOR</h3></div></div></div><p>
        pam_wheel was written by Cristian Gafton &lt;gafton@redhat.com&gt;.
      </p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="sag-pam_warn.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="sag-module-reference.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="sag-pam_xauth.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">6.39. pam_warn - logs all PAM items </td><td width="20%" align="center"><a accesskey="h" href="Linux-PAM_SAG.html">Home</a></td><td width="40%" align="right" valign="top"> 6.41. pam_xauth - forward xauth keys between users</td></tr></table></div></body></html>

6.40. pam_wheel - only permit root access to members of group wheel

6.40. pam_wheel - only permit root access to members of group wheel
Prev	Chapter 6. A reference guide for available modules	Next

6.40. pam_wheel - only permit root access to members of group wheel

pam_wheel.so [ debug ] [ deny ] [ group=name ] [ root_only ] [ trust ] [ use_uid ]

6.40.1. DESCRIPTION

The pam_wheel PAM module is used to enforce the so-called wheel group. By default it permits root access to the system if the applicant user is a member of the wheel group. If no group with this name exist, the module is using the group with the group-ID 0.

6.40.2. OPTIONS

debug: Print debug information.
deny: Reverse the sense of the auth operation: if the user is trying to get UID 0 access and is a member of the wheel group (or the group of the group option), deny access. Conversely, if the user is not in the group, return PAM_IGNORE (unless trust was also specified, in which case we return PAM_SUCCESS).
group=name: Instead of checking the wheel or GID 0 groups, use the name group to perform the authentication.
root_only: The check for wheel membership is done only when the target user UID is 0.
trust: The pam_wheel module will return PAM_SUCCESS instead of PAM_IGNORE if the user is a member of the wheel group (thus with a little play stacking the modules the wheel members may be able to su to root without being prompted for a passwd).
use_uid: The check will be done against the real uid of the calling process, instead of trying to obtain the user from the login session associated with the terminal in use.

6.40.3. MODULE TYPES PROVIDED

The auth and account module types are provided.

6.40.4. RETURN VALUES

PAM_AUTH_ERR: Authentication failure.
PAM_BUF_ERR: Memory buffer error.
PAM_IGNORE: The return value should be ignored by PAM dispatch.
PAM_PERM_DENY: Permission denied.
PAM_SERVICE_ERR: Cannot determine the user name.
PAM_SUCCESS: Success.
PAM_USER_UNKNOWN: User not known.

6.40.5. EXAMPLES

The root account gains access by default (rootok), only wheel members can become root (wheel) but Unix authenticate non-root applicants.

su      auth     sufficient     pam_rootok.so
su      auth     required       pam_wheel.so
su      auth     required       pam_unix.so

6.40.6. AUTHOR

pam_wheel was written by Cristian Gafton <gafton@redhat.com>.

Prev	Up	Next
6.39. pam_warn - logs all PAM items	Home	6.41. pam_xauth - forward xauth keys between users