diff options
author | Thorsten Kukuk <kukuk@thkukuk.de> | 2008-01-08 12:44:15 +0000 |
---|---|---|
committer | Thorsten Kukuk <kukuk@thkukuk.de> | 2008-01-08 12:44:15 +0000 |
commit | d48c90b14254794fcad9ccc37873a8c663cce02d (patch) | |
tree | 62e42b3fd242091e7fab171d1b816586c09e743c /modules/pam_unix/README | |
parent | 1f802e15b36f0ca69dc4127a9332983acfd70117 (diff) | |
download | pam-d48c90b14254794fcad9ccc37873a8c663cce02d.tar.gz pam-d48c90b14254794fcad9ccc37873a8c663cce02d.tar.bz2 pam-d48c90b14254794fcad9ccc37873a8c663cce02d.zip |
Relevant BUGIDs:
Purpose of commit: cleanup
Commit summary:
---------------
Remove autogenerated documentation from CVS
Diffstat (limited to 'modules/pam_unix/README')
-rw-r--r-- | modules/pam_unix/README | 142 |
1 files changed, 0 insertions, 142 deletions
diff --git a/modules/pam_unix/README b/modules/pam_unix/README deleted file mode 100644 index 3421eb31..00000000 --- a/modules/pam_unix/README +++ /dev/null @@ -1,142 +0,0 @@ -pam_unix — Module for traditional password authentication - -━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ - -DESCRIPTION - -This is the standard Unix authentication module. It uses standard calls from -the system's libraries to retrieve and set account information as well as -authentication. Usually this is obtained from the /etc/passwd and the /etc/ -shadow file as well if shadow is enabled. - -The account component performs the task of establishing the status of the -user's account and password based on the following shadow elements: expire, -last_change, max_change, min_change, warn_change. In the case of the latter, it -may offer advice to the user on changing their password or, through the -PAM_AUTHTOKEN_REQD return, delay giving service to the user until they have -established a new password. The entries listed above are documented in the -shadow(5) manual page. Should the user's record not contain one or more of -these entries, the corresponding shadow check is not performed. - -The authentication component performs the task of checking the users -credentials (password). The default action of this module is to not permit the -user access to a service if their official password is blank. - -A helper binary, unix_chkpwd(8), is provided to check the user's password when -it is stored in a read protected database. This binary is very simple and will -only check the password of the user invoking it. It is called transparently on -behalf of the user by the authenticating component of this module. In this way -it is possible for applications like xlock(1) to work without being -setuid-root. The module, by default, will temporarily turn off SIGCHLD handling -for the duration of execution of the helper binary. This is generally the right -thing to do, as many applications are not prepared to handle this signal from a -child they didn't know was fork()d. The noreap module argument can be used to -suppress this temporary shielding and may be needed for use with certain -applications. - -The password component of this module performs the task of updating the user's -password. - -The session component of this module logs when a user logins or leave the -system. - -Remaining arguments, supported by others functions of this module, are silently -ignored. Other arguments are logged as errors through syslog(3). - -OPTIONS - -debug - - Turns on debugging via syslog(3). - -audit - - A little more extreme than debug. - -nullok - - The default action of this module is to not permit the user access to a - service if their official password is blank. The nullok argument overrides - this default. - -try_first_pass - - Before prompting the user for their password, the module first tries the - previous stacked module's password in case that satisfies this module as - well. - -use_first_pass - - The argument use_first_pass forces the module to use a previous stacked - modules password and will never prompt the user - if no password is - available or the password is not appropriate, the user will be denied - access. - -nodelay - - This argument can be used to discourage the authentication component from - requesting a delay should the authentication as a whole fail. The default - action is for the module to request a delay-on-failure of the order of two - second. - -use_authtok - - When password changing enforce the module to set the new password to the - one provided by a previously stacked password module (this is used in the - example of the stacking of the pam_cracklib module documented above). - -not_set_pass - - This argument is used to inform the module that it is not to pay attention - to/make available the old or new passwords from/to other (stacked) password - modules. - -nis - - NIS RPC is used for setting new passwords. - -remember=n - - The last n passwords for each user are saved in /etc/security/opasswd in - order to force password change history and keep the user from alternating - between the same password too frequently. - -shadow - - Try to maintain a shadow based system. - -md5 - - When a user changes their password next, encrypt it with the MD5 algorithm. - -bigcrypt - - When a user changes their password next, encrypt it with the DEC C2 - algorithm. - -broken_shadow - - Ignore errors reading shadow inforation for users in the account management - module. - -Invalid arguments are logged with syslog(3). - -EXAMPLES - -An example usage for /etc/pam.d/login would be: - -# Authenticate the user -auth required pam_unix.so -# Ensure users account and password are still active -account required pam_unix.so -# Change the users password, but at first check the strength -# with pam_cracklib(8) -password required pam_cracklib.so retry=3 minlen=6 difok=3 -password required pam_unix.so use_authtok nullok md5 -session required pam_unix.so - - -AUTHOR - -pam_unix was written by various people. - |