summaryrefslogtreecommitdiffstats
path: root/etc/pam.conf
blob: 95f57a64da781ec761d638c29a81e154d2a2aacc (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
# Configuration file for Pluggable Authentication Modules (PAM).
#
# This file controls the authentication methods that login and other
# utilities use.  See pam(8) for a description of its format.
#
# $FreeBSD$
#
# service-name	module-type	control-flag	module-path	arguments
#
# module-type:
#  auth:      prompt for a password to authenticate that the user is
#             who they say they are, and set any credentials.
#  account:   non-authentication based authorization, based on time,
#             resources, etc.
#  session:   housekeeping before and/or after login.
#  password:  update authentication tokens.
#
# control-flag: How libpam handles success or failure of the module.
#  required:   success is required, and on failure all remaining
#              modules are run.
#  requisite:  success is required, and on failure no remaining
#              modules are run.
#  sufficient: success is sufficient, and if no previous required
#              module failed, no remaining modules are run.
#  optional:   ignored unless the other modules return PAM_IGNORE.
#
# arguments:
#  Passed to the module; module-specific plus some generic ones:
#   debug:           syslog debug info.
#   no_warn:         return no warning messages to the application.
#   use_first_pass:  try authentication using password from the
#                    preceding auth module.
#   try_first_pass:  first try authentication using password from
#                    the preceding auth module, and if that fails
#                    prompt for a new password.
#   use_mapped_pass: convert cleartext password to a crypto key.
#   expose_account:  allow printing more info about the user when
#                    prompting.
#
# Each final entry must say "required" -- otherwise, things don't
# work quite right.  If you delete a final entry, be sure to change
# "sufficient" to "required" in the entry before it.

login	auth	required	pam_nologin.so
#login	auth	sufficient	pam_kerberosIV.so
#login	auth	sufficient	pam_krb5.so
login	auth	required	pam_unix.so		try_first_pass
#login	account	required	pam_kerberosIV.so
#login	account	required	pam_krb5.so
login	account	required	pam_unix.so
#login	session	required	pam_kerberosIV.so
#login	session	required	pam_krb5.so
login	password required	pam_permit.so
login	session	required	pam_permit.so

rsh	auth	required	pam_nologin.so
rsh	auth	required	pam_permit.so
rsh	account	required	pam_unix.so
rsh	session	required	pam_permit.so

# "Standard" su(1) policy.
#su	auth	sufficient	pam_kerberosIV.so
#su	auth	sufficient	pam_krb5.so
su	auth	sufficient	pam_rootok.so
su	auth	requisite	pam_wheel.so		use_uid
su	auth	required	pam_unix.so		try_first_pass nullok
#su	account	required	pam_kerberosIV.so 
#su	account	required	pam_krb5.so
su	account	required	pam_unix.so
#su	session	required	pam_kerberosIV.so
#su	session	required	pam_krb5.so
su	password required	pam_permit.so
su	session	required	pam_permit.so

# If you want a "WHEELSU"-type su(1), then comment out the
# above, and uncomment the below "su" entries.
##su	auth	sufficient	pam_kerberosIV.so
##su	auth	sufficient	pam_krb5.so
#su	auth	sufficient	pam_rootok.so
#su	auth	required	pam_unix.so		try_first_pass auth_as_self
##su	account	required	pam_kerberosIV.so
##su	account	required	pam_krb5.so
#su	account	required	pam_unix.so
##su	session	required	pam_kerberosIV.so
##su	session	required	pam_krb5.so
#su	password required	pam_permit.so
#su	session	required	pam_permit.so

# Native ftpd.
ftpd	auth	required	pam_nologin.so
#ftpd	auth	sufficient	pam_kerberosIV.so
#ftpd	auth	sufficient	pam_krb5.so
ftpd	auth	required	pam_unix.so			try_first_pass
#ftpd	account	required	pam_kerberosIV.so
#ftpd	account	required	pam_krb5.so
ftpd	account	required	pam_unix.so
#ftpd	session	required	pam_kerberosIV.so
#ftpd	session	required	pam_krb5.so

# PROftpd.
ftp	auth	required	pam_nologin.so
#ftp	auth	sufficient	pam_kerberosIV.so
#ftp	auth	sufficient	pam_krb5.so
ftp	auth	required	pam_unix.so			try_first_pass
#ftp	account	required	pam_kerberosIV.so
#ftp	account	required	pam_krb5.so
ftp	session	required	pam_unix.so
#ftp	session	required	pam_kerberosIV.so
#ftp	session	required	pam_krb5.so

# OpenSSH
sshd	auth	required	pam_nologin.so
sshd	auth	required	pam_unix.so			try_first_pass
sshd	account	required	pam_unix.so
sshd	password required	pam_permit.so
sshd	session	required	pam_permit.so
# "csshd" is for challenge-based authentication with sshd (TIS auth, etc.)
csshd	auth	required	pam_opie.so

# SRA telnet. Non-SRA telnet uses 'login'.
telnetd	auth	required	pam_nologin.so
telnetd	auth	required	pam_unix.so			try_first_pass
telnetd	account	required	pam_unix.so

# Don't break startx
xserver	auth	required	pam_permit.so

# XDM is difficult; it fails or moans unless there are modules for each
# of the four management groups; auth, account, session and password.
xdm	auth	required	pam_nologin.so
xdm	auth	required	pam_unix.so
xdm	account	required	pam_unix.so
xdm	session	required	pam_deny.so
xdm	password required	pam_deny.so

# Mail services
#imap	auth	required	pam_nologin.so
#imap	auth	required	pam_unix.so		try_first_pass
#pop3	auth	required	pam_nologin.so
#pop3	auth	required	pam_unix.so		try_first_pass

# If we don't match anything else, default to using getpwnam().
other	auth	required	pam_nologin.so
other	auth	required	pam_unix.so		try_first_pass
other	account	required	pam_unix.so
OpenPOWER on IntegriCloud