Hallo, dies ist ein Test.

PWD: /www/data-lst1/unixsoft/unixsoft/kaempfer/.public_html

Running in File Mode
Relative path: ./../../../../../../usr/man/man7/pam_unix_auth.7
Real path: /usr/share/man/man7/pam_unix_auth.7
Zurück

'\" te .\" Copyright (c) 2008, 2023, Oracle and/or its affiliates. .TH pam_unix_auth 7 "12 Sep 2023" "Oracle Solaris 11.4" "Standards, Environments, Macros, Character Sets, and miscellany" .SH NAME pam_unix_auth \- PAM authentication module for UNIX .SH SYNOPSIS .LP .nf \fBpam_unix_auth.so.1\fR [\fBdebug\fR] [\fBnolock\fR] [\fBnowarn\fR] [\fBserver_policy\fR] .fi .SH DESCRIPTION .sp .LP The \fBpam_unix_auth\fR module implements \fBpam_sm_authenticate\fR(3PAM), which provides functionality to the PAM authentication stack. It provides functions that use \fBcrypt\fR(3C) to verify that the password contained in the \fBPAM\fR item \fBPAM_AUTHTOK\fR is the correct password for the user specified in the item \fBPAM_USER\fR. .sp .LP If \fBPAM_AUSER\fR and \fBPAM_USER\fR are both specified and \fBPAM_USER\fR is a role, the \fBuser_attr\fR(5) keyword \fBroleauth\fR is checked to determine if the password that is checked is for the \fBrole\fR (\fBPAM_USER\fR) or the assuming \fBuser\fR (\fBPAM_AUSER\fR). If \fBPAM_REPOSITORY\fR is specified, the user's password is fetched from that repository. Otherwise, the default \fBnsswitch.conf\fR(5) repository is searched for that user. .sp .LP For accounts in the name services which support automatic account locking, the account can be configured to be automatically locked (see \fBuser_attr\fR(5) and \fBpolicy.conf\fR(5)) after multiple failed login attempts. For accounts that are configured for automatic locking, if authentication failure is to be returned, the failed login counter is incremented upon each failure. If the number of successive failures equals or exceeds the configured value, the account is locked and \fBPAM_MAXTRIES\fR is returned. The \fBfiles\fR (see \fBpasswd\fR(5) and \fBshadow\fR(5)) and \fBldap\fR (when configured with \fBenableShadowUpdate true\fR, see \fBldapclient\fR(8)), repositories support automatic account locking. A successful authentication by this module clears the failed login counter and reports the number of failed attempts since the last successful authentication. Accounts that have been locked may be configured to be automatically unlocked upon successful authentication by configuring an unlock time (see \fBuser_attr\fR(5) and \fBpolicy.conf\fR(5)). .sp .LP Authentication service modules must implement both \fBpam_sm_authenticate\fR(3PAM) and \fBpam_sm_setcred\fR(3PAM). To allow the authentication portion of UNIX authentication to be replaced, \fBpam_sm_setcred()\fR in this module always returns \fBPAM_IGNORE\fR. This module should be stacked with \fBpam_unix_cred\fR(7) to ensure a successful return from \fBpam_setcred\fR(3PAM). .sp .LP The following options can be passed to the module: .sp .ne 2 .mk .na \fB\fBdebug\fR\fR .ad .br .sp .6 .RS 4n \fBsyslog\fR(3C) debugging information at the \fBLOG_DEBUG\fR level. .RE .sp .ne 2 .mk .na \fB\fBnolock\fR\fR .ad .br .sp .6 .RS 4n Regardless of the automatic account locking setting for the account, do not lock the account, increment or clear the failed login count. The \fBnolock\fR option allows for exempting account locking on a per service basis. .RE .sp .ne 2 .mk .na \fB\fBnowarn\fR\fR .ad .br .sp .6 .RS 4n Turn off warning messages. .RE .sp .ne 2 .mk .na \fB\fBserver_policy\fR\fR .ad .br .sp .6 .RS 4n If the account authority for the user, as specified by \fBPAM_USER\fR, is a server, do not apply the UNIX policy from the \fBpasswd\fR entry in the name service switch. .RE .SH RETURN VALUES .sp .LP The following values are returned from \fBpam_sm_authenticate()\fR: .sp .ne 2 .mk .na \fB\fBPAM_AUTH_ERR\fR\fR .ad .br .sp .6 .RS 4n Authentication failure. .RE .sp .ne 2 .mk .na \fB\fBPAM_BUF_ERR\fR\fR .ad .br .sp .6 .RS 4n Memory buffer error. .RE .sp .ne 2 .mk .na \fB\fBPAM_IGNORE\fR\fR .ad .br .sp .6 .RS 4n Ignores module, not participating in result. .RE .sp .ne 2 .mk .na \fB\fBPAM_MAXTRIES\fR\fR .ad .br .sp .6 .RS 4n Maximum number of retries exceeded. .RE .sp .ne 2 .mk .na \fB\fBPAM_PERM_DENIED\fR\fR .ad .br .sp .6 .RS 4n Permission denied. .RE .sp .ne 2 .mk .na \fB\fBPAM_SUCCESS\fR\fR .ad .br .sp .6 .RS 4n Successfully obtains authentication token. .RE .sp .ne 2 .mk .na \fB\fBPAM_SYSTEM_ERR\fR\fR .ad .br .sp .6 .RS 4n System error. .RE .sp .ne 2 .mk .na \fB\fBPAM_USER_UNKNOWN\fR\fR .ad .br .sp .6 .RS 4n No account present for user. .RE .sp .LP The following value is returned from \fBpam_sm_setcred()\fR: .sp .ne 2 .mk .na \fB\fBPAM_IGNORE\fR\fR .ad .br .sp .6 .RS 4n Ignores this module regardless of the control flag. .RE .SH ATTRIBUTES .sp .LP See \fBattributes\fR(7) for descriptions of the following attributes: .sp .TS tab( ) box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) . ATTRIBUTE TYPE ATTRIBUTE VALUE _ Availability system/library/pam-core _ Interface Stability Committed .TE .sp .SH SEE ALSO .sp .LP \fBlogin\fR(1), \fBpasswd\fR(1), \fBcrypt\fR(3C), \fBsyslog\fR(3C), \fBlibpam\fR(3LIB), \fBpam\fR(3PAM), \fBpam_authenticate\fR(3PAM), \fBpam_setcred\fR(3PAM), \fBpam_sm_authenticate\fR(3PAM), \fBpam_sm_setcred\fR(3PAM), \fBnsswitch.conf\fR(5), \fBpam.conf\fR(5), \fBpasswd\fR(5), \fBpolicy.conf\fR(5), \fBshadow\fR(5), \fBuser_attr\fR(5), \fBattributes\fR(7), \fBpam_authtok_check\fR(7), \fBpam_authtok_get\fR(7), \fBpam_authtok_store\fR(7), \fBpam_dhkeys\fR(7), \fBpam_passwd_auth\fR(7), \fBpam_unix_account\fR(7), \fBpam_unix_cred\fR(7), \fBpam_unix_session\fR(7), \fBldapclient\fR(8), \fBroleadd\fR(8), \fBrolemod\fR(8), \fBuseradd\fR(8), \fBusermod\fR(8) .SH NOTES .sp .LP If the \fBPAM_REPOSITORY\fR \fIitem_type\fR is set and a service module does not recognize the type, the service module does not process any information, and returns \fBPAM_IGNORE\fR. If the \fBPAM_REPOSITORY\fR \fIitem_type\fR is not set, a service module performs its default action. .SH HISTORY .sp .LP Support for unlocking accounts when either the \fBUNLOCK_AFTER\fR property is set in \fBpolicy.conf\fR(5), or the \fBunlock_after\fR attribute is set in \fBuser_attr\fR(5), was added in Oracle Solaris 11.4.0. .sp .LP Support for checking the \fBroleauth\fR attribute from \fBuser_attr\fR(5) to determine if it should check for the role or user password was added in Oracle Solaris 11.0.0. .sp .LP Support for the \fBnolock\fR option and for locking accounts upon multiple failed authentication attempts was added in Solaris 10 3/05. .sp .LP Support for the \fBserver_policy\fR option was added in Solaris 10 3/05. .sp .LP The \fBpam_unix_account\fR module was introduced in Solaris 9, and later backported to patches for Solaris 8. This included support for the \fBdebug\fR and \fBnowarn\fR options. Prior to that, these checks were performed in the \fBpam_unix\fR module.