From 402c0201e31b02d3e3e8ceb11cd8953eda5ddb15 Mon Sep 17 00:00:00 2001 From: Matthijs Kooijman Date: Tue, 30 Dec 2008 11:24:58 +0100 Subject: [PATCH] pam: Add default pamd.d/{chfn,chsh,cron,login} files. --- etc/pam.d/chfn | 16 ++++++++++ etc/pam.d/chsh | 20 ++++++++++++ etc/pam.d/cron | 13 ++++++++ etc/pam.d/login | 83 +++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 132 insertions(+) create mode 100644 etc/pam.d/chfn create mode 100644 etc/pam.d/chsh create mode 100644 etc/pam.d/cron create mode 100644 etc/pam.d/login diff --git a/etc/pam.d/chfn b/etc/pam.d/chfn new file mode 100644 index 0000000..10fcf07 --- /dev/null +++ b/etc/pam.d/chfn @@ -0,0 +1,16 @@ +# +# The PAM configuration file for the Shadow `chfn' service +# + +# This allows root to change user infomation without being +# prompted for a password +auth sufficient pam_rootok.so + +# The standard Unix authentication modules, used with +# NIS (man nsswitch) as well as normal /etc/passwd and +# /etc/shadow entries. +@include common-auth +@include common-account +@include common-session + + diff --git a/etc/pam.d/chsh b/etc/pam.d/chsh new file mode 100644 index 0000000..7eb604d --- /dev/null +++ b/etc/pam.d/chsh @@ -0,0 +1,20 @@ +# +# The PAM configuration file for the Shadow `chsh' service +# + +# This will not allow a user to change their shell unless +# their current one is listed in /etc/shells. This keeps +# accounts with special shells from changing them. +auth required pam_shells.so + +# This allows root to change user shell without being +# prompted for a password +auth sufficient pam_rootok.so + +# The standard Unix authentication modules, used with +# NIS (man nsswitch) as well as normal /etc/passwd and +# /etc/shadow entries. +@include common-auth +@include common-account +@include common-session + diff --git a/etc/pam.d/cron b/etc/pam.d/cron new file mode 100644 index 0000000..2a58ec2 --- /dev/null +++ b/etc/pam.d/cron @@ -0,0 +1,13 @@ +# +# The PAM configuration file for the cron daemon +# + +@include common-auth +auth required pam_env.so +@include common-account +@include common-session +# Sets up user limits, please define limits for cron tasks +# through /etc/security/limits.conf +session required pam_limits.so + + diff --git a/etc/pam.d/login b/etc/pam.d/login new file mode 100644 index 0000000..cc8e1e4 --- /dev/null +++ b/etc/pam.d/login @@ -0,0 +1,83 @@ +# +# The PAM configuration file for the Shadow `login' service +# + +# Enforce a minimal delay in case of failure (in microseconds). +# (Replaces the `FAIL_DELAY' setting from login.defs) +# Note that other modules may require another minimal delay. (for example, +# to disable any delay, you should add the nodelay option to pam_unix) +auth optional pam_faildelay.so delay=3000000 + +# Outputs an issue file prior to each login prompt (Replaces the +# ISSUE_FILE option from login.defs). Uncomment for use +# auth required pam_issue.so issue=/etc/issue + +# Disallows root logins except on tty's listed in /etc/securetty +# (Replaces the `CONSOLE' setting from login.defs) +auth [success=ok ignore=ignore user_unknown=ignore default=die] pam_securetty.so + +# Disallows other than root logins when /etc/nologin exists +# (Replaces the `NOLOGINS_FILE' option from login.defs) +auth requisite pam_nologin.so + +# This module parses environment configuration file(s) +# and also allows you to use an extended config +# file /etc/security/pam_env.conf. +# +# parsing /etc/environment needs "readenv=1" +session required pam_env.so readenv=1 +# locale variables are also kept into /etc/default/locale in etch +# reading this file *in addition to /etc/environment* does not hurt +session required pam_env.so readenv=1 envfile=/etc/default/locale + +# Standard Un*x authentication. +@include common-auth + +# This allows certain extra groups to be granted to a user +# based on things like time of day, tty, service, and user. +# Please edit /etc/security/group.conf to fit your needs +# (Replaces the `CONSOLE_GROUPS' option in login.defs) +auth optional pam_group.so + +# Uncomment and edit /etc/security/time.conf if you need to set +# time restrainst on logins. +# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs +# as well as /etc/porttime) +# account requisite pam_time.so + +# Uncomment and edit /etc/security/access.conf if you need to +# set access limits. +# (Replaces /etc/login.access file) +# account required pam_access.so + +# Sets up user limits according to /etc/security/limits.conf +# (Replaces the use of /etc/limits in old login) +session required pam_limits.so + +# Prints the last login info upon succesful login +# (Replaces the `LASTLOG_ENAB' option from login.defs) +session optional pam_lastlog.so + +# Prints the motd upon succesful login +# (Replaces the `MOTD_FILE' option in login.defs) +session optional pam_motd.so + +# Prints the status of the user's mailbox upon succesful login +# (Replaces the `MAIL_CHECK_ENAB' option from login.defs). +# +# This also defines the MAIL environment variable +# However, userdel also needs MAIL_DIR and MAIL_FILE variables +# in /etc/login.defs to make sure that removing a user +# also removes the user's mail spool file. +# See comments in /etc/login.defs +session optional pam_mail.so standard + +# SELinux needs to intervene at login time to ensure that the process +# starts in the proper default security context. +# Uncomment the following line to enable SELinux +# session required pam_selinux.so select_context + +# Standard Un*x account and session +@include common-account +@include common-session +@include common-password -- 2.30.2