diff options
Diffstat (limited to 'static/openbsd/man5/login.conf.5')
| -rw-r--r-- | static/openbsd/man5/login.conf.5 | 948 |
1 files changed, 948 insertions, 0 deletions
diff --git a/static/openbsd/man5/login.conf.5 b/static/openbsd/man5/login.conf.5 new file mode 100644 index 00000000..f97f449d --- /dev/null +++ b/static/openbsd/man5/login.conf.5 @@ -0,0 +1,948 @@ +.\" +.\" Copyright (c) 1995,1996,1997 Berkeley Software Design, Inc. +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" 3. All advertising materials mentioning features or use of this software +.\" must display the following acknowledgement: +.\" This product includes software developed by Berkeley Software Design, +.\" Inc. +.\" 4. The name of Berkeley Software Design, Inc. may not be used to endorse +.\" or promote products derived from this software without specific prior +.\" written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY BERKELEY SOFTWARE DESIGN, INC. ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL BERKELEY SOFTWARE DESIGN, INC. BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $OpenBSD: login.conf.5,v 1.73 2025/01/26 05:47:17 semarie Exp $ +.\" BSDI $From: login.conf.5,v 2.20 2000/06/26 14:50:38 prb Exp $ +.\" +.Dd $Mdocdate: January 26 2025 $ +.Dt LOGIN.CONF 5 +.Os +.Sh NAME +.Nm login.conf +.Nd login class capability database +.Sh DESCRIPTION +The +.Nm +file describes the various attributes of login classes. +A login class determines what styles of authentication are available +as well as session resource limits and environment setup. +While designed primarily for the +.Xr login 1 +program, +it is also used by other programs, such as +.Xr ftpd 8 , +to determine what means of authentication are available. +It is also used by programs which need to set up a user environment. +.Pp +A special record, +.Dq default , +in +.Pa /etc/login.conf +is used for any user without a valid login class in +.Pa /etc/master.passwd . +.Pp +In case the +.Pa /etc/login.conf.d/${ Ns Va class Ns } +file exists, it will take precedence over the same login class +defined in +.Pa /etc/login.conf . +.Pp +Sites with very large +.Pa /etc/login.conf +files may wish to create a database version of the file, +.Pa /etc/login.conf.db , +for improved performance. +Using a database version for small files does not result in a +performance improvement. +To build +.Pa /etc/login.conf.db +from +.Pa /etc/login.conf +the following command may be used: +.Pp +.Dl # cap_mkdb /etc/login.conf +.Pp +Note that +.Xr cap_mkdb 1 +must be run after each edit of +.Pa /etc/login.conf +or the +.Pa /etc/login.conf.d/${class} +file to keep the database version in sync with the plain file. +.Sh CAPABILITIES +Refer to +.Xr cgetent 3 +for a description of the file layout. +All entries in the +.Nm +file are either boolean or use a +.Ql = +to separate the capability from the value. +The types are described after the capability table. +.Bl -column "approve-service" "program" "bcrypt,8" "Description" +.It Sy Name Ta Sy Type Ta Sy Default Ta Sy Description +.\" +.It approve Ta program Ta "" Ta +Default program to approve login. +.\" +.Pp +.It approve- Ns Ar service Ta program Ta "" Ta +Program to approve login for +.Ar service . +.\" +.Pp +.It auth Ta list Ta Dv passwd Ta +Allowed authentication styles. +The first value is the default style. +.\" +.Pp +.It auth- Ns Ar type Ta list Ta "" Ta +Allowed authentication styles for the authentication type +.Ar type . +.\" +.Pp +.It classify Ta program Ta "" Ta +Classify type of login. +.\" +.Pp +.It copyright Ta file Ta "" Ta +File containing additional copyright information. +.\" +.Pp +.It coredumpsize Ta size Ta "" Ta +Maximum coredump size limit. +.\" +.Pp +.It cputime Ta time Ta "" Ta +CPU usage limit. +.\" +.Pp +.It datasize Ta size Ta "" Ta +Maximum data size limit. +.\" +.Pp +.It expire-warn Ta time Ta Dv 2w Ta +If the user's account will expire within this length of time then +warn the user of this. +.\" +.Pp +.It filesize Ta size Ta "" Ta +Maximum file size limit. +.\" +.Pp +.It hushlogin Ta bool Ta Dv false Ta +Same as having a +.Pa $HOME/.hushlogin +file. +See +.Xr login 1 . +.\" +.Pp +.It ignorenologin Ta bool Ta Dv false Ta +Not affected by +.Pa nologin +files. +See +.Xr login 1 . +.\" +.Pp +.It localcipher Ta string Ta bcrypt,a Ta +The cipher to use for encrypting passwords. +Refer to +.Xr crypt_newhash 3 +for possible values. +.\" +.Pp +.It login-backoff Ta number Ta 3 Ta +After +.Ar login-backoff +unsuccessful login attempts during a single session, +.Xr login 1 +will start sleeping a bit in between attempts. +.\" +.Pp +.It login-timeout Ta time Ta 300 Ta +Number of seconds before +.Xr login 1 +times out at the password prompt. +Note that this setting is only valid for the +.Li default +record. +.\" +.Pp +.It login-tries Ta number Ta 10 Ta +Number of tries a user gets to successfully login before +.Xr login 1 +closes the connection. +.\" +.Pp +.It stacksize Ta size Ta "" Ta +Maximum stack size limit. +.\" +.Pp +.It maxproc Ta number Ta "" Ta +Maximum number of processes. +.\" +.Pp +.It memorylocked Ta size Ta "" Ta +Maximum locked in core memory size limit. +.\" +.Pp +.It memoryuse Ta size Ta "" Ta +Maximum in core memoryuse size limit. +.\" +.Pp +.It minpasswordlen Ta number Ta 6 Ta +The minimum length a local password may be. +If a negative value or zero, no length restrictions are enforced. +Used by the +.Xr passwd 1 +utility. +.\" +.Pp +.It nologin Ta file Ta "" Ta +If the file exists, it will be displayed +and the login session will be terminated. +.\" +.Pp +.It openfiles Ta number Ta "" Ta +Maximum number of open file descriptors per process. +.\" +.Pp +.It password-dead Ta time Ta Dv 0 Ta +Length of time a password may be expired but not quite dead yet. +When set (for both the client and remote server machine when doing +remote authentication), a user is allowed to log in just one more +time after their password (but not account) has expired. +This allows a grace period for updating their password. +.\" +.Pp +.It password-warn Ta time Ta Dv 2w Ta +If the user's password will expire within this length of time then +warn the user of this. +.\" +.Pp +.It passwordcheck Ta program Ta "" Ta +An external program that checks the quality of the password. +The password is passed to the program on +.Pa stdin . +An exit code of 0 indicates that the quality of the password is +sufficient, an exit code of 1 signals that the password failed the check. +.\" +.Pp +.It passwordtime Ta time Ta "" Ta +The lifetime of a password in seconds, reset every time a user +changes their password. +When this value is exceeded, the user will no longer be able to +login unless the +.Li password-dead +option has been specified. +Used by the +.Xr passwd 1 +utility. +.\" +.Pp +.It passwordtries Ta number Ta 3 Ta +The number of times the +.Xr passwd 1 +utility enforces a check on the password. +If 0, the new password will only be accepted if it passes the password +quality check. +.\" +.Pp +.It path Ta path Ta value of Dv _PATH_DEFPATH Ta +.br +Default search path. +See +.Pa /usr/include/paths.h . +.\" +.Pp +.It priority Ta number Ta "" Ta +Initial priority (nice) level. +.\" +.Pp +.It requirehome Ta bool Ta Dv false Ta +Require home directory to login. +.\" +.Pp +.It rtable Ta number Ta "" Ta +Rtable to be set for the class. +.\" +.Pp +.It setenv Ta envlist Ta "" Ta +A list of environment variables and associated values to be set for the class. +.\" +.Pp +.It shell Ta program Ta "" Ta +Session shell to execute rather than the shell specified in the password file. +The +.Ev SHELL +environment variable will contain the shell specified in the password file. +.\" +.Pp +.It tc Ta string Ta "" Ta +Interpolate/expands records from corresponding +.Pa login.conf . +See +.Xr cgetent 3 . +.\" +.Pp +.It term Ta string Ta Dv su Ta +Default terminal type if not able to determine from other means. +.\" +.Pp +.It umask Ta number Ta Dv 022 Ta +Initial umask. +Should always have a leading +.Li 0 +to ensure octal interpretation. +See +.Xr umask 2 . +.\" +.Pp +.It vmemoryuse Ta size Ta "" Ta +Maximum virtual memoryuse size limit. +.\" +.Pp +.It welcome Ta file Ta Pa /etc/motd Ta +File containing welcome message. +.El +.Pp +The resource limit entries +.Va ( cputime , filesize , datasize , stacksize , coredumpsize , +.Va memoryuse , memorylocked , maxproc , +and +.Va openfiles ) +actually specify both the maximum and current limits (see +.Xr getrlimit 2 ) . +The current limit is the one normally used, although the user is permitted +to increase the current limit to the maximum limit. +The maximum and current limits may be specified individually by appending a +.Va \-max +or +.Va \-cur +to the capability name (e.g., +.Va openfiles-max +and +.Va openfiles-cur ) . +.Pp +.Ox +will never define capabilities which start with +.Li x- +or +.Li X- , +these are reserved for external use (unless included through contributed +software). +.Pp +The argument types are defined as: +.Bl -tag -width programxx +.\" +.It envlist +A comma-separated list of environment variables of the form +.Ev variable Ns No = Ns value . +If no value is specified, the +.Sq = +is optional. +A +.Li ~ +in the path name is expanded to the user's home directory +if it is at the end of a string or is followed by a slash +.Pq Sq / +or the user's login name. +A +.Li $ +in the path name is expanded to the user's login name. +.\" +.It file +Path name to a text file. +.\" +.It list +A comma-separated list of values. +.\" +.It number +A number, or +.Cm infinity +for no limit. +A leading +.Li 0x +implies the number is expressed in hexadecimal. +A leading +.Li 0 +implies the number is expressed in octal. +Any other number is treated as decimal. +.\" +.It path +A space-separated list of path names. +Login name and directory are substituted as for +.Em envlist . +Additionally, a +.Li ~ +is only expanded at the beginning of a path name. +.\" +.It program +A path name to program. +.\" +.It size +A number which expresses a size, or +.Cm infinity +for no limit. +By default, the size is specified in bytes. +It may have a trailing +.Li b , +.Li k , +.Li m , +.Li g +or +.Li t +to indicate that the value is in 512-byte blocks, +kilobytes, megabytes, gigabytes, or terabytes, respectively. +.\" +.It time +A time in seconds, or +.Cm infinity +for no limit. +A time may be expressed as a series of numbers which are added together. +Each number may have a trailing character to represent time units: +.Bl -tag -width xxx +.\" +.It y +Indicates a number of 365 day years. +.\" +.It w +Indicates a number of 7 day weeks. +.\" +.It d +Indicates a number of 24 hour days. +.\" +.It h +Indicates a number of 60 minute hours. +.\" +.It m +Indicates a number of 60 second minutes. +.\" +.It s +Indicates a number of seconds. +.El +.Pp +For example, to indicate 1 and 1/2 hours, the following string could be used: +.Li 1h30m . +.El +.\" +.Sh AUTHENTICATION +.Ox +uses +.Bx +Authentication, which is made up of a variety of +authentication styles. +The authentication styles currently provided are: +.Bl -tag -width lchpassxx +.\" +.It Li activ +Authenticate using an ActivCard token. +See +.Xr login_activ 8 . +.\" +.It Li chpass +Change user's password. +See +.Xr login_chpass 8 . +.\" +.It Li crypto +Authenticate using a CRYPTOCard token. +See +.Xr login_crypto 8 . +.\" +.It Li lchpass +Change user's local password. +See +.Xr login_lchpass 8 . +.\" +.It Li ldap +Authenticate using an LDAP server. +See +.Xr login_ldap 8 . +.\" +.It Li passwd +Request a password and check it against the password in the master.passwd file. +See +.Xr login_passwd 8 . +.\" +.It Li radius +Normally linked to another authentication type, contact a RADIUS server +to do authentication. +See +.Xr login_radius 8 . +.\" +.It Li reject +Request a password and reject any request. +See +.Xr login_reject 8 . +.\" +.It Li skey +Send a challenge and request a response, checking it +with S/Key (tm) authentication. +See +.Xr login_skey 8 . +.\" +.It Li snk +Authenticate using a SecureNet Key token. +See +.Xr login_snk 8 . +.\" +.It Li token +Authenticate using a generic X9.9 token. +See +.Xr login_token 8 . +.\" +.It Li yubikey +Authenticate using a Yubico YubiKey token. +See +.Xr login_yubikey 8 . +.El +.Pp +Local authentication styles may be added by creating a login script +for the style (see below). +To prevent collisions with future official +.Bx +Authentication style names, all local style names should start with a dash (-). +Current plans are for all official +.Bx +Authentication style names to begin +with a lower case alphabetic character. +For example, if you have a new style you refer to as +.Li slick +then you should create an authentication script named +.Pa /usr/libexec/auth/login_-slick +using the style name +.Li -slick . +When logging in via the +.Xr login 1 +program, the syntax +.Ar user Ns Li :-slick +would be used. +.Pp +Authentication requires several pieces of information: +.Bl -tag -width usernamexx +.\" +.It Ar class +The login class being used. +.It Ar service +The type of service requesting authentication. +The service type is used to determine what information the authentication +program can provide to the user and what information the user can provide +to the authentication program. +.Pp +The service type +.Li login +is appropriate for most situations. +Two other service types, +.Li challenge +and +.Li response , +are provided for use by programs like +.Xr ftpd 8 +and +.Xr radiusd 8 . +If no service type is specified, +.Li login +is used. +.It Ar style +The authentication style being used. +.It Ar type +The authentication type, +used to determine the available authentication styles. +.It Ar username +The name of the user to authenticate. +The name may contain an instance. +If the authentication style being used does not support such instances, +the request will fail. +.El +.Pp +The program requesting authentication must specify a username and an +authentication style. +(For example, +.Xr login 1 +requests a username from the user. +Users may enter usernames of the form +.Dq user:style +to optionally specify the authentication style.) +The requesting program may also specify the type of authentication +that will be done. +Most programs will only have a single type, if any at all, i.e., +.Xr ftpd 8 +will always request the +.Li ftp +type authentication, and +.Xr su 1 +will always request the +.Li su +type authentication. +The +.Xr login 1 +utility is special in that it may select an authentication type based +on information found in the +.Pa /etc/ttys +file for the appropriate tty (see +.Xr ttys 5 ) . +.Pp +The class to be used is normally determined by the +.Li class +field in the password file (see +.Xr passwd 5 ) . +.Pp +The class is used to look up a corresponding entry in the +.Pa login.conf +file. +If an authentication type is defined and a value for +.Li auth- Ns Ar type +exists in that entry, +it will be used as a list of potential authentication styles. +If an authentication type is not defined, or +.Li auth- Ns Ar type +is not specified for the class, +the value of +.Li auth +is used as the list of available authentication styles. +.Pp +If the user did not specify an authentication style, the first style +in the list of available styles is used. +If the user did specify an authentication style and the style is in the +list of available styles it will be used, otherwise the request is +rejected. +.Pp +For any given style, the program +.Pa /usr/libexec/auth/login_ Ns Va style +is used to perform the authentication. +The synopsis of this program is: +.Pp +.Li /usr/libexec/auth/login_ Ns Va style +.Op Fl v Va name=value +.Op Fl s Va service +.Va username class +.Pp +The +.Fl v +option is used to specify arbitrary information to the authentication +programs. +Any number of +.Fl v +options may be used. +The +.Xr login 1 +program provides the following through the +.Fl v +option: +.Bl -tag -width remote_addrxxx +.It Li auth_type +The type of authentication to use. +.It Li fqdn +The hostname provided to login by the +.Fl h +option. +.It Li hostname +The name +.Xr login 1 +will place in the utmp file +for the remote hostname. +.It Li local_addr +The local IP address given to +.Xr login 1 +by the +.Fl L +option. +.It Li lastchance +Set to +.Dq yes +when a user's password has expired but the user is being given one last +chance to login and update the password. +.It Li login +This is a new login session (as opposed to a simple identity check). +.It Li remote_addr +The remote IP address given to +.Xr login 1 +by the +.Fl R +option. +.It Li style +The style of authentication used for this user +(see approval scripts below). +.El +.Pp +The +.Xr su 1 +program provides the following through the +.Fl v +option: +.Bl -tag -width remote_addrxxx +.It Li wheel +Set to either +.Dq yes +or +.Dq no +to indicate if the user is in group wheel when they are trying to become root. +Some authentication types require the user to be in group wheel when using +the +.Xr su 1 +program to become super user. +.El +.Pp +When the authentication program is executed, +the environment will only contain the values +.Ev PATH=/bin:/usr/bin +and +.Ev SHELL=/bin/sh . +File descriptor 3 will be open for reading and writing. +The authentication program should write one or more of the following +strings to this file descriptor: +.Bl -tag -width authorize +.\" +.It Li authorize +The user has been authorized. +.\" +.It Li authorize secure +The user has been authorized and root should be allowed to +login even if this is not a secure terminal. +This should only be sent by authentication styles that are secure +over insecure lines. +.\" +.It Li reject +Authorization is rejected. +This overrides any indication that the user was authorized (though +one would question the wisdom in sending both a +.Va reject +and an +.Va authorize +command). +.\" +.It Li reject challenge +Authorization was rejected and a challenge has been made available +via the value +.Li challenge . +.\" +.It Li reject silent +Authorization is rejected, but no error messages should be generated. +.\" +.It Li remove Va file +If the login session fails for any reason, remove +.Va file +before termination. +.\" +.It Li setenv Va name Va value +If the login session succeeds, the environment variable +.Va name +should be set to the specified +.Va value . +.\" +.It Li unsetenv Va name +If the login session succeeds, the environment variable +.Va name +should be removed. +.\" +.It Li value Va name Va value +Set the internal variable +.Va name +to the specified +.Va value . +The +.Va value +should only contain printable characters. +Several \e sequences may be used to introduce non printing characters. +These are: +.Bl -tag -width indent +.It Li \en +A newline. +.It Li \er +A carriage return. +.It Li \et +A tab. +.It Li \e Ns Va xxx +The character represented by the octal value +.Va xxx . +The value may be one, two, or three octal digits. +.It Li \e Ns Va c +The string is replaced by the value of +.Va c . +This allows quoting an initial space or the \e character itself. +.El +.Pp +The following values are currently defined: +.Bl -tag -width indent +.It Li challenge +See section on challenges below. +.It Li errormsg +If set, the value is the reason authentication failed. +The calling program may choose to display this when rejecting the user, but +display is not required. +.El +.El +.Pp +In order for authentication to be successful, +the authentication program must exit with a value of 0 as well +as provide an +.Li authorize +or +.Li "authorize root" +statement on file descriptor 3. +.Pp +An authentication program must not assume it will be called as root, +nor must it assume it will not be called as root. +If it needs special permissions to access files, it should be setuid or +setgid to the appropriate user/group. +See +.Xr chmod 1 . +.Sh CHALLENGES +When an authentication program is called with a service of +.Li challenge +it should do one of three things: +.Pp +If this style of authentication supports challenge response, +it should set the internal variable +.Li challenge +to be the appropriate challenge for the user. +This is done by the +.Li value +command listed above. +The program should also issue a +.Li reject challenge +and then exit with a 0 status. +See the section on responses below. +.Pp +If this style of authentication does not support challenge response, +but does support the +.Li response +service (described below) it should issue +.Li reject silent +and then exit with a 0 status. +.Pp +If this style of authentication does not support the +.Li response +service it should simply fail, complaining about an unknown service type. +It should exit with a non-zero status. +.Sh RESPONSES +When an authentication program is called with a service of +.Li response , +and this style supports this mode of authentication, +it should read two null terminated strings from file descriptor 3. +The first string is a challenge that was issued to the user +(obtained from the +.Li challenge +service above). +The second string is the response the user gave (i.e., the password). +If the response is correct for the specified challenge, the authentication +should be accepted, else it should be rejected. +It is possible for the challenge to be an empty string, which implies +the calling program did first obtain a challenge prior to getting a +response from the user. +Not all authentication styles support empty challenges. +.Sh APPROVAL +An approval program has the synopsis of: +.Bd -filled -offset indent +.Va approve +.Op Fl v Ar name=value +.Va username class service +.Ed +.Pp +Just as with an authentication program, file descriptor 3 will be +open for writing when the approval program is executed. +The +.Fl v +option is the same as in the authentication program. +Unlike an authentication program, +the approval program need not explicitly send an +.Li authorize +or +.Li "authorize root" +statement, +it only need exit with a value of 0 or non-zero. +An exit value of 0 is equivalent to an +.Li authorize +statement, and non-zero to a +.Li reject +statement. +This allows for simple programs which have no information to provide +other than approval or denial. +.Sh CLASSIFICATION +A classify program has the synopsis of: +.Bd -filled -offset indent +.Va classify +.Op Fl v Ar name=value +.Op Fl f +.Op user +.Ed +.Pp +See +.Xr login 1 +for a description of the +.Fl f , +option. +The +.Fl v +option is the same as for the authentication programs. +The +.Va user +is the username passed to +.Xr login 1 +login, if any. +.Pp +The typical job of the classify program is to determine what authentication +type should actually be used, presumably based on the remote IP address. +It might also re-specify the hostname to be included in the +.Xr utmp 5 +file, reject the login attempt outright, +or even print an additional login banner (e.g., +.Pa /etc/issue ) . +.Pp +The classify entry is only valid for the +.Li default +class as it is used prior to knowing who the user is. +The classify script may pass environment variables or other commands +back to +.Xr login 1 +on file descriptor 3, just as an authentication program does. +The two variables +.Nm AUTH_TYPE +and +.Nm REMOTE_NAME +are used to specify a new authentication type (the type must have the +form +.Li auth- Ns Ar type ) +and override the +.Fl h +option to login, respectively. +.Sh FILES +.Bl -tag -width "/etc/login.conf" +.It Pa /etc/login.conf +Login class capability database. +.It Pa /etc/login.conf.d/${ Ns Va class Ns } +Login class capability database for the specified +login class. +.El +.Sh SEE ALSO +.Xr cap_mkdb 1 , +.Xr login 1 , +.Xr auth_subr 3 , +.Xr authenticate 3 , +.Xr cgetent 3 , +.Xr login_cap 3 , +.Xr passwd 5 , +.Xr ttys 5 , +.Xr ftpd 8 |