Here we need to use pam_access. Pam_access is the module used to process user access control in pam. Before pam is used, all access control for users in linux is implemented by hosts. allow, hosts. the deny file is used to implement access control for all services. In addition, usertty is used to control user login (specifically for login ). However
Here we need to use pam_access. Pam_access is the module used to process user access control in pam. Before pam is used, all access control for users in linux is implemented by hosts. allow, hosts. the deny file is used to implement access control for all services. In addition, usertty is used to control user login (specifically for login ). However
Here we need
UsePam_access. Pam_access is the processing user in pam.
Access
ControlModule, no
UseBefore pam, linux
Access
ControlAll services are implemented using the hosts. allow and hosts. deny files
Access
ControlIn addition, usertty is used to log on to the user.
Control(Specifically for login ). However, with the application of pam, usertty is no longer
UseEven though it is mentioned in the man of login.
Now let's take a look at how to use pam_access to log on to individual users.
Access
Control(For all
UseLogin is valid.) First, what we need is
Access
ControlIn/etc/security/access. conf. The format of the entire file is: permission: user (multiple users can be separated by spaces): Source
AccessPoint. The following is a brief description of each region:
Permission (permission) can be + /-. + Indicates allow
Access,-Indicates disabled
Access;
User (users): Specifies the user name, user group name, or network user group name. multiple user groups must be separated by spaces. When specifying a network user group name, the network user group name should specify the source of the user group
AccessAnd separate them with the @ and user group names. In addition, you can also use ALL to specify ALL and EXCEPT for the distinct T.
Source
AccessOrigins
AccessPoint. Users can be specified here
AccessTtyname, hostname, domainname or ip. Domainname indicates the host name starting with.. For example, .downsky.net specifies the domain downsky.net. Here you can
UseThe keyword of ALL and limit t also specifies LOCAL.
Let's take a look at some examples. If you first restrict the login permissions of some users on some hosts, we provide the login service host named linux. Next we will look at the access. conf configuration:
1. # access. conf file
2.-: ALL: .foo.com .hacker.org
3.-: ALL privileges t root: tty1
4. +: ALL privileges t root: 192.168.1.
5. +: root user: .downsky.net
6.-: chase: 192.168.2.
7.-: ALL
From the above configuration file, we can see that the second line rejects all logins from the domain name .foo.com and .hacker.org.
Access; Row 3 rejects users except root users
ControlLogin
AccessThe fourth line allows all users except the root user to log on from the network segment of 192.168.1.
Access. The fifth line allows members of the root and user groups to log on from downsky.net.
Access. Row 6 rejects login from the 192.168.2 network segment of user chase
Access, Row 7 rejects other logins
Access...
Now we only need to add the following line in the/etc/pam. d/login file
Account required/lib/security/pam_access.so
Login
UsePam_access to log on to the user
Access
Control. The entire login file is as follows:
Auth requisite/lib/security/pam_unix.so nullok # set_secrpc
Auth required/lib/security/pam_securetty.so
Auth required/lib/security/pam_nologin.so
# Auth required/lib/security/pam_homecheck.so
Auth required/lib/security/pam_env.so
Auth required/lib/security/pam_mail.so
Account required/lib/security/pam_unix.so
Account required/lib/security/pam_access.so
Password required/lib/security/pam_pwcheck.so nullok
Password required/lib/security/pam_unix.so nullok use_first_pass use_authtok
Session required/lib/security/pam_unix.so none # debug or trace
Session required/lib/security/pam_limits.so
The following output is displayed if the user is rejected to log on to the host.
Linux login: chase
Password:
Permission denied
Connection closed by foreign host.
We can also get the pam_access log from/var/log/messages. Accordingly, we get the following log from the message:
Apr 25 12:50:25 linux pam_access [13916]: access denied for user 'chas' from '192. 168.2.78'
Apr 25 12:50:25 linux login [13916]: Permission denied
