diff options
-rw-r--r-- | etc/pam.conf | 56 |
1 files changed, 46 insertions, 10 deletions
diff --git a/etc/pam.conf b/etc/pam.conf index 12e6fffaa83f..932be05b9e9a 100644 --- a/etc/pam.conf +++ b/etc/pam.conf @@ -41,52 +41,84 @@ # work quite right. If you delete a final entry, be sure to change # "sufficient" to "required" in the entry before it. +login auth required pam_nologin.so +#login auth sufficient pam_kerberosIV.so #login auth sufficient pam_krb5.so -login auth required pam_unix.so try_first_pass +login auth required pam_unix.so try_first_pass +#login account required pam_kerberosIV.so #login account required pam_krb5.so login account required pam_unix.so +#login session required pam_kerberosIV.so #login session required pam_krb5.so login password required pam_permit.so login session required pam_permit.so +rsh auth required pam_nologin.so rsh auth required pam_permit.so rsh account required pam_unix.so rsh session required pam_permit.so +# "Standard" su(1) policy. +#su auth sufficient pam_kerberosIV.so #su auth sufficient pam_krb5.so -su auth required pam_unix.so try_first_pass +su auth sufficient pam_rootok.so +su auth requisite pam_wheel.so +su auth required pam_unix.so try_first_pass +#su account required pam_kerberosIV.so #su account required pam_krb5.so su account required pam_unix.so +#su session required pam_kerberosIV.so #su session required pam_krb5.so su password required pam_permit.so su session required pam_permit.so +# If you want a "WHEELSU"-type su(1), then comment out the +# above, and uncomment the below "su" entries. +##su auth sufficient pam_kerberosIV.so +##su auth sufficient pam_krb5.so +#su auth sufficient pam_rootok.so +#su auth required pam_unix.so try_first_pass auth_as_self +##su account required pam_kerberosIV.so +##su account required pam_krb5.so +#su account required pam_unix.so +##su session required pam_kerberosIV.so +##su session required pam_krb5.so +#su password required pam_permit.so +#su session required pam_permit.so + # Native ftpd. +ftpd auth required pam_nologin.so +#ftpd auth sufficient pam_kerberosIV.so #ftpd auth sufficient pam_krb5.so ftpd auth required pam_unix.so try_first_pass +#ftpd account required pam_kerberosIV.so #ftpd account required pam_krb5.so ftpd account required pam_unix.so +#ftpd session required pam_kerberosIV.so #ftpd session required pam_krb5.so # PROftpd. +ftp auth required pam_nologin.so +#ftp auth sufficient pam_kerberosIV.so #ftp auth sufficient pam_krb5.so ftp auth required pam_unix.so try_first_pass +#ftp account required pam_kerberosIV.so #ftp account required pam_krb5.so -ftp account required pam_unix.so +ftp session required pam_unix.so +#ftp session required pam_kerberosIV.so #ftp session required pam_krb5.so # OpenSSH -#sshd auth sufficient pam_krb5.so +sshd auth required pam_nologin.so sshd auth required pam_unix.so try_first_pass -#sshd account required pam_krb5.so sshd account required pam_unix.so sshd password required pam_permit.so -#sshd session required pam_krb5.so sshd session required pam_permit.so # "csshd" is for challenge-based authentication with sshd (TIS auth, etc.) -csshd auth required pam_skey.so +csshd auth required pam_opie.so # SRA telnet. Non-SRA telnet uses 'login'. +telnetd auth required pam_nologin.so telnetd auth required pam_unix.so try_first_pass telnetd account required pam_unix.so @@ -95,15 +127,19 @@ xserver auth required pam_permit.so # XDM is difficult; it fails or moans unless there are modules for each # of the four management groups; auth, account, session and password. +xdm auth required pam_nologin.so xdm auth required pam_unix.so xdm account required pam_unix.so xdm session required pam_deny.so xdm password required pam_deny.so # Mail services -#imap auth required pam_unix.so try_first_pass -#pop3 auth required pam_unix.so try_first_pass +#imap auth required pam_nologin.so +#imap auth required pam_unix.so try_first_pass +#pop3 auth required pam_nologin.so +#pop3 auth required pam_unix.so try_first_pass # If we don't match anything else, default to using getpwnam(). -other auth required pam_unix.so try_first_pass +other auth required pam_nologin.so +other auth required pam_unix.so try_first_pass other account required pam_unix.so |