1*4882a593Smuzhiyun# 2*4882a593Smuzhiyun# The PAM configuration file for the Shadow `login' service 3*4882a593Smuzhiyun# 4*4882a593Smuzhiyun 5*4882a593Smuzhiyun# Enforce a minimal delay in case of failure (in microseconds). 6*4882a593Smuzhiyun# (Replaces the `FAIL_DELAY' setting from login.defs) 7*4882a593Smuzhiyun# Note that other modules may require another minimal delay. (for example, 8*4882a593Smuzhiyun# to disable any delay, you should add the nodelay option to pam_unix) 9*4882a593Smuzhiyunauth optional pam_faildelay.so delay=3000000 10*4882a593Smuzhiyun 11*4882a593Smuzhiyun# Outputs an issue file prior to each login prompt (Replaces the 12*4882a593Smuzhiyun# ISSUE_FILE option from login.defs). Uncomment for use 13*4882a593Smuzhiyun# auth required pam_issue.so issue=/etc/issue 14*4882a593Smuzhiyun 15*4882a593Smuzhiyun# Disallows root logins except on tty's listed in /etc/securetty 16*4882a593Smuzhiyun# (Replaces the `CONSOLE' setting from login.defs) 17*4882a593Smuzhiyun# Note that it is included as a "requisite" module. No password prompts will 18*4882a593Smuzhiyun# be displayed if this module fails to avoid having the root password 19*4882a593Smuzhiyun# transmitted on unsecure ttys. 20*4882a593Smuzhiyun# You can change it to a "required" module if you think it permits to 21*4882a593Smuzhiyun# guess valid user names of your system (invalid user names are considered 22*4882a593Smuzhiyun# as possibly being root). 23*4882a593Smuzhiyunauth [success=ok ignore=ignore user_unknown=ignore default=die] pam_securetty.so 24*4882a593Smuzhiyun 25*4882a593Smuzhiyun# Disallows other than root logins when /etc/nologin exists 26*4882a593Smuzhiyun# (Replaces the `NOLOGINS_FILE' option from login.defs) 27*4882a593Smuzhiyunauth requisite pam_nologin.so 28*4882a593Smuzhiyun 29*4882a593Smuzhiyun# This module parses environment configuration file(s) 30*4882a593Smuzhiyun# and also allows you to use an extended config 31*4882a593Smuzhiyun# file /etc/security/pam_env.conf. 32*4882a593Smuzhiyun# 33*4882a593Smuzhiyun# parsing /etc/environment needs "readenv=1" 34*4882a593Smuzhiyunsession required pam_env.so readenv=1 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun# Standard Un*x authentication. 37*4882a593Smuzhiyunauth include common-auth 38*4882a593Smuzhiyun 39*4882a593Smuzhiyun# This allows certain extra groups to be granted to a user 40*4882a593Smuzhiyun# based on things like time of day, tty, service, and user. 41*4882a593Smuzhiyun# Please edit /etc/security/group.conf to fit your needs 42*4882a593Smuzhiyun# (Replaces the `CONSOLE_GROUPS' option in login.defs) 43*4882a593Smuzhiyunauth optional pam_group.so 44*4882a593Smuzhiyun 45*4882a593Smuzhiyun# Uncomment and edit /etc/security/time.conf if you need to set 46*4882a593Smuzhiyun# time restrainst on logins. 47*4882a593Smuzhiyun# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs 48*4882a593Smuzhiyun# as well as /etc/porttime) 49*4882a593Smuzhiyun# account requisite pam_time.so 50*4882a593Smuzhiyun 51*4882a593Smuzhiyun# Uncomment and edit /etc/security/access.conf if you need to 52*4882a593Smuzhiyun# set access limits. 53*4882a593Smuzhiyun# (Replaces /etc/login.access file) 54*4882a593Smuzhiyun# account required pam_access.so 55*4882a593Smuzhiyun 56*4882a593Smuzhiyun# Sets up user limits according to /etc/security/limits.conf 57*4882a593Smuzhiyun# (Replaces the use of /etc/limits in old login) 58*4882a593Smuzhiyunsession required pam_limits.so 59*4882a593Smuzhiyun 60*4882a593Smuzhiyun# Prints the last login info upon succesful login 61*4882a593Smuzhiyun# (Replaces the `LASTLOG_ENAB' option from login.defs) 62*4882a593Smuzhiyunsession optional pam_lastlog.so 63*4882a593Smuzhiyun 64*4882a593Smuzhiyun# Prints the motd upon succesful login 65*4882a593Smuzhiyun# (Replaces the `MOTD_FILE' option in login.defs) 66*4882a593Smuzhiyunsession optional pam_motd.so 67*4882a593Smuzhiyun 68*4882a593Smuzhiyun# Prints the status of the user's mailbox upon succesful login 69*4882a593Smuzhiyun# (Replaces the `MAIL_CHECK_ENAB' option from login.defs). 70*4882a593Smuzhiyun# 71*4882a593Smuzhiyun# This also defines the MAIL environment variable 72*4882a593Smuzhiyun# However, userdel also needs MAIL_DIR and MAIL_FILE variables 73*4882a593Smuzhiyun# in /etc/login.defs to make sure that removing a user 74*4882a593Smuzhiyun# also removes the user's mail spool file. 75*4882a593Smuzhiyun# See comments in /etc/login.defs 76*4882a593Smuzhiyunsession optional pam_mail.so standard 77*4882a593Smuzhiyun 78*4882a593Smuzhiyun# Standard Un*x account and session 79*4882a593Smuzhiyunaccount include common-account 80*4882a593Smuzhiyunpassword include common-password 81*4882a593Smuzhiyunsession include common-session 82