head	1.10;
access;
symbols
	cjep_sun2x:1.10.0.16
	cjep_sun2x-base:1.10
	cjep_staticlib_x-base1:1.10
	cjep_staticlib_x:1.10.0.14
	cjep_staticlib_x-base:1.10
	phil-wifi-20200421:1.10
	phil-wifi-20200411:1.10
	phil-wifi-20200406:1.10
	pgoyette-compat-merge-20190127:1.10
	pgoyette-compat-20190127:1.10
	pgoyette-compat-20190118:1.10
	pgoyette-compat-1226:1.10
	pgoyette-compat-1126:1.10
	pgoyette-compat-1020:1.10
	pgoyette-compat-0930:1.10
	pgoyette-compat-0906:1.10
	pgoyette-compat-0728:1.10
	pgoyette-compat-0625:1.10
	pgoyette-compat-0521:1.10
	pgoyette-compat-0502:1.10
	pgoyette-compat-0422:1.10
	pgoyette-compat-0415:1.10
	pgoyette-compat-0407:1.10
	pgoyette-compat-0330:1.10
	pgoyette-compat-0322:1.10
	pgoyette-compat-0315:1.10
	pgoyette-compat:1.10.0.12
	pgoyette-compat-base:1.10
	perseant-stdc-iso10646:1.10.0.10
	perseant-stdc-iso10646-base:1.10
	prg-localcount2-base3:1.10
	prg-localcount2-base2:1.10
	prg-localcount2-base1:1.10
	prg-localcount2:1.10.0.8
	prg-localcount2-base:1.10
	pgoyette-localcount-20170426:1.10
	bouyer-socketcan-base1:1.10
	pgoyette-localcount-20170320:1.10
	bouyer-socketcan:1.10.0.6
	bouyer-socketcan-base:1.10
	pgoyette-localcount-20170107:1.10
	pgoyette-localcount-20161104:1.10
	localcount-20160914:1.10
	pgoyette-localcount-20160806:1.10
	pgoyette-localcount-20160726:1.10
	pgoyette-localcount:1.10.0.4
	pgoyette-localcount-base:1.10
	netbsd-5-2-3-RELEASE:1.9
	netbsd-5-1-5-RELEASE:1.9
	netbsd-6-0-6-RELEASE:1.9
	netbsd-6-1-5-RELEASE:1.9
	yamt-pagecache-base9:1.10
	yamt-pagecache-tag8:1.9
	netbsd-6-1-4-RELEASE:1.9
	netbsd-6-0-5-RELEASE:1.9
	tls-earlyentropy:1.10.0.2
	tls-earlyentropy-base:1.10
	riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.10
	riastradh-drm2-base3:1.10
	netbsd-6-1-3-RELEASE:1.9
	netbsd-6-0-4-RELEASE:1.9
	netbsd-5-2-2-RELEASE:1.9
	netbsd-5-1-4-RELEASE:1.9
	netbsd-6-1-2-RELEASE:1.9
	netbsd-6-0-3-RELEASE:1.9
	netbsd-5-2-1-RELEASE:1.9
	netbsd-5-1-3-RELEASE:1.9
	netbsd-6-1-1-RELEASE:1.9
	riastradh-drm2-base2:1.9
	riastradh-drm2-base1:1.9
	riastradh-drm2:1.9.0.32
	riastradh-drm2-base:1.9
	netbsd-6-1:1.9.0.36
	netbsd-6-0-2-RELEASE:1.9
	netbsd-6-1-RELEASE:1.9
	netbsd-6-1-RC4:1.9
	netbsd-6-1-RC3:1.9
	agc-symver:1.9.0.34
	agc-symver-base:1.9
	netbsd-6-1-RC2:1.9
	netbsd-6-1-RC1:1.9
	yamt-pagecache-base8:1.9
	netbsd-5-2:1.9.0.30
	netbsd-6-0-1-RELEASE:1.9
	yamt-pagecache-base7:1.9
	netbsd-5-2-RELEASE:1.9
	netbsd-5-2-RC1:1.9
	matt-nb6-plus-nbase:1.9
	yamt-pagecache-base6:1.9
	netbsd-6-0:1.9.0.28
	netbsd-6-0-RELEASE:1.9
	netbsd-6-0-RC2:1.9
	tls-maxphys:1.9.0.26
	tls-maxphys-base:1.10
	matt-nb6-plus:1.9.0.24
	matt-nb6-plus-base:1.9
	netbsd-6-0-RC1:1.9
	yamt-pagecache-base5:1.9
	yamt-pagecache-base4:1.9
	netbsd-6:1.9.0.22
	netbsd-6-base:1.9
	netbsd-5-1-2-RELEASE:1.9
	netbsd-5-1-1-RELEASE:1.9
	yamt-pagecache-base3:1.9
	yamt-pagecache-base2:1.9
	yamt-pagecache:1.9.0.20
	yamt-pagecache-base:1.9
	cherry-xenmp:1.9.0.18
	cherry-xenmp-base:1.9
	bouyer-quota2-nbase:1.9
	bouyer-quota2:1.9.0.16
	bouyer-quota2-base:1.9
	matt-mips64-premerge-20101231:1.9
	matt-nb5-mips64-premerge-20101231:1.9
	matt-nb5-pq3:1.9.0.14
	matt-nb5-pq3-base:1.9
	netbsd-5-1:1.9.0.12
	netbsd-5-1-RELEASE:1.9
	netbsd-5-1-RC4:1.9
	matt-nb5-mips64-k15:1.9
	netbsd-5-1-RC3:1.9
	netbsd-5-1-RC2:1.9
	netbsd-5-1-RC1:1.9
	netbsd-5-0-2-RELEASE:1.9
	matt-nb5-mips64-premerge-20091211:1.9
	matt-premerge-20091211:1.9
	matt-nb5-mips64-u2-k2-k4-k7-k8-k9:1.9
	matt-nb4-mips64-k7-u2a-k9b:1.9
	matt-nb5-mips64-u1-k1-k5:1.9
	matt-nb5-mips64:1.9.0.10
	netbsd-5-0-1-RELEASE:1.9
	jym-xensuspend-nbase:1.9
	netbsd-5-0:1.9.0.8
	netbsd-5-0-RELEASE:1.9
	netbsd-5-0-RC4:1.9
	netbsd-5-0-RC3:1.9
	netbsd-5-0-RC2:1.9
	jym-xensuspend:1.9.0.6
	jym-xensuspend-base:1.9
	netbsd-5-0-RC1:1.9
	netbsd-5:1.9.0.4
	netbsd-5-base:1.9
	matt-mips64-base2:1.9
	matt-mips64:1.8.0.24
	netbsd-4-0-1-RELEASE:1.8
	wrstuden-revivesa-base-3:1.9
	wrstuden-revivesa-base-2:1.9
	wrstuden-fixsa-newbase:1.8
	wrstuden-revivesa-base-1:1.9
	yamt-pf42-base4:1.9
	yamt-pf42-base3:1.9
	hpcarm-cleanup-nbase:1.9
	yamt-pf42-baseX:1.8
	yamt-pf42-base2:1.9
	wrstuden-revivesa:1.9.0.2
	wrstuden-revivesa-base:1.9
	yamt-pf42:1.8.0.22
	yamt-pf42-base:1.8
	mjf-devfs2:1.8.0.20
	mjf-devfs2-base:1.9
	keiichi-mipv6-nbase:1.8
	keiichi-mipv6:1.8.0.18
	keiichi-mipv6-base:1.8
	matt-armv6-nbase:1.8
	matt-armv6-prevmlocking:1.8
	wrstuden-fixsa-base-1:1.8
	netbsd-4-0:1.8.0.16
	netbsd-4-0-RELEASE:1.8
	cube-autoconf:1.8.0.14
	cube-autoconf-base:1.8
	netbsd-4-0-RC5:1.8
	netbsd-4-0-RC4:1.8
	netbsd-4-0-RC3:1.8
	netbsd-4-0-RC2:1.8
	netbsd-4-0-RC1:1.8
	matt-armv6:1.8.0.12
	matt-armv6-base:1.8
	matt-mips64-base:1.8
	hpcarm-cleanup:1.8.0.10
	hpcarm-cleanup-base:1.8
	netbsd-3-1-1-RELEASE:1.7
	netbsd-3-0-3-RELEASE:1.7
	wrstuden-fixsa:1.8.0.8
	wrstuden-fixsa-base:1.8
	abandoned-netbsd-4-base:1.8
	abandoned-netbsd-4:1.8.0.4
	netbsd-3-1:1.7.0.6
	netbsd-3-1-RELEASE:1.7
	netbsd-3-0-2-RELEASE:1.7
	netbsd-3-1-RC4:1.7
	netbsd-3-1-RC3:1.7
	netbsd-3-1-RC2:1.7
	netbsd-3-1-RC1:1.7
	netbsd-4:1.8.0.6
	netbsd-4-base:1.8
	chap-midi-nbase:1.8
	netbsd-3-0-1-RELEASE:1.7
	chap-midi:1.8.0.2
	chap-midi-base:1.8
	netbsd-3-0:1.7.0.4
	netbsd-3-0-RELEASE:1.7
	netbsd-3-0-RC6:1.7
	netbsd-3-0-RC5:1.7
	netbsd-3-0-RC4:1.7
	netbsd-3-0-RC3:1.7
	netbsd-3-0-RC2:1.7
	netbsd-3-0-RC1:1.7
	netbsd-3:1.7.0.2
	netbsd-3-base:1.7;
locks; strict;
comment	@.\" @;


1.10
date	2013.12.28.17.35.01;	author christos;	state dead;
branches;
next	1.9;
commitid	2jAVNVufw7MYnVix;

1.9
date	2008.04.30.13.10.57;	author martin;	state Exp;
branches
	1.9.20.1
	1.9.26.1;
next	1.8;

1.8
date	2005.03.17.12.55.26;	author wiz;	state Exp;
branches
	1.8.20.1
	1.8.22.1;
next	1.7;

1.7
date	2005.03.16.18.51.09;	author christos;	state Exp;
branches;
next	1.6;

1.6
date	2005.03.09.17.07.00;	author wiz;	state Exp;
branches;
next	1.5;

1.5
date	2005.03.09.00.11.31;	author christos;	state Exp;
branches;
next	1.4;

1.4
date	2005.03.07.03.17.21;	author thorpej;	state Exp;
branches;
next	1.3;

1.3
date	2005.03.07.03.11.01;	author thorpej;	state Exp;
branches;
next	1.2;

1.2
date	2005.03.07.02.44.33;	author christos;	state Exp;
branches;
next	1.1;

1.1
date	2005.03.07.02.26.31;	author thorpej;	state Exp;
branches;
next	;

1.9.20.1
date	2014.05.22.11.37.51;	author yamt;	state dead;
branches;
next	;
commitid	P3Rlj4go6xHqKwBx;

1.9.26.1
date	2014.08.20.00.02.36;	author tls;	state dead;
branches;
next	;
commitid	jTnpym9Qu0o4R1Nx;

1.8.20.1
date	2008.06.02.13.21.40;	author mjf;	state Exp;
branches;
next	;

1.8.22.1
date	2008.05.18.12.31.10;	author yamt;	state Exp;
branches;
next	;


desc
@@


1.10
log
@remove dup file
@
text
@.\"	$NetBSD: pam.conf.5,v 1.9 2008/04/30 13:10:57 martin Exp $
.\"
.\" Copyright (c) 2005 The NetBSD Foundation, Inc.
.\" All rights reserved.
.\"
.\" This code is derived from software contributed to The NetBSD Foundation
.\" by Jason R. Thorpe.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd March 17, 2005
.Dt PAM.CONF 5
.Os
.Sh NAME
.Nm pam.conf
.Nd Pluggable Authentication Modules configuration file
.Sh DESCRIPTION
The
.Nm
file specifies how Pluggable Authentication Modules
.Pq PAM
should operate.
For an overview of the Pluggable Authentication Modules framework, see
.Xr pam 8 .
.Pp
PAM may be configured using a single
.Pa /etc/pam.conf
configuration file or by using multiple configuration files, one for each
PAM-aware service, located in the
.Pa /etc/pam.d/
directory.
If
.Pa /etc/pam.d/
exists,
.Pa /etc/pam.conf
will be ignored.
.Pa /etc/pam.d/
is the preferred method for configuring PAM.
.Pp
PAM's configuration is based on
.Dq stacking
different modules together to form a processing chain for the task.
A standard PAM configuration stanza is structured as follows:
.Bd -filled -offset indent
.Op Ar service-name
.Ar module-type
.Ar control-flag
.Ar module-name
.Op Ar options
.Ed
.Pp
.Ar service-name
is used only
.Pq and is mandatory
in
.Pa /etc/pam.conf .
It specifies the PAM-aware service whose PAM behavior is being configured.
When
.Pa /etc/pam.d/
is used, the name of the configuration file specifies the service.
.Pp
.Ar module-type
specifies which of the four classes of PAM module functionality is being
configured.
These four classes are
.Em account
.Pq account management ,
.Em auth
.Pq authentication ,
.Em password
.Pq password management ,
and
.Em session
.Pq session management .
.Pp
.Ar control-flag
specifies the behavior of the processing chain upon success or failure
of the PAM module's authentication task.
The following are valid values for
.Ar control-flag :
.Bl -tag -width sufficient
.It binding
If the module succeeds and no earlier module in the chain
has failed, the chain is immediately terminated and the
request is granted.
If the module fails, the rest of the chain is executed,
but the request is ultimately denied.
.It requisite
If the module returns success, continue to execute the processing chain.
If the module fails, immediately return the error code from the first
.Sq required
failure.
.It required
If the module returns success, continue to execute the processing chain.
If the module fails, record as a
.Sq required
failure and continue to execute the processing chain.
If there are any
.Sq required
failures in the processing chain, the chain will ultimately return
failure.
.It optional
If the module returns success, continue to execute the processing chain.
If the module fails, record as an
.Sq optional
failure and continue to execute the processing chain.
.It sufficient
If the module returns success and there have been no recorded
.Sq required
failures, immediately return success without calling any subsequent
modules in the processing chain.
If the module fails, return as an
.Sq optional
failure and continue to execute the processing chain.
.El
.Pp
.Ar module-name
specifies the module to execute for this stanza.
This is either an absolute path name or a path name relative to the
default module location:
.Pa /usr/lib/security .
.Pp
.Ar options
are additional options that may be specified for the module.
Refer to the individual modules' documentation for more information
on available options.
.Pp
In addition to the standard configuration stanza format, there is
an additional stanza format available when
.Pa /etc/pam.d/
is used:
.Bd -filled -offset indent
.Ar module-type
include
.Ar service-name
.Ed
.Pp
This stanza format provides a simple inheritance model for processing
chains.
.Sh FILES
.Bl -tag -width /etc/pam.conf -compact
.It Pa /etc/pam.conf
monolithic PAM configuration file
.It Pa /etc/pam.d/
PAM service configuration file directory
.El
.Sh EXAMPLES
The following
.Em auth
processing chain for the
.Dq login
service
.Po
located in
.Pa /etc/pam.d/login
.Pc
performs the following tasks: allows the login if the old user
and new user are the same, verifies that logins are not disabled using
the
.Pa /var/run/nologin
file, allows Kerberos 5 password authentication, and requires standard
.Ux
password authentication if Kerberos 5 failed:
.Bd -literal -offset indent
auth	sufficient	pam_self.so
auth	required	pam_nologin.so
auth	sufficient	pam_krb5.so
auth	required	pam_unix.so
.Ed
.Sh NOTES
It is important to note that loading a chain will fail if any of the
components of the chain fail to load or are not available.
A common situation when this can happen is on a system that where
components such as
.Xr kerberos 1
or
.Xr crypto 3
have not been installed.
In that situation
.Xr pam_krb5 8 ,
.Xr pam_ksu 8 ,
or
.Xr pam_ssh 8
might not be present in the system.
In order for a chain to load properly all non-present components must
be removed from the chain.
.Sh SEE ALSO
.Xr login 1 ,
.Xr passwd 1 ,
.Xr su 1 ,
.Xr pam 3 ,
.Xr pam 8
.Sh HISTORY
The
.Nm
file format first appeared in
.Nx 3.0 .
@


1.9
log
@Convert TNF licenses to new 2 clause variant
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.8 2005/03/17 12:55:26 wiz Exp $
@


1.9.26.1
log
@Rebase to HEAD as of a few days ago.
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.9 2008/04/30 13:10:57 martin Exp $
@


1.9.20.1
log
@sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.9 2008/04/30 13:10:57 martin Exp $
@


1.8
log
@Bump date for new NOTES section.
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.7 2005/03/16 18:51:09 christos Exp $
a16 7
.\" 3. All advertising materials mentioning features or use of this software
.\"    must display the following acknowledgement:
.\"        This product includes software developed by the NetBSD
.\"        Foundation, Inc. and its contributors.
.\" 4. Neither the name of The NetBSD Foundation nor the names of its
.\"    contributors may be used to endorse or promote products derived
.\"    from this software without specific prior written permission.
@


1.8.20.1
log
@Sync with HEAD.
@
text
@d1 1
a1 1
.\"	$NetBSD$
d17 7
@


1.8.22.1
log
@sync with head.
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.8 2005/03/17 12:55:26 wiz Exp $
d17 7
@


1.7
log
@Add a note about missing components and chain load failure.
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.6 2005/03/09 17:07:00 wiz Exp $
d37 1
a37 1
.Dd March 8, 2005
@


1.6
log
@Fix some typos, remove trailing whitespace.
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.5 2005/03/09 00:11:31 christos Exp $
d196 17
@


1.5
log
@Add the binding keyword.
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.4 2005/03/07 03:17:21 thorpej Exp $
d49 1
a49 1
For an overfiew of the Pluggable Authentication Modules framework, see
d103 1
a103 1
speficies the behavior of the processing chain upon success or failure
d108 1
a108 1
.It binding 
d151 1
a151 1
Refer to the individual modules' docuementation for more information
d154 2
a155 2
In addition to the standard configuration stanza format, there is an additional
stanza format availble when
d157 1
a157 1
is in use:
@


1.4
log
@Fix missing word in sentence.
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.3 2005/03/07 03:11:01 thorpej Exp $
d37 1
a37 1
.Dd March 6, 2005
d108 6
@


1.3
log
@Indent the example.
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.2 2005/03/07 02:44:33 christos Exp $
d148 1
a148 1
In addition to the standard configuration stanza format, there an additional
@


1.2
log
@.Bd needs display style. Thanks jason for the man page!
@
text
@d1 1
a1 1
.\"	$NetBSD: pam.conf.5,v 1.1 2005/03/07 02:26:31 thorpej Exp $
d184 1
a184 1
.Bd -literal
@


1.1
log
@Add a pam.conf(5) manual page.
@
text
@d1 1
a1 1
.\"	$NetBSD$
d70 1
a70 1
.Bd -offset indent
d152 1
a152 1
.Bd -offset indent
@