Loading ...Linux allow / restrict system logins to specific user groups only using pam_listfile PAM module
There are two ways to allow / restrict system login to specific user groups only. The simplest method is to use a PAM module called pam_listfile.so. Another option is to use login access control table. Locking down system login access is very important task if you need a secure system.
The system administrator is free to choose how individual service-providing applications will authenticate users. Many new admins not aware of PAM and related services. In this tip you are going to use authentication (auth) group, which authenticate a user and set up user credentials.
Deny or allow access to groups using PAM
pam_listfile is a PAM module which provides a way to deny or allow access to services based on an arbitrary file. Service can be any one of the following
=> su
=> sudo
=> ftp
=> Mail Service (MTA/POP3/IMAP)
=> SSH
=> Samba
=> Crond
=> Squid and many others
How do I setup pam_listfile PAM module for group based login?
Let us say you would like to allow login to only members of wheel (root user) and webdev groups.
Step # 1: Create /etc/login.group.allowed file
/etc/login.group.allowed filename contains one line per group listed. If the group name is found, then login is allowed; else authorization request denied:
# vi /etc/login.group.allowed
Add group names:
root
wheel
webdev
Save and close the file.
Step # 2: Allow group based login to all services
Open /etc/pam.d/system-auth file if you are using Redhat / RHEL / Fedora / CentOS Linux. If you are using Debian / Ubuntu Linux use /etc/pam.d/common-auth file:
# vi /etc/pam.d/system-auth
You must add the following config directive at the top of the file:
auth required pam_listfile.so onerr=fail item=group sense=allow file=/etc/login.group.allowed
Where,
- auth required pam_listfile.so : Pam module name required for allowing group based login
- onerr=fail : What to do if something weird happens like being unable to open the file or busy disk I/O. In our case login is denied till weird problem is sorted out.
- item=group : Check for group name
- sense=allow : The authorization request to succeed if group name found in /etc/login.group.allowed file
- file=/etc/login.group.allowed : Filename contains one line per group name listed. If the group name is found, then if sense=allow, PAM_SUCCESS is returned, causing the authorization request to succeed.
Caution: Please note that by adding above line you are forcing this configuraion on all login services including ssh, telnet, mail, su, sudo and all PAM aware services. If you need login restrictions for specific service modify specific service located in /etc/pam.d/service-name file.
Save and close the file. This will only allow users that belong to the root, wheel and webdev group to login to the system. You can apply above technique to:
- User names
- Shell
- Tty names
- Rhost / Ruser (remote login host / user id)
The config can be reversed to denied login to specific group name by modify the configuration file. This is left as exercise to our reader (hint type man pam_listfile).
=> Related PAM config FAQ : Linux PAM configuration that allows or deny user login via the sshd server
Want to stay up to date with the latest Linux tips, news and announcements? Subscribe to our free e-mail newsletter or RSS feed to get all updates.
You can Email this page to a friend.
You may also be interested in other helpful articles:
- OpenSSH deny or restrict access to users and groups
- Solaris modify a user account
- Allow normal user to dialout Internet
- Solaris adding new user accounts
- Linux Failed Login Control: Lock and Unlock User Accounts Using PAM
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
Tags: access_control, pam_configuration, pam_listfile.so_module, pam_module, secure_system, user_groups_login
Recent Comments
Today ~ 12 Comments
Today ~ 6 Comments
Today ~ 21 Comments
Today ~ 1 Comment
Today ~ 1 Comment