line.

The syntax of the lines is as follows:

`services`;`ttys`;`users`;`times`;`groups`

The first field, the `services` field, is a logic list of PAM service names that the rule applies to.

The second field, the `tty` field, is a logic list of terminal names that this rule applies to.

The third field, the `users` field, is a logic list of users, or a UNIX group, or a netgroup of users to whom this rule applies. Group names are preceded by a '%' symbol, while netgroup names are preceded by a '@' symbol.

A logic list namely means individual tokens that are optionally prefixed with '!' (logical not) and separated with '&' (logical and) and '|' (logical or).

For these items the simple wildcard '*' may be used only once. With UNIX groups or netgroups no wildcards or logic operators are allowed.

The `times` field is used to indicate "when" these groups are to be given to the user. The format here is a logic list of day/time-range entries. The days are specified by a sequence of two character entries, MoTuSa for example is Monday Tuesday and Saturday. Note that repeated days are unset MoMo = no day, and MoWk = all weekdays bar Monday. The two character combinations accepted are Mo Tu We Th Fr Sa Su Wk Wd Al, the last two being week-end days and all 7 days of the week respectively. As a final example, AlFr means all days except Friday.

Each day/time-range can be prefixed with a '!' to indicate "anything but". The time-range part is two 24-hour times HHMM, separated by a hyphen, indicating the start and finish time (if the finish time is smaller than the start time it is deemed to apply on the following day).

The `groups` field is a comma or space separated list of groups that the user inherits membership of. These groups are added if the previous fields are satisfied by the user's request.

For a rule to be active, ALL of service+ttys+users must be satisfied by the applying process.

### 6.12.3. OPTIONS

This module does not recognise any options.

### 6.12.4. MODULE TYPES PROVIDED

Only the `auth` module type is provided.

### 6.12.5. RETURN VALUES

PAM_SUCCESS

  group membership was granted.

PAM_ABORT

  Not all relevant data could be gotten.

PAM_BUF_ERR

  Memory buffer error.

PAM_CRED_ERR

  Group membership was not granted.

PAM_IGNORE

  `pam_sm_authenticate` was called which does nothing.

PAM_USER_UNKNOWN

  The user is not known to the system.

### 6.12.6. FILES

/etc/security/group.conf

  Default configuration file

### 6.12.7. EXAMPLES

These are some example lines which might be specified in `/etc/security/group.conf`.

Running 'xsh' on tty* (any ttyXXX device), the user 'us' is given access to the floppy (through membership of the floppy group)

    xsh;tty*&!ttyp*;us;Al0000-2400;floppy

Running 'xsh' on tty* (any ttyXXX device), the users 'sword', 'pike' and 'shield' are given access to games (through membership of the floppy group) after work hours.

    xsh; tty* ;sword|pike|shield;!Wk0900-1800;games, sound
    xsh; tty* ;*;Al0900-1800;floppy

Any member of the group 'admin' running 'xsh' on tty*, is granted access (at any time) to the group 'plugdev'

    xsh; tty* ;%admin;Al0000-2400;plugdev

### 6.12.8. AUTHORS

pam_group was written by Andrew G. Morgan <morgan@kernel.org>.

Prev | Up | Next
6.11. pam_ftp - module for anonymous access | Home | 6.13. pam_issue - add issue file to user prompt