te
Copyright (c) 2005, Sun Microsystems, Inc. All Rights Reserved
The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
PAM_DENY 5 "Jun 16, 2005"
NAME
pam_deny - PAM authentication, account, session and password management PAM module to deny operations
SYNOPSIS

pam_deny.so.1
DESCRIPTION

The pam_deny module implements all the PAM service module functions and returns the module type default failure return code for all calls.

The following options are interpreted: debug

syslog(3C) debugging information at the LOG_AUTH|LOG_DEBUG levels

ERRORS

The following error codes are returned: PAM_ACCT_EXPIRED

If pam_sm_acct_mgmt is called.

PAM_AUTH_ERR

If pam_sm_authenticate is called.

PAM_AUTHOK_ERR

If pam_sm_chauthtok is called.

PAM_CRED_ERR

If pam_sm_setcred is called.

PAM_SESSION_ERR

If pam_sm_open_session or pam_sm_close_session is called.

EXAMPLES

Example 1 Disallowing ssh none authentication 

 sshd-none auth requisite pam_deny.so.1
 sshd-none account requisite pam_deny.so.1
 sshd-none session requisite pam_deny.so.1
 sshd-none password requisite pam_deny.so.1

Example 2 Disallowing any service not explicitly defined 

 other auth requisite pam_deny.so.1
 other account requisite pam_deny.so.1
 other session requisite pam_deny.so.1
 other password requisite pam_deny.so.1
ATTRIBUTES

See attributes(5) for a description of the following attributes:

ATTRIBUTE TYPE ATTRIBUTE VALUE
Interface Stability Evolving
MT Level MT-Safe with exceptions
SEE ALSO

su(1M), libpam(3LIB), pam(3PAM), pam_sm_authenticate(3PAM), syslog(3C), pam.conf(4), nsswitch.conf(4), attributes(5), pam_authtok_check(5), pam_authtok_get(5), pam_authtok_store(5), pam_dhkeys(5), pam_passwd_auth(5), pam_unix_account(5), pam_unix_auth(5), pam_unix_session(5), privileges(5)

NOTES

The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle.

The pam_deny module is intended to deny access to a specified service. The other service name may be used to deny access to services not explicitly specified.