A Collection of Modules for PAM
pam_innetgr module checks if the user and current host
match a triple in the NIS netgroup supplied via the ‘netgroup’
argument. It returns success if so, and ‘PAM_AUTH_ERR’ otherwise.
Another possible return values are: ‘PAM_AUTHINFO_UNAVAIL’, if the input information was not sufficient (e.g. the username was not supplied, or the module was unable to determine the host or domain name), and ‘PAM_SERVICE_ERR’, if a generic error condition (such as a lack of memory) occurred.
In order to determine host and domain name parts, the following approach is used. First, the ‘gethostname’ function is called to obtain the hostname part. If the ‘getdomainname’ function is available, it is used to determine the domain part. If the resulting domain part is ‘NULL’ or the string ‘(none)’, the ‘gethostbyname’ function is invoked with the hostname as its argument. The returned name (technically speaking, the ‘h_name’ member of the ‘struct hostent’) is used as the canonical name of the server. It is split on the first occurrence of the dot character. The second part is used as the domain name. The options described below control this process.
This module can be used in any PAM service stack.
The following table summarizes the options specific for this module. See common options, for the list of common options.
Name of the netgroup to use. This option is mandatory.
Defines the hostname of the current host. By default it is determined
gethostname system call.
Defines the domainname of the current host.
Disable the use of
getdomainname libc function. By default it
is used to determine the domain name. If it fails or returns a string
‘(none)’, than the module tries to get the fully qualified name
of the server and uses the part after the first dot as the domain
name. Using the ‘nogetdomainname’ option instructs it to always
use the latter method.
Never use this option together with ‘noresove’.
Don’t fallback to obtaining the fully qualified domain name of the
host from DNS in order to obtain the domain part. This means that
getdomainname call fails or is not available on your system,
the module will return
Never use this option together with ‘nogetdomainname’.
What to do on success. The value ‘allow’ means to return
PAM_SUCCESS, ‘deny’ means to return
Default is ‘allow’.
This document was generated on August 12, 2018 using makeinfo.Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.