| blob | 1a17ea52f4b16c18ad916efa7a3bf545a7443ec0 |
1 .\" $NetBSD: login.conf.5,v 1.22 2008/11/18 13:04:04 reed Exp $
2 .\"
3 .\" Copyright (c) 1995,1996,1997 Berkeley Software Design, Inc.
4 .\" All rights reserved.
5 .\"
6 .\" Redistribution and use in source and binary forms, with or without
7 .\" modification, are permitted provided that the following conditions
8 .\" are met:
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\" 2. Redistributions in binary form must reproduce the above copyright
12 .\" notice, this list of conditions and the following disclaimer in the
13 .\" documentation and/or other materials provided with the distribution.
14 .\" 3. All advertising materials mentioning features or use of this software
15 .\" must display the following acknowledgement:
16 .\" This product includes software developed by Berkeley Software Design,
17 .\" Inc.
18 .\" 4. The name of Berkeley Software Design, Inc. may not be used to endorse
19 .\" or promote products derived from this software without specific prior
20 .\" written permission.
21 .\"
22 .\" THIS SOFTWARE IS PROVIDED BY BERKELEY SOFTWARE DESIGN, INC. ``AS IS'' AND
23 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 .\" ARE DISCLAIMED. IN NO EVENT SHALL BERKELEY SOFTWARE DESIGN, INC. BE LIABLE
26 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 .\" SUCH DAMAGE.
33 .\"
34 .\" BSDI login.conf.5,v 2.19 1998/02/19 23:39:39 prb Exp
35 .\"
36 .Dd November 18, 2008
37 .Dt LOGIN.CONF 5
38 .Os
39 .Sh NAME
40 .Nm login.conf
41 .Nd login class capability data base
42 .Sh SYNOPSIS
43 .Nm login.conf
44 .Sh DESCRIPTION
45 The
46 .Nm login.conf
47 file describes the various attributes of login classes.
48 A login class determines what styles of authentication are available
49 as well as session resource limits and environment setup.
50 While designed primarily for the
51 .Xr login 1
52 program,
53 it is also used by other programs, e.g.,
54 .Xr rexecd 8 ,
55 which need to set up a user environment.
56 .Pp
57 The class to be used is normally determined by the
58 .Li class
59 field in the password file (see
60 .Xr passwd 5 ) .
61 The class is used to look up a corresponding entry in the
62 .Pa login.conf
63 file.
64 A special class called
65 .Dq default
66 will be used (if it exists) if the field in the password file is empty.
67 .Sh CAPABILITIES
68 Refer to
69 .Xr getcap 3
70 for a description of the file layout.
71 An example entry is:
72 .Bd -literal -offset indent
73 classname|Description entry:\\
74 :capability=value:\\
75 :booleancapability:\\
76 \&.\&.\&.
77 :lastcapability=value:
78 .Ed
79 .Pp
80 All entries in the
81 .Nm login.conf
82 file are either boolean or use a `=' to separate the capability
83 from the value.
84 The types are described after the capability table.
85 .Bl -column minpasswordlen program default
86 .It Sy Name Type Default Description
87 .\"
88 .sp
89 .It Sy copyright Ta file Ta "" Ta
90 File containing additional copyright information.
91 (If the file exists,
92 .Xr login 1
93 displays it before the welcome message.)
94 .\"
95 .sp
96 .It Sy coredumpsize Ta size Ta "" Ta
97 Maximum coredump size limit.
98 .\"
99 .sp
100 .It Sy cputime Ta time Ta "" Ta
101 CPU usage limit.
102 .\"
103 .sp
104 .It Sy datasize Ta size Ta "" Ta
105 Maximum data size limit.
106 .\"
107 .sp
108 .It Sy filesize Ta size Ta "" Ta
109 Maximum file size limit.
110 .\"
111 .sp
112 .It Sy host.allow Ta string Ta "" Ta
113 A comma-separated list of host name or IP address patterns
114 from which a class is allowed access.
115 Access is instead denied from any hosts preceded
116 by
117 .Sq Li \&! .
118 Patterns can contain the
119 .Xr sh 1 Ns -style
120 .Sq Li *
121 and
122 .Sq Li \&?
123 wildcards.
124 The
125 .Sy host.deny
126 entry is checked before
127 .Sy host.allow .
128 (Currently used only by
129 .Xr sshd 8 . )
130 .\"
131 .sp
132 .It Sy host.deny Ta string Ta "" Ta
133 A comma-separated list of host name or IP address patterns
134 from which a class is denied access.
135 Patterns as per
136 .Sy host.allow ,
137 although a matched pattern that has been negated with
138 .Sq Li \&!
139 is ignored.
140 (Currently used only by
141 .Xr sshd 8 . )
142 .\"
143 .sp
144 .It Sy hushlogin Ta bool Ta Li false Ta
145 Same as having a
146 .Pa $HOME/.hushlogin
147 file.
148 See
149 .Xr login 1 .
150 .\"
151 .sp
152 .It Sy ignorenologin Ta bool Ta Li false Ta
153 Not affected by
154 .Pa nologin
155 files.
156 .\"
157 .sp
158 .It Sy login-retries Ta number Ta 10 Ta
159 Maximum number of login attempts allowed.
160 .\"
161 .sp
162 .It Sy login-backoff Ta number Ta 3 Ta
163 Number of login attempts after which to start random back-off.
164 .\"
165 .sp
166 .It Sy maxproc Ta number Ta "" Ta
167 Maximum number of process.
168 .\"
169 .sp
170 .It Sy memorylocked Ta size Ta "" Ta
171 Maximum locked in core memory size limit.
172 .\"
173 .sp
174 .It Sy memoryuse Ta size Ta "" Ta
175 Maximum in core memoryuse size limit.
176 .\"
177 .sp
178 .It Sy minpasswordlen Ta number Ta "" Ta
179 The minimum length a local password may be.
180 Used by the
181 .Xr passwd 1
182 utility.
183 .\"
184 .sp
185 .It Sy nologin Ta file Ta "" Ta
186 If the file exists it will be displayed
187 and the login session will be terminated.
188 .\"
189 .sp
190 .It Sy openfiles Ta number Ta "" Ta
191 Maximum number of open file descriptors per process.
192 .\"
193 .\"XX .sp
194 .\"XX .It Sy password-dead Ta time Ta Li 0 Ta
195 .\"XX Length of time a password may be expired but not quite dead yet.
196 .\"XX When set (for both the client and remote server machine when doing
197 .\"XX remote authentication), a user is allowed to log in just one more
198 .\"XX time after their password (but not account) has expired. This allows
199 .\"XX a grace period for updating their password.
200 .\"
201 .sp
202 .It Sy passwordtime Ta time Ta "" Ta
203 Used by
204 .Xr passwd 1
205 to set next password expiry date.
206 .\"
207 .sp
208 .It Sy password-warn Ta time Ta Li 2w Ta
209 If the user's password will expire within this length of time then
210 warn the user of this.
211 .\"
212 .sp
213 .It Sy path Ta path Ta Li "/bin /usr/bin" Ta
214 .br
215 Default search path.
216 .\"
217 .sp
218 .It Sy priority Ta number Ta "" Ta
219 Initial priority (nice) level.
220 .\"
221 .sp
222 .It Sy requirehome Ta bool Ta Li false Ta
223 Require home directory to login.
224 .\"
225 .sp
226 .It Sy sbsize Ta size Ta "" Ta
227 Maximum socket buffer size limit.
228 .\"
229 .sp
230 .It Sy setenv Ta list Ta "" Ta
231 Comma or whitespace separated list
232 of environment variables and values to be set.
233 Commas and whitespace can be escaped using \e\e.
234 .\"
235 .sp
236 .It Sy shell Ta program Ta "" Ta
237 Session shell to execute rather than the shell specified in the password file.
238 The
239 .Ev SHELL
240 environment variable will contain the shell specified in the password file.
241 .\"
242 .sp
243 .It Sy stacksize Ta size Ta "" Ta
244 Maximum stack size limit.
245 .\"
246 .sp
247 .It Sy tc Ta string Ta "" Ta
248 A "continuation" entry, which must be the last capability provided.
249 More capabilities are read from the named entry.
250 The capabilities given before
251 .Sy tc
252 override those in the entry invoked by
253 .Sy tc .
254 .\"
255 .sp
256 .It Sy term Ta string Ta Li su Ta
257 Default terminal type if not able to determine from other means.
258 .\"
259 .sp
260 .It Sy umask Ta number Ta Li 022 Ta
261 Initial umask.
262 Should always have a leading
263 .Li 0
264 to assure octal interpretation.
265 See
266 .Xr umask 2 .
267 .\"
268 .sp
269 .It Sy welcome Ta file Ta Li /etc/motd Ta
270 File containing welcome message.
271 .Xr login 1
272 displays this and
273 .Xr sshd 8
274 sends this.
275 .El
276 .Pp
277 The resource limit entries
278 .Sy ( coredumpsize ,
279 .Sy cputime ,
280 .Sy datasize ,
281 .Sy filesize ,
282 .Sy maxproc ,
283 .Sy memorylocked ,
284 .Sy memoryuse ,
285 .Sy openfiles ,
286 .Sy sbsize ,
287 and
288 .Sy stacksize )
289 actually specify both the maximum and current limits (see
290 .Xr getrlimit 2 ) .
291 The current limit is the one normally used,
292 although the user is permitted to increase the current limit to the
293 maximum limit.
294 The maximum and current limits may be specified individually by appending
295 a
296 .Sq Sy \-max
297 or
298 .Sq Sy \-cur
299 to the capability name (e.g.,
300 .Sy openfiles-max
301 and
302 .Sy openfiles-cur Ns No ) .
303 .Pp
304 .Nx
305 will never define capabilities which start with
306 .Li x-
307 or
308 .Li X- ,
309 these are reserved for external use (unless included through contributed
310 software).
311 .Pp
312 The argument types are defined as:
313 .Bl -tag -width programxx
314 .\"
315 .It Sy bool
316 If the name is present, then the boolean value is true;
317 otherwise, it is false.
318 .\"
319 .It Sy file
320 Path name to a text file.
321 .\"
322 .It Sy list
323 A comma or whitespace separated list of values.
324 .\"
325 .It Sy number
326 A number. A leading
327 .Li 0x
328 implies the number is expressed in hexadecimal.
329 A leading
330 .Li 0
331 implies the number is expressed in octal.
332 Any other number is treated as decimal.
333 .\"
334 .It Sy path
335 A space separated list of path names.
336 If a
337 .Sq Li ~
338 is the first character in the path name, the
339 .Sq Li ~
340 is expanded to the user's home directory.
341 .\"
342 .It Sy program
343 A path name to program.
344 .\"
345 .It Sy size
346 A number which expresses a size in bytes.
347 It may have a trailing
348 .Li b
349 to multiply the value by 512, a
350 .Li k
351 to multiply the value by 1 K (1024), and a
352 .Li m
353 to multiply the value by 1 M (1048576).
354 .\"
355 .It Sy time
356 A time in seconds.
357 A time may be expressed as a series of numbers
358 which are added together.
359 Each number may have a trailing character to
360 represent time units:
361 .Bl -tag -width xxx
362 .\"
363 .It Sy y
364 Indicates a number of 365 day years.
365 .\"
366 .It Sy w
367 Indicates a number of 7 day weeks.
368 .\"
369 .It Sy d
370 Indicates a number of 24 hour days.
371 .\"
372 .It Sy h
373 Indicates a number of 60 minute hours.
374 .\"
375 .It Sy m
376 Indicates a number of 60 second minutes.
377 .\"
378 .It Sy s
379 Indicates a number of seconds.
380 .El
381 .Pp
382 For example, to indicate 1 and 1/2 hours, the following string
383 could be used:
384 .Li 1h30m .
385 .El
386 .\"
387 .Sh FILES
388 .Bl -tag -width /etc/login.conf.db -compact
389 .It Pa /etc/login.conf
390 login class capability database
391 .It Pa /etc/login.conf.db
392 hashed database built with
393 .Xr cap_mkdb 1
394 .El
395 .Sh SEE ALSO
396 .Xr cap_mkdb 1 ,
397 .Xr login 1 ,
398 .Xr getcap 3 ,
399 .Xr login_cap 3 ,
400 .Xr ttys 5 ,
401 .Xr ftpd 8 ,
402 .Xr sshd 8
403 .Sh HISTORY
404 The
405 .Nm
406 configuration file appeared in
407 .Nx 1.5 .