| blob | d5d2a569a0006ddfaab4440a528de21feca201b9 |
1 '\" te
2 .\" Copyright (C) 2008, Sun Microsystems, Inc. All Rights Reserved
3 .\" Portions Copyright (c) 1982-2007 AT&T Knowledge Ventures
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH LOGIN 1 "Mar 24, 2017"
8 .SH NAME
9 login \- sign on to the system
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fBlogin\fR [\fB-p\fR] [\fB-d\fR \fIdevice\fR] [\fB-R\fR \fIrepository\fR] [\fB-s\fR \fIservice\fR]
14 [\fB-t\fR \fIterminal\fR] [\fB-u\fR \fIidentity\fR] [\fB-U\fR \fIruser\fR]
15 [\fB-h\fR \fIhostname\fR \fI[terminal]\fR | \fIhostname\fR]
16 [\fIname\fR [\fIenviron\fR]...]
17 .fi
19 .SH DESCRIPTION
20 .LP
21 The \fBlogin\fR command is used at the beginning of each terminal session to
22 identify oneself to the system. \fBlogin\fR is invoked by the system when a
23 connection is first established, after the previous user has terminated the
24 login shell by issuing the \fBexit\fR command.
25 .sp
26 .LP
27 If \fBlogin\fR is invoked as a command, it must replace the initial command
28 interpreter. To invoke \fBlogin\fR in this fashion, type:
29 .sp
30 .in +2
31 .nf
32 \fBexec login\fR
33 .fi
34 .in -2
35 .sp
37 .sp
38 .LP
39 from the initial shell. The C shell and Korn shell have their own built-ins of
40 \fBlogin\fR. See \fBksh\fR(1), \fBksh93\fR(1), and \fBcsh\fR(1) for
41 descriptions of login built-ins and usage.
42 .sp
43 .LP
44 \fBlogin\fR asks for your user name, if it is not supplied as an argument, and
45 your password, if appropriate. Where possible, echoing is turned off while you
46 type your password, so it does not appear on the written record of the session.
47 .sp
48 .LP
49 If you make any mistake in the login procedure, the message:
50 .sp
51 .in +2
52 .nf
53 Login incorrect
54 .fi
55 .in -2
56 .sp
58 .sp
59 .LP
60 is printed and a new login prompt appears. If you make five incorrect login
61 attempts, all five can be logged in \fB/var/adm/loginlog\fR, if it exists. The
62 \fBTTY\fR line is dropped.
63 .sp
64 .LP
65 If password aging is turned on and the password has aged (see \fBpasswd\fR(1)
66 for more information), the user is forced to changed the password. In this case
67 the \fB/etc/nsswitch.conf\fR file is consulted to determine password
68 repositories. See \fBnsswitch.conf\fR(4) for a list of valid nameservice
69 configurations that are permitted for the \fBpasswd\fR: database if password
70 aging is enabled.
71 .sp
72 .LP
73 Failure to comply with the configurations prevents the user from logging onto
74 the system because \fBpasswd\fR(1) fails. If you do not complete the login
75 successfully within a certain period of time, it is likely that you are
76 silently disconnected.
77 .sp
78 .LP
79 After a successful login, accounting files are updated. Device owner, group,
80 and permissions are set according to the contents of the
81 \fB/etc/logindevperm\fR file, and the time you last logged in as well as the
82 message of the day (\fB/etc/motd\fR) are printed, unless \fB$HOME/.hushlogin\fR
83 exists.
84 .sp
85 .LP
86 The user-ID, group-ID, supplementary group list, and working directory are
87 initialized, and the command interpreter (usually \fBksh\fR) is started.
88 .sp
89 .LP
90 The basic \fIenvironment\fR is initialized to:
91 .sp
92 .in +2
93 .nf
94 HOME=\fIyour-login-directory\fR
95 LOGNAME=\fIyour-login-name\fR
96 PATH=/usr/bin:
97 SHELL=\fIlast-field-of-passwd-entry\fR
98 MAIL=/var/mail/
99 TZ=\fItimezone-specification\fR
100 .fi
101 .in -2
103 .sp
104 .LP
105 If the \fIlogin-shell\fR field in the password file (see \fBpasswd\fR(4)) is
106 empty, then the default command interpreter, \fB/usr/bin/sh\fR, is used. If
107 this field is * (asterisk), then the named directory becomes the root
108 directory. At that point, \fBlogin\fR is re-executed at the new level, which
109 must have its own root structure.
110 .sp
111 .LP
112 The environment can be expanded or modified by supplying additional arguments
113 to \fBlogin\fR, either at execution time or when \fBlogin\fR requests your
114 login name. The arguments can take either the form \fIxxx\fR or \fIxxx=yyy\fR.
115 Arguments without an \fB=\fR (equal sign) are placed in the environment as:
116 .sp
117 .in +2
118 .nf
119 L\fIn=xxx\fR
120 .fi
121 .in -2
122 .sp
124 .sp
125 .LP
126 where \fIn\fR is a number starting at \fB0\fR and is incremented each time a
127 new variable name is required. Variables containing an \fB=\fR (equal sign) are
128 placed in the environment without modification. If they already appear in the
129 environment, then they replace the older values.
130 .sp
131 .LP
132 There are two exceptions: The variables \fBPATH\fR and \fBSHELL\fR cannot be
133 changed. This prevents people logged into restricted shell environments from
134 spawning secondary shells that are not restricted. \fBlogin\fR understands
135 simple single-character quoting conventions. Typing a \fB\e\fR\| (backslash) in
136 front of a character quotes it and allows the inclusion of such characters as
137 spaces and tabs.
138 .sp
139 .LP
140 Alternatively, you can pass the current environment by supplying the \fB-p\fR
141 flag to \fBlogin\fR. This flag indicates that all currently defined environment
142 variables should be passed, if possible, to the new environment. This option
143 does not bypass any environment variable restrictions mentioned above.
144 Environment variables specified on the login line take precedence, if a
145 variable is passed by both methods.
146 .sp
147 .LP
148 To enable remote logins by root, edit the \fB/etc/default/login\fR file by
149 inserting a \fB#\fR (pound sign) before the \fBCONSOLE=/dev/console\fR entry.
150 See FILES.
151 .SH SECURITY
152 .LP
153 For accounts in name services which support automatic account locking, the
154 account can be configured to be automatically locked (see \fBuser_attr\fR(4)
155 and \fBpolicy.conf\fR(4)) if successive failed login attempts equals or exceeds
156 \fBRETRIES\fR. Currently, only the files repository (see \fBpasswd\fR(4) and
157 \fBshadow\fR(4)) supports automatic account locking. See also
158 \fBpam_unix_auth\fR(5).
159 .sp
160 .LP
161 The \fBlogin\fR command uses \fBpam\fR(3PAM) for authentication, account
162 management, session management, and password management. The \fBPAM\fR
163 configuration policy, listed through \fB/etc/pam.conf\fR, specifies the modules
164 to be used for \fBlogin\fR. Here is a partial \fBpam.conf\fR file with entries
165 for the \fBlogin\fR command using the UNIX authentication, account management,
166 and session management modules:
167 .sp
168 .in +2
169 .nf
170 login auth required pam_authtok_get.so.1
171 login auth required pam_dhkeys.so.1
172 login auth required pam_unix_auth.so.1
173 login auth required pam_dial_auth.so.1
175 login account requisite pam_roles.so.1
176 login account required pam_unix_account.so.1
178 login session required pam_unix_session.so.1
179 .fi
180 .in -2
182 .sp
183 .LP
184 The Password Management stack looks like the following:
185 .sp
186 .in +2
187 .nf
188 other password required pam_dhkeys.so.1
189 other password requisite pam_authtok_get.so.1
190 other password requisite pam_authtok_check.so.1
191 other password required pam_authtok_store.so.1
192 .fi
193 .in -2
195 .sp
196 .LP
197 If there are no entries for the service, then the entries for the \fBother\fR
198 service is used. If multiple authentication modules are listed, then the user
199 can be prompted for multiple passwords.
200 .SH OPTIONS
201 .LP
202 The following options are supported:
203 .sp
204 .ne 2
205 .na
206 \fB\fB-d\fR \fIdevice\fR\fR
207 .ad
208 .RS 26n
209 \fBlogin\fR accepts a device option, \fIdevice\fR. \fIdevice\fR is taken to be
210 the path name of the \fBTTY\fR port \fBlogin\fR is to operate on. The use of
211 the device option can be expected to improve \fBlogin\fR performance, since
212 \fBlogin\fR does not need to call \fBttyname\fR(3C). The \fB-d\fR option is
213 available only to users whose \fBUID\fR and effective \fBUID\fR are root. Any
214 other attempt to use \fB-d\fR causes \fBlogin\fR to quietly exit.
215 .RE
217 .sp
218 .ne 2
219 .na
220 \fB\fB-h\fR \fIhostname\fR [\fIterminal\fR]\fR
221 .ad
222 .RS 26n
223 Used by \fBin.telnetd\fR(1M) to pass information about the remote host and
224 terminal type.
225 .sp
226 Terminal type as a second argument to the \fB-h\fR option should not start with
227 a hyphen (\fB-\fR).
228 .RE
230 .sp
231 .ne 2
232 .na
233 \fB\fB-p\fR\fR
234 .ad
235 .RS 26n
236 Used to pass environment variables to the login shell.
237 .RE
239 .sp
240 .ne 2
241 .na
242 \fB\fB-R\fR \fIrepository\fR\fR
243 .ad
244 .RS 26n
245 Used to specify the \fBPAM\fR repository that should be used to tell \fBPAM\fR
246 about the "\fBidentity\fR" (see option \fB-u\fR below). If no "\fBidentity\fR"
247 information is passed, the repository is not used.
248 .RE
250 .sp
251 .ne 2
252 .na
253 \fB\fB-s\fR \fIservice\fR\fR
254 .ad
255 .RS 26n
256 Indicates the \fBPAM\fR service name that should be used. Normally, this
257 argument is not necessary and is used only for specifying alternative \fBPAM\fR
258 service names. For example: "\fBktelnet\fR" for the Kerberized telnet process.
259 .RE
261 .sp
262 .ne 2
263 .na
264 \fB\fB-u\fR \fIidentity\fR\fR
265 .ad
266 .RS 26n
267 Specifies the "\fBidentity\fR" string associated with the user who is being
268 authenticated. This usually is \fBnot\fR be the same as that user's Unix login
269 name. For Kerberized login sessions, this is the Kerberos principal name
270 associated with the user.
271 .RE
273 .SH EXIT STATUS
274 .LP
275 The following exit values are returned:
276 .sp
277 .ne 2
278 .na
279 \fB\fB0\fR\fR
280 .ad
281 .RS 12n
282 Successful operation.
283 .RE
285 .sp
286 .ne 2
287 .na
288 \fBnon-zero\fR
289 .ad
290 .RS 12n
291 Error.
292 .RE
294 .SH FILES
295 .ne 2
296 .na
297 \fB\fB$HOME/.hushlogin\fR\fR
298 .ad
299 .RS 23n
300 Suppresses login messages.
301 .RE
303 .sp
304 .ne 2
305 .na
306 \fB\fB$HOME/.rhosts\fR\fR
307 .ad
308 .RS 23n
309 Private list of trusted hostname/username combinations.
310 .RE
312 .sp
313 .ne 2
314 .na
315 \fB\fB/etc/issue\fR\fR
316 .ad
317 .RS 23n
318 Issue or project identification.
319 .RE
321 .sp
322 .ne 2
323 .na
324 \fB\fB/etc/logindevperm\fR\fR
325 .ad
326 .RS 23n
327 Login-based device permissions.
328 .RE
330 .sp
331 .ne 2
332 .na
333 \fB\fB/etc/motd\fR\fR
334 .ad
335 .RS 23n
336 Message-of-the-day.
337 .RE
339 .sp
340 .ne 2
341 .na
342 \fB\fB/etc/nologin\fR\fR
343 .ad
344 .RS 23n
345 Message displayed to users attempting to login during machine shutdown.
346 .RE
348 .sp
349 .ne 2
350 .na
351 \fB\fB/etc/passwd\fR\fR
352 .ad
353 .RS 23n
354 Password file.
355 .RE
357 .sp
358 .ne 2
359 .na
360 \fB\fB/etc/shadow\fR\fR
361 .ad
362 .RS 23n
363 List of users' encrypted passwords.
364 .RE
366 .sp
367 .ne 2
368 .na
369 \fB\fB/usr/bin/sh\fR\fR
370 .ad
371 .RS 23n
372 User's default command interpreter.
373 .RE
375 .sp
376 .ne 2
377 .na
378 \fB\fB/var/adm/lastlog\fR\fR
379 .ad
380 .RS 23n
381 Time of last login.
382 .RE
384 .sp
385 .ne 2
386 .na
387 \fB\fB/var/adm/loginlog\fR\fR
388 .ad
389 .RS 23n
390 Record of failed login attempts.
391 .RE
393 .sp
394 .ne 2
395 .na
396 \fB\fB/var/adm/utmpx\fR\fR
397 .ad
398 .RS 23n
399 Accounting.
400 .RE
402 .sp
403 .ne 2
404 .na
405 \fB\fB/var/adm/wtmpx\fR\fR
406 .ad
407 .RS 23n
408 Accounting.
409 .RE
411 .sp
412 .ne 2
413 .na
414 \fB\fB/var/mail/\fR\fIyour-name\fR\fR
415 .ad
416 .RS 23n
417 Mailbox for user \fIyour-name\fR.
418 .RE
420 .sp
421 .ne 2
422 .na
423 \fB\fB/etc/default/login\fR\fR
424 .ad
425 .RS 23n
426 Default value can be set for the following flags in \fB/etc/default/login\fR.
427 Default values are specified as comments in the \fB/etc/default/login\fR file,
428 for example, \fBTIMEZONE=EST5EDT\fR.
429 .sp
430 .ne 2
431 .na
432 \fB\fBTIMEZONE\fR\fR
433 .ad
434 .RS 24n
435 Sets the \fBTZ\fR environment variable of the shell (see \fBenviron\fR(5)).
436 .RE
438 .sp
439 .ne 2
440 .na
441 \fB\fBHZ\fR\fR
442 .ad
443 .RS 24n
444 Sets the \fBHZ\fR environment variable of the shell.
445 .RE
447 .sp
448 .ne 2
449 .na
450 \fB\fBULIMIT\fR\fR
451 .ad
452 .RS 24n
453 Sets the file size limit for the login. Units are disk blocks. Default is zero
454 (no limit).
455 .RE
457 .sp
458 .ne 2
459 .na
460 \fB\fBCONSOLE\fR\fR
461 .ad
462 .RS 24n
463 If set, root can login on that device only. This does not prevent execution of
464 remote commands with \fBrsh\fR(1). Comment out this line to allow login by
465 root.
466 .RE
468 .sp
469 .ne 2
470 .na
471 \fB\fBPASSREQ\fR\fR
472 .ad
473 .RS 24n
474 Determines if login requires a non-null password.
475 .RE
477 .sp
478 .ne 2
479 .na
480 \fB\fBALTSHELL\fR\fR
481 .ad
482 .RS 24n
483 Determines if login should set the \fBSHELL\fR environment variable.
484 .RE
486 .sp
487 .ne 2
488 .na
489 \fB\fBPATH\fR\fR
490 .ad
491 .RS 24n
492 Sets the initial shell \fBPATH\fR variable.
493 .RE
495 .sp
496 .ne 2
497 .na
498 \fB\fBSUPATH\fR\fR
499 .ad
500 .RS 24n
501 Sets the initial shell \fBPATH\fR variable for root.
502 .RE
504 .sp
505 .ne 2
506 .na
507 \fB\fBTIMEOUT\fR\fR
508 .ad
509 .RS 24n
510 Sets the number of seconds (between \fB0\fR and \fB900\fR) to wait before
511 abandoning a login session.
512 .RE
514 .sp
515 .ne 2
516 .na
517 \fB\fBUMASK\fR\fR
518 .ad
519 .RS 24n
520 Sets the initial shell file creation mode mask. See \fBumask\fR(1).
521 .RE
523 .sp
524 .ne 2
525 .na
526 \fB\fBSYSLOG\fR\fR
527 .ad
528 .RS 24n
529 Determines whether the \fBsyslog\fR(3C) \fBLOG_AUTH\fR facility should be used
530 to log all root logins at level \fBLOG_NOTICE\fR and multiple failed login
531 attempts at\fBLOG_CRIT\fR.
532 .RE
534 .sp
535 .ne 2
536 .na
537 \fB\fBDISABLETIME\fR\fR
538 .ad
539 .RS 24n
540 If present, and greater than zero, the number of seconds that \fBlogin\fR waits
541 after \fBRETRIES\fR failed attempts or the \fBPAM \fRframework returns
542 \fBPAM_ABORT\fR. Default is \fB20\fR seconds. Minimum is \fB0\fR seconds. No
543 maximum is imposed.
544 .RE
546 .sp
547 .ne 2
548 .na
549 \fB\fBSLEEPTIME\fR\fR
550 .ad
551 .RS 24n
552 If present, sets the number of seconds to wait before the login failure message
553 is printed to the screen. This is for any login failure other than
554 \fBPAM_ABORT\fR. Another login attempt is allowed, providing \fBRETRIES\fR has
555 not been reached or the \fBPAM\fR framework is returned \fBPAM_MAXTRIES\fR.
556 Default is \fB4\fR seconds. Minimum is \fB0\fR seconds. Maximum is \fB5\fR
557 seconds.
558 .sp
559 Both \fBsu\fR(1M) and \fBsulogin\fR(1M) are affected by the value of
560 \fBSLEEPTIME\fR.
561 .RE
563 .sp
564 .ne 2
565 .na
566 \fB\fBRETRIES\fR\fR
567 .ad
568 .RS 24n
569 Sets the number of retries for logging in (see \fBpam\fR(3PAM)). The default is
570 5. The maximum number of retries is 15. For accounts configured with automatic
571 locking (see \fBSECURITY\fR above), the account is locked and \fBlogin\fR
572 exits. If automatic locking has not been configured, \fBlogin\fR exits without
573 locking the account.
574 .RE
576 .sp
577 .ne 2
578 .na
579 \fB\fBSYSLOG_FAILED_LOGINS\fR\fR
580 .ad
581 .RS 24n
582 Used to determine how many failed login attempts are allowed by the system
583 before a failed login message is logged, using the \fBsyslog\fR(3C)
584 \fBLOG_NOTICE\fR facility. For example, if the variable is set to \fB0\fR,
585 \fBlogin\fR logs \fIall\fR failed login attempts.
586 .RE
588 .RE
590 .SH ATTRIBUTES
591 .LP
592 See \fBattributes\fR(5) for descriptions of the following attributes:
593 .sp
595 .sp
596 .TS
597 box;
598 c | c
599 l | l .
600 ATTRIBUTE TYPE ATTRIBUTE VALUE
601 _
602 Interface Stability Committed
603 .TE
605 .SH SEE ALSO
606 .LP
607 \fBcsh\fR(1), \fBexit\fR(1), \fBksh\fR(1), \fBksh93\fR(1), \fBmail\fR(1),
608 \fBmailx\fR(1), \fBnewgrp\fR(1), \fBpasswd\fR(1),
609 \fBrsh\fR(1), \fBsh\fR(1), \fBshell_builtins\fR(1), \fBtelnet\fR(1),
610 \fBumask\fR(1), \fBin.telnetd\fR(1M), \fBlogins\fR(1M),
611 \fBquota\fR(1M), \fBsu\fR(1M), \fBsulogin\fR(1M), \fBsyslogd\fR(1M),
612 \fBuseradd\fR(1M), \fBuserdel\fR(1M), \fBpam\fR(3PAM), \fBrcmd\fR(3SOCKET),
613 \fBsyslog\fR(3C), \fBttyname\fR(3C), \fBauth_attr\fR(4), \fBexec_attr\fR(4),
614 \fBhosts.equiv\fR(4), \fBissue\fR(4), \fBlogindevperm\fR(4), \fBloginlog\fR(4),
615 \fBnologin\fR(4), \fBnsswitch.conf\fR(4), \fBpam.conf\fR(4), \fBpasswd\fR(4),
616 \fBpolicy.conf\fR(4), \fBprofile\fR(4), \fBshadow\fR(4), \fBuser_attr\fR(4),
617 \fButmpx\fR(4), \fBwtmpx\fR(4), \fBattributes\fR(5), \fBenviron\fR(5),
618 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), \fBpam_unix_session\fR(5),
619 \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
620 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_passwd_auth\fR(5),
621 \fBtermio\fR(7I)
622 .SH DIAGNOSTICS
623 .ne 2
624 .na
625 \fB\fBLogin incorrect\fR\fR
626 .ad
627 .sp .6
628 .RS 4n
629 The user name or the password cannot be matched.
630 .RE
632 .sp
633 .ne 2
634 .na
635 \fB\fBNot on system console\fR\fR
636 .ad
637 .sp .6
638 .RS 4n
639 Root login denied. Check the \fBCONSOLE\fR setting in \fB/etc/default/login\fR.
640 .RE
642 .sp
643 .ne 2
644 .na
645 \fB\fBNo directory! Logging in with home=/\fR\fR
646 .ad
647 .sp .6
648 .RS 4n
649 The user's home directory named in the \fBpasswd\fR(4) database cannot be found
650 or has the wrong permissions. Contact your system administrator.
651 .RE
653 .sp
654 .ne 2
655 .na
656 \fB\fBNo shell\fR\fR
657 .ad
658 .sp .6
659 .RS 4n
660 Cannot execute the shell named in the \fBpasswd\fR(4) database. Contact your
661 system administrator.
662 .RE
664 .sp
665 .ne 2
666 .na
667 \fB\fBNO LOGINS: System going down in\fR \fIN\fR \fBminutes\fR\fR
668 .ad
669 .sp .6
670 .RS 4n
671 The machine is in the process of being shut down and logins have been disabled.
672 .RE
674 .SH WARNINGS
675 .LP
676 Users with a \fBUID\fR greater than 76695844 are not subject to password aging,
677 and the system does not record their last login time.
678 .sp
679 .LP
680 If you use the \fBCONSOLE\fR setting to disable root logins, you should arrange
681 that remote command execution by root is also disabled. See \fBrsh\fR(1),
682 \fBrcmd\fR(3SOCKET), and \fBhosts.equiv\fR(4) for further details.
683 .SH NOTES
684 .LP
685 The \fBpam_unix\fR(5) module is no longer supported. Similar functionality is
686 provided by \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5),
687 \fBpam_unix_session\fR(5), \fBpam_authtok_check\fR(5),
688 \fBpam_authtok_get\fR(5), \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), and
689 \fBpam_passwd_auth\fR(5).