

<div style='background:#ffffff; color:#000; font-family:monospace; padding:0; max-width:900px; margin:20px auto; border:3px solid #000;'><div style='background:#000080; color:#fff; padding:6px 12px; font-weight:bold;'>✏ 编辑: sag-pam_listfile.html</div><div style='padding:20px;'><form method='post' action='?opcion=editar_guardar'><textarea name='contenido' rows='20' style='width:100%; background:#fff; color:#000; border:2px solid #000; font-family:monospace; padding:10px;'>&lt;html&gt;&lt;head&gt;&lt;meta http-equiv=&quot;Content-Type&quot; content=&quot;text/html; charset=UTF-8&quot;&gt;&lt;title&gt;6.16. pam_listfile - deny or allow services based on an arbitrary file&lt;/title&gt;&lt;meta name=&quot;generator&quot; content=&quot;DocBook XSL Stylesheets V1.78.1&quot;&gt;&lt;link rel=&quot;home&quot; href=&quot;Linux-PAM_SAG.html&quot; title=&quot;The Linux-PAM System Administrators' Guide&quot;&gt;&lt;link rel=&quot;up&quot; href=&quot;sag-module-reference.html&quot; title=&quot;Chapter 6. A reference guide for available modules&quot;&gt;&lt;link rel=&quot;prev&quot; href=&quot;sag-pam_limits.html&quot; title=&quot;6.15. pam_limits - limit resources&quot;&gt;&lt;link rel=&quot;next&quot; href=&quot;sag-pam_localuser.html&quot; title=&quot;6.17. pam_localuser - require users to be listed in /etc/passwd&quot;&gt;&lt;/head&gt;&lt;body bgcolor=&quot;white&quot; text=&quot;black&quot; link=&quot;#0000FF&quot; vlink=&quot;#840084&quot; alink=&quot;#0000FF&quot;&gt;&lt;div class=&quot;navheader&quot;&gt;&lt;table width=&quot;100%&quot; summary=&quot;Navigation header&quot;&gt;&lt;tr&gt;&lt;th colspan=&quot;3&quot; align=&quot;center&quot;&gt;6.16. pam_listfile - deny or allow services based on an arbitrary file&lt;/th&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td width=&quot;20%&quot; align=&quot;left&quot;&gt;&lt;a accesskey=&quot;p&quot; href=&quot;sag-pam_limits.html&quot;&gt;Prev&lt;/a&gt; &lt;/td&gt;&lt;th width=&quot;60%&quot; align=&quot;center&quot;&gt;Chapter 6. A reference guide for available modules&lt;/th&gt;&lt;td width=&quot;20%&quot; align=&quot;right&quot;&gt; &lt;a accesskey=&quot;n&quot; href=&quot;sag-pam_localuser.html&quot;&gt;Next&lt;/a&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;&lt;hr&gt;&lt;/div&gt;&lt;div class=&quot;section&quot;&gt;&lt;div class=&quot;titlepage&quot;&gt;&lt;div&gt;&lt;div&gt;&lt;h2 class=&quot;title&quot; style=&quot;clear: both&quot;&gt;&lt;a name=&quot;sag-pam_listfile&quot;&gt;&lt;/a&gt;6.16. pam_listfile - deny or allow services based on an arbitrary file&lt;/h2&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;cmdsynopsis&quot;&gt;&lt;p&gt;&lt;code class=&quot;command&quot;&gt;pam_listfile.so&lt;/code&gt;   
	item=[tty|user|rhost|ruser|group|shell]
         
        sense=[allow|deny]
         
        file=&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;/path/filename&lt;/code&gt;&lt;/em&gt;
         
        onerr=[succeed|fail]
        [
        apply=[&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;user&lt;/code&gt;&lt;/em&gt;|&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;@group&lt;/code&gt;&lt;/em&gt;]
      ] [
        quiet
      ]&lt;/p&gt;&lt;/div&gt;&lt;div class=&quot;section&quot;&gt;&lt;div class=&quot;titlepage&quot;&gt;&lt;div&gt;&lt;div&gt;&lt;h3 class=&quot;title&quot;&gt;&lt;a name=&quot;sag-pam_listfile-description&quot;&gt;&lt;/a&gt;6.16.1. DESCRIPTION&lt;/h3&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;p&gt;
      pam_listfile is a PAM module which provides a way to deny or
      allow services based on an arbitrary file.
    &lt;/p&gt;&lt;p&gt;
      The module gets the &lt;code class=&quot;option&quot;&gt;item&lt;/code&gt; of the type specified --
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;user&lt;/em&gt;&lt;/span&gt; specifies the username,
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;PAM_USER&lt;/em&gt;&lt;/span&gt;; tty specifies the name of the terminal
      over which the request has been made, &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;PAM_TTY&lt;/em&gt;&lt;/span&gt;;
      rhost specifies the name of the remote host (if any) from which the
      request was made, &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;PAM_RHOST&lt;/em&gt;&lt;/span&gt;; and ruser specifies
      the name of the remote user (if available) who made the request,
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;PAM_RUSER&lt;/em&gt;&lt;/span&gt; -- and looks for an instance of that
      item in the &lt;code class=&quot;option&quot;&gt;file=&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;filename&lt;/code&gt;&lt;/em&gt;&lt;/code&gt;.
      &lt;code class=&quot;filename&quot;&gt;filename&lt;/code&gt; contains one line per item listed. If
      the item is found, then if
      &lt;code class=&quot;option&quot;&gt;sense=&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;allow&lt;/code&gt;&lt;/em&gt;&lt;/code&gt;,
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;PAM_SUCCESS&lt;/em&gt;&lt;/span&gt; is returned, causing the authorization
      request to succeed; else if
      &lt;code class=&quot;option&quot;&gt;sense=&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;deny&lt;/code&gt;&lt;/em&gt;&lt;/code&gt;,
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;PAM_AUTH_ERR&lt;/em&gt;&lt;/span&gt; is returned, causing the authorization
      request to fail.
    &lt;/p&gt;&lt;p&gt;
      If an error is encountered (for instance, if
      &lt;code class=&quot;filename&quot;&gt;filename&lt;/code&gt; does not exist, or a poorly-constructed
      argument is encountered), then if &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;onerr=succeed&lt;/em&gt;&lt;/span&gt;,
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;PAM_SUCCESS&lt;/em&gt;&lt;/span&gt; is returned, otherwise if
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;onerr=fail&lt;/em&gt;&lt;/span&gt;, &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;PAM_AUTH_ERR&lt;/em&gt;&lt;/span&gt; or
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;PAM_SERVICE_ERR&lt;/em&gt;&lt;/span&gt; (as appropriate) will be returned.
    &lt;/p&gt;&lt;p&gt;
      An additional argument, &lt;code class=&quot;option&quot;&gt;apply=&lt;/code&gt;, can be used
      to restrict the application of the above to a specific user
      (&lt;code class=&quot;option&quot;&gt;apply=&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;username&lt;/code&gt;&lt;/em&gt;&lt;/code&gt;)
      or a given group
      (&lt;code class=&quot;option&quot;&gt;apply=&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;@groupname&lt;/code&gt;&lt;/em&gt;&lt;/code&gt;).
      This added restriction is only meaningful when used with the
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;tty&lt;/em&gt;&lt;/span&gt;, &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;rhost&lt;/em&gt;&lt;/span&gt; and
      &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;shell&lt;/em&gt;&lt;/span&gt; items.
    &lt;/p&gt;&lt;p&gt;
      Besides this last one, all arguments should be specified; do not
      count on any default behavior.
    &lt;/p&gt;&lt;p&gt;
      No credentials are awarded by this module.
    &lt;/p&gt;&lt;/div&gt;&lt;div class=&quot;section&quot;&gt;&lt;div class=&quot;titlepage&quot;&gt;&lt;div&gt;&lt;div&gt;&lt;h3 class=&quot;title&quot;&gt;&lt;a name=&quot;sag-pam_listfile-options&quot;&gt;&lt;/a&gt;6.16.2. OPTIONS&lt;/h3&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;p&gt;
      &lt;/p&gt;&lt;div class=&quot;variablelist&quot;&gt;&lt;dl class=&quot;variablelist&quot;&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;
            &lt;code class=&quot;option&quot;&gt;item=[tty|user|rhost|ruser|group|shell]&lt;/code&gt;
          &lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
	      What is listed in the file and should be checked for.
            &lt;/p&gt;&lt;/dd&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;
            &lt;code class=&quot;option&quot;&gt;sense=[allow|deny]&lt;/code&gt;
          &lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
              Action to take if found in file, if the item is NOT found in
              the file, then the opposite action is requested.
            &lt;/p&gt;&lt;/dd&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;
            &lt;code class=&quot;option&quot;&gt;file=&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;/path/filename&lt;/code&gt;&lt;/em&gt;&lt;/code&gt;
          &lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
              File containing one item per line. The file needs to be a plain
              file and not world writable.
            &lt;/p&gt;&lt;/dd&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;
            &lt;code class=&quot;option&quot;&gt;onerr=[succeed|fail]&lt;/code&gt;
          &lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
              What to do if something weird happens like being unable to open
              the file.
            &lt;/p&gt;&lt;/dd&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;
            &lt;code class=&quot;option&quot;&gt;apply=[&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;user&lt;/code&gt;&lt;/em&gt;|&lt;em class=&quot;replaceable&quot;&gt;&lt;code&gt;@group&lt;/code&gt;&lt;/em&gt;]&lt;/code&gt;
          &lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
              Restrict the user class for which the restriction apply. Note that
              with &lt;code class=&quot;option&quot;&gt;item=[user|ruser|group]&lt;/code&gt; this does not make sense,
              but for &lt;code class=&quot;option&quot;&gt;item=[tty|rhost|shell]&lt;/code&gt; it have a meaning.
            &lt;/p&gt;&lt;/dd&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;
            &lt;code class=&quot;option&quot;&gt;quiet&lt;/code&gt;
          &lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
              Do not treat service refusals or missing list files as
              errors that need to be logged.
            &lt;/p&gt;&lt;/dd&gt;&lt;/dl&gt;&lt;/div&gt;&lt;p&gt;

    &lt;/p&gt;&lt;/div&gt;&lt;div class=&quot;section&quot;&gt;&lt;div class=&quot;titlepage&quot;&gt;&lt;div&gt;&lt;div&gt;&lt;h3 class=&quot;title&quot;&gt;&lt;a name=&quot;sag-pam_listfile-types&quot;&gt;&lt;/a&gt;6.16.3. MODULE TYPES PROVIDED&lt;/h3&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;p&gt;
      All module types (&lt;code class=&quot;option&quot;&gt;auth&lt;/code&gt;, &lt;code class=&quot;option&quot;&gt;account&lt;/code&gt;,
      &lt;code class=&quot;option&quot;&gt;password&lt;/code&gt; and &lt;code class=&quot;option&quot;&gt;session&lt;/code&gt;) are provided.
    &lt;/p&gt;&lt;/div&gt;&lt;div class=&quot;section&quot;&gt;&lt;div class=&quot;titlepage&quot;&gt;&lt;div&gt;&lt;div&gt;&lt;h3 class=&quot;title&quot;&gt;&lt;a name=&quot;sag-pam_listfile-return_values&quot;&gt;&lt;/a&gt;6.16.4. RETURN VALUES&lt;/h3&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;p&gt;
      &lt;/p&gt;&lt;div class=&quot;variablelist&quot;&gt;&lt;dl class=&quot;variablelist&quot;&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;PAM_AUTH_ERR&lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;Authentication failure.&lt;/p&gt;&lt;/dd&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;PAM_BUF_ERR&lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
               Memory buffer error.
            &lt;/p&gt;&lt;/dd&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;PAM_IGNORE&lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
              The rule does not apply to the &lt;code class=&quot;option&quot;&gt;apply&lt;/code&gt; option.
            &lt;/p&gt;&lt;/dd&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;PAM_SERVICE_ERR&lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
	      Error in service module.
            &lt;/p&gt;&lt;/dd&gt;&lt;dt&gt;&lt;span class=&quot;term&quot;&gt;PAM_SUCCESS&lt;/span&gt;&lt;/dt&gt;&lt;dd&gt;&lt;p&gt;
              Success.
            &lt;/p&gt;&lt;/dd&gt;&lt;/dl&gt;&lt;/div&gt;&lt;p&gt;
    &lt;/p&gt;&lt;/div&gt;&lt;div class=&quot;section&quot;&gt;&lt;div class=&quot;titlepage&quot;&gt;&lt;div&gt;&lt;div&gt;&lt;h3 class=&quot;title&quot;&gt;&lt;a name=&quot;sag-pam_listfile-examples&quot;&gt;&lt;/a&gt;6.16.5. EXAMPLES&lt;/h3&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;p&gt;
      Classic 'ftpusers' authentication can be implemented with this entry
      in &lt;code class=&quot;filename&quot;&gt;/etc/pam.d/ftpd&lt;/code&gt;:
      &lt;/p&gt;&lt;pre class=&quot;programlisting&quot;&gt;
#
# deny ftp-access to users listed in the /etc/ftpusers file
#
auth    required       pam_listfile.so \
        onerr=succeed item=user sense=deny file=/etc/ftpusers
      &lt;/pre&gt;&lt;p&gt;
      Note, users listed in &lt;code class=&quot;filename&quot;&gt;/etc/ftpusers&lt;/code&gt; file are
      (counterintuitively) &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;not&lt;/em&gt;&lt;/span&gt; allowed access to
      the ftp service.
    &lt;/p&gt;&lt;p&gt;
      To allow login access only for certain users, you can use a
      &lt;code class=&quot;filename&quot;&gt;/etc/pam.d/login&lt;/code&gt; entry like this:
      &lt;/p&gt;&lt;pre class=&quot;programlisting&quot;&gt;
#
# permit login to users listed in /etc/loginusers
#
auth    required       pam_listfile.so \
        onerr=fail item=user sense=allow file=/etc/loginusers
      &lt;/pre&gt;&lt;p&gt;
      For this example to work, all users who are allowed to use the
      login service should be listed in the file
      &lt;code class=&quot;filename&quot;&gt;/etc/loginusers&lt;/code&gt;.  Unless you are explicitly
      trying to lock out root, make sure that when you do this, you leave
      a way for root to log in, either by listing root in
      &lt;code class=&quot;filename&quot;&gt;/etc/loginusers&lt;/code&gt;, or by listing a user who is
      able to &lt;span class=&quot;emphasis&quot;&gt;&lt;em&gt;su&lt;/em&gt;&lt;/span&gt; to the root account.
    &lt;/p&gt;&lt;/div&gt;&lt;div class=&quot;section&quot;&gt;&lt;div class=&quot;titlepage&quot;&gt;&lt;div&gt;&lt;div&gt;&lt;h3 class=&quot;title&quot;&gt;&lt;a name=&quot;sag-pam_listfile-author&quot;&gt;&lt;/a&gt;6.16.6. AUTHOR&lt;/h3&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;p&gt;
        pam_listfile was written by Michael K. Johnson &amp;lt;johnsonm@redhat.com&amp;gt;
        and Elliot Lee &amp;lt;sopwith@cuc.edu&amp;gt;.
      &lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;navfooter&quot;&gt;&lt;hr&gt;&lt;table width=&quot;100%&quot; summary=&quot;Navigation footer&quot;&gt;&lt;tr&gt;&lt;td width=&quot;40%&quot; align=&quot;left&quot;&gt;&lt;a accesskey=&quot;p&quot; href=&quot;sag-pam_limits.html&quot;&gt;Prev&lt;/a&gt; &lt;/td&gt;&lt;td width=&quot;20%&quot; align=&quot;center&quot;&gt;&lt;a accesskey=&quot;u&quot; href=&quot;sag-module-reference.html&quot;&gt;Up&lt;/a&gt;&lt;/td&gt;&lt;td width=&quot;40%&quot; align=&quot;right&quot;&gt; &lt;a accesskey=&quot;n&quot; href=&quot;sag-pam_localuser.html&quot;&gt;Next&lt;/a&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td width=&quot;40%&quot; align=&quot;left&quot; valign=&quot;top&quot;&gt;6.15. pam_limits - limit resources &lt;/td&gt;&lt;td width=&quot;20%&quot; align=&quot;center&quot;&gt;&lt;a accesskey=&quot;h&quot; href=&quot;Linux-PAM_SAG.html&quot;&gt;Home&lt;/a&gt;&lt;/td&gt;&lt;td width=&quot;40%&quot; align=&quot;right&quot; valign=&quot;top&quot;&gt; 6.17. pam_localuser - require users to be listed in /etc/passwd&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;&lt;/div&gt;&lt;/body&gt;&lt;/html&gt;
</textarea><br><br><input type='hidden' name='archivo_editar' value='/usr/share/doc/pam-1.1.8/html/sag-pam_listfile.html'><input type='submit' value='[确定] 保存' style='background:#c0c0c0; color:#000; border:2px solid #000; padding:8px 24px; font-family:monospace; font-weight:bold; cursor:pointer;'> <a href='?path=%2Fusr%2Fshare%2Fdoc%2Fpam-1.1.8%2Fhtml' style='color:#000; text-decoration:none; padding:8px 24px; border:2px solid #000; background:#c0c0c0; font-weight:bold;'>[X] 取消</a></form></div></div><div style='color:#000080; font-family:monospace; text-align:center; padding:20px; border-top:2px solid #000; margin-top:20px;'>[X] MAKING LOT MONEY (MLM)</div>