mirror of
https://github.com/freebsd/freebsd-src.git
synced 2024-12-03 08:22:44 +00:00
87 lines
2.3 KiB
Groff
87 lines
2.3 KiB
Groff
|
.TH SKEY.ACCESS 5
|
||
|
|
.SH NAME
|
||
|
|
skey.access \- S/Key password control table
|
||
|
|
.SH DESCRIPTION
|
||
|
|
The S/Key password control table (default
|
||
|
|
.IR /etc/skey.access )
|
||
|
|
is used by \fIlogin\fR-like programs to determine when UNIX passwords
|
||
|
|
may be used to access the system.
|
||
|
|
.IP \(bu
|
||
|
|
When the table does not exist, there are no password restrictions. The
|
||
|
|
user may enter the UNIX password or the S/Key one.
|
||
|
|
.IP \(bu
|
||
|
|
When the table does exist, UNIX passwords are permitted only when
|
||
|
|
explicitly specified.
|
||
|
|
.IP \(bu
|
||
|
|
For the sake of sanity, UNIX passwords are always permitted on the
|
||
|
|
systems console.
|
||
|
|
.SH "TABLE FORMAT"
|
||
|
|
The format of the table is one rule per line. Rules are matched in
|
||
|
|
order. The search terminates when the first matching rule is found, or
|
||
|
|
when the end of the table is reached.
|
||
|
|
.PP
|
||
|
|
Rules have the form:
|
||
|
|
.sp
|
||
|
|
.in +5
|
||
|
|
permit condition condition...
|
||
|
|
.br
|
||
|
|
deny condition condition...
|
||
|
|
.in
|
||
|
|
.PP
|
||
|
|
where
|
||
|
|
.I permit
|
||
|
|
and
|
||
|
|
.I deny
|
||
|
|
may be followed by zero or more conditions. Comments begin with a `#\'
|
||
|
|
character, and extend through the end of the line. Empty lines or
|
||
|
|
lines with only comments are ignored.
|
||
|
|
.PP
|
||
|
|
A rule is matched when all conditions are satisfied. A rule without
|
||
|
|
conditions is always satisfied. For example, the last entry could
|
||
|
|
be a line with just the word
|
||
|
|
.I deny
|
||
|
|
on it.
|
||
|
|
.SH CONDITIONS
|
||
|
|
.IP "hostname wzv.win.tue.nl"
|
||
|
|
True when the login comes from host wzv.win.tue.nl.
|
||
|
|
.IP "internet 131.155.210.0 255.255.255.0"
|
||
|
|
True when the remote host has an internet address in network
|
||
|
|
131.155.210. The general form of a net/mask rule is:
|
||
|
|
.sp
|
||
|
|
.ti +5
|
||
|
|
internet net mask
|
||
|
|
.sp
|
||
|
|
The expression is true when the host has an internet address for which
|
||
|
|
the bitwise and of
|
||
|
|
.I address
|
||
|
|
and
|
||
|
|
.I mask
|
||
|
|
equals
|
||
|
|
.IR net.
|
||
|
|
.IP "port ttya"
|
||
|
|
True when the login terminal is equal to
|
||
|
|
.IR /dev/ttya .
|
||
|
|
Remember that UNIX passwords are always permitted with logins on the
|
||
|
|
system console.
|
||
|
|
.IP "user uucp"
|
||
|
|
True when the user attempts to log in as
|
||
|
|
.IR uucp .
|
||
|
|
.IP "group wheel"
|
||
|
|
True when the user attempts to log in as a member of the
|
||
|
|
.I wheel
|
||
|
|
group.
|
||
|
|
.SH COMPATIBILITY
|
||
|
|
For the sake of backwards compatibility, the
|
||
|
|
.I internet
|
||
|
|
keyword may be omitted from net/mask patterns.
|
||
|
|
.SH DIAGNOSTICS
|
||
|
|
Syntax errors are reported to the syslogd. When an error is found
|
||
|
|
the rule is skipped.
|
||
|
|
.SH FILES
|
||
|
|
/etc/skey.access, password control table
|
||
|
|
.SH AUTHOR
|
||
|
|
.nf
|
||
|
|
Wietse Venema
|
||
|
|
Eindhoven University of Technology
|
||
|
|
The Netherlands
|