pam_alreadyloggedin8
Already-logged-in pam module
Usage
[service-name] module-type control-flag pam_alreadyloggedin [options]
Overview
The Already-logged-in authentication service module for PAM, pam_alreadyloggedin provides functionality for only one PAM category: authentication. In terms of the module-type parameter, this is the “auth” feature. It also provides null functions for other PAM categories.
Already-logged-in Authentication Module
The Already-logged-in authentication component (pam_sm_authenticate()), returns success if and only if the target user's ID is identical to a current login specified in the utmp(5) database and verified with matching permissions on that login's respective terminal in /dev. If a user shows up in w(8) output, they will generally be allowed to authenticate using this method.
The following options may be passed to the authentication module:
debug-
Enable verbose output to syslog at LOG_DEBUG level.
no_debug-
Disable verbose output to syslog even it's enabled at compile time.
no_root-
Never allow login with a target user ID of zero.
restrict_tty=ttyglob*-
Only allow login if the terminal device currently being authenticated on matches ttyglob*. The ttyglob* argument is specified as a shell glob, and checked using the fnmatch(3) function. For example,
restrict_tty=/dev/tty[1-6]allows logging from text consoles of physical terminal only. restrict_loggedin_tty=ttyglob*-
Disallow recognition that the user is already logged in unless the terminal device logged in upon matches ttyglob*.
Examples
Modify auth section of the /etc/pam.d/login file like following:
auth required /lib/security/pam_securetty.so auth sufficient /lib/security/pam_alreadyloggedin.so no_root auth required /lib/security/pam_stack.so service=system-auth
Releases
6 releases since Debian 6.0 (Squeeze); the text changed 1 time.