head	1.4;
access;
symbols;
locks; strict;
comment	@# @;


1.4
date	97.04.05.06.50.42;	author morgan;	state Exp;
branches;
next	1.3;

1.3
date	97.02.15.18.25.44;	author morgan;	state Exp;
branches;
next	1.2;

1.2
date	97.01.04.21.05.27;	author morgan;	state Exp;
branches;
next	1.1;

1.1
date	96.11.30.20.59.32;	author morgan;	state Exp;
branches;
next	;


desc
@@


1.4
log
@update for .57
@
text
@<!--
   $Id: pam_rhosts.sgml,v 1.3 1997/02/15 18:25:44 morgan Exp morgan $
   
   This file was written by Andrew G. Morgan <morgan@@parc.power.net>
-->

<sect1>The rhosts module

<sect2>Synopsis

<p>
<descrip>

<tag><bf>Module Name:</bf></tag>
<tt/pam_rhosts_auth/

<tag><bf>Author:</bf></tag>
Al Longyear &lt;longyear@@netcom.com&gt;

<tag><bf>Maintainer:</bf></tag>

<tag><bf>Management groups provided:</bf></tag>
authentication

<tag><bf>Cryptographically sensitive:</bf></tag>
	
<tag><bf>Security rating:</bf></tag>

<tag><bf>Clean code base:</bf></tag>
Clean.

<tag><bf>System dependencies:</bf></tag>

<tag><bf>Network aware:</bf></tag>
Standard <tt/inet_addr()/, <tt/gethostbyname()/ function calls.

</descrip>

<sect2>Overview of module

<p>
This module performs the standard network authentication for services,
as used by traditional implementations of <em/rlogin/ and <em/rsh/
etc.

<sect2>Authentication component

<p>
<descrip>

<tag><bf>Recognized arguments:</bf></tag>
<tt/no_hosts_equiv/; <tt/no_rhosts/; <tt/debug/; <tt/no_warn/;
<tt/promiscuous/; <tt/suppress/

<tag><bf>Description:</bf></tag>

The authentication mechanism of this module is based on the contents
of two files; <tt>/etc/hosts.equiv</tt> (or <tt/_PATH_HEQUIV/ in
<tt>#include &lt;netdb.h&gt;</tt>) and <tt>~/.rhosts</tt>.  Firstly,
hosts listed in the former file are treated as equivalent to the
localhost. Secondly, entries in the user's own copy of the latter file
is used to map "<tt/remote-host remote-user/" pairs to that user's
account on the current host. Access is granted to the user if their
host is present in <tt>/etc/hosts.equiv</tt> and their remote account
is identical to their local one, or if their remote account has an
entry in their personal configuration file.

<p>
Some restrictions are applied to the attributes of the user's personal
configuration file: it must be a regular file (as defined by
<tt/S_ISREG(x)/ of POSIX.1); it must be owned by the <em/superuser/ or
the user; it must not be writable by any user besides its owner.

<p>
The module authenticates a remote user (internally specified by the
item <tt/PAM_RUSER/) connecting from the remote host (internally
specified by the item <tt/PAM_RHOST/).  Accordingly, for applications
to be compatible this authentication module they must set these items
prior to calling <tt/pam_authenticate()/.  The module is not capable
of independently probing the network connection for such information.

<p>
In the case of <tt/root/-access, the <tt>/etc/host.equiv</tt> file is
<em/ignored/. Instead, the superuser must have a correctly configured
personal configuration file.

<p>
The behavior of the module is modified by flags:
<itemize>
<item>
<tt/debug/ -
log more information to <tt/syslog(3)/. (XXX - actually, this module
does not do any logging currently, please volunteer to fix this!)

<item>
<tt/no_warn/ -
do not give verbal warnings to the user about failures etc. (XXX -
this module currently does not issue any warnings, please volunteer to
fix this!)

<item>
<tt/no_hosts_equiv/ -
ignore the contents of the <tt>/etc/hosts.equiv</tt> file.

<item>
<tt/no_rhosts/ -
ignore the contents of all user's personal configuration file
<tt>~/.rhosts</tt>.

<item>
<tt/promiscuous/ -
A host entry of `+' will lead to all hosts being granted
access. Without this option, '+' entries will be ignored. Note, that
the <tt/debug/ option will syslog a warning in this latter case.

<item>
<tt/suppress/ -
This will prevent the module from <tt/syslog(3)/ing a warning message
when this authentication fails.  This option is mostly for keeping
logs free of meaningless errors, in particular when the module is used
with the <tt/sufficient/ control flag.

</itemize>
<tag><bf>Examples/suggested usage:</bf></tag>

To allow users to login from trusted remote machines, you should try
adding the following line to your <tt>/etc/pam.conf</tt> file
<em/before/ the line that would otherwise prompt the user for a
password:
<tscreen>
<verb>
#
# No passwords required for users from hosts listed above.
#
login  auth  sufficient  pam_rhosts_auth.so no_rhosts
</verb>
</tscreen>
Note, in this example, the system administrator has turned off all
<em/personal/ <em/rhosts/ configuration files. Also note, that this module
can be used to <em/only/ allow remote login from hosts specified in
the <tt>/etc/host.equiv</tt> file, by replacing <tt/sufficient/ in the
above example with <tt/required/.

</descrip>

<!--
End of sgml insert for this module.
-->
@


1.3
log
@update for .56
@
text
@d2 1
a2 1
   $Id: pam_rhosts.sgml,v 1.2 1997/01/04 21:05:27 morgan Exp morgan $
d52 2
a53 1
<tt/no_hosts_equiv/; <tt/no_rhosts/; <tt/debug/; <tt/no_warn/
d83 3
a85 6
Note, the name "<tt/root/" is hard-wired into the program (XXX - this
should be reconfigurable with a configuration option).  Caution
should be used in the case that the local superuser goes by another
name. In the case of <tt/root/-access, the <tt>/etc/host.equiv</tt>
file is <em/ignored/. Instead, the superuser must have a correctly
configured personal configuration file.
d109 13
@


1.2
log
@fixed pam_rhosts formatting
@
text
@d2 1
a2 1
   $Id: pam_rhosts.sgml,v 1.1 1996/11/30 20:59:32 morgan Exp morgan $
d124 1
a124 1
login  auth  sufficient  /usr/lib/security/pam_rhosts_auth.so no_rhosts
@


1.1
log
@Initial revision
@
text
@d2 1
a2 1
   $Id$
d124 1
a124 2
login	auth	sufficient	/usr/lib/security/pam_rhosts_auth.so
no_rhosts
@
