freebsd-ports/security/pam_abl/files/patch-doc-index.html at 5bed712e62c85797aff8df9863e163df368d745f

Pav Lucistnik bf663cc26b The pam_abl provides auto blacklisting of hosts and users

responsible for repeated failed authentication attempts.

WWW: http://www.hexten.net/pam_abl/

PR:		ports/100635
Submitted by:	Petr Rehor <prehor@gmail.com>

2006-09-01 18:34:03 +00:00

4.7 KiB

Raw Blame History

--- doc/index.html.orig Wed Oct 12 21:22:27 2005 +++ doc/index.html Sat Jan 14 22:48:16 2006 @@ -44,7 +44,7 @@

Requires Berkeley DB (tested with 4.3.21 and 4.2.50).
- Requires a configuration file (by convention /etc/security/pam_abl.conf)

+ Requires a configuration file (by convention %%ETCPREFIX%%/etc/pam_abl.conf)

Network aware:

@@ -171,28 +171,26 @@

Typically pam_abl.so is added to the auth stack as a required module just before whatever modules actually peform authentication. Here's a fragment of the PAM config for a production server that is running pam_abl:

- - - - + +

auth	required	/lib/security/pam_env.so
auth	required	/lib/security/pam_abl.so config=/etc/security/pam_abl.conf
auth	sufficient	/lib/security/pam_unix.so likeauth nullok
auth	required	/lib/security/pam_deny.so
auth	required	%%PREFIX%%/lib/pam_abl.so config=%%ETCPREFIX%%/etc/pam_abl.conf
auth	required	pam_unix.so no_warn try_first_pass nullok

Although all of accepted arguments can be supplied here they will usually be placed in a separate config file and linked to using the config argument as in the above example. The pam_abl command line tool reads the external config file (/etc/security/pam_abl.conf in this case) to find the databases so in order for it work correctly an external config should be used.

Although all of accepted arguments can be supplied here they will usually be placed in a separate config file and linked to using the config argument as in the above example. The pam_abl command line tool reads the external config file (%%ETCPREFIX%%/etc/pam_abl.conf in this case) to find the databases so in order for it work correctly an external config should be used.

Config file syntax:

The config file can contain any arguments that would be supplied via PAM config. In the config file arguments are placed on separate lines. Comments may be included after a '#' and line continuation is possible by placing a back slash at the end of the line to be continued. Here is a sample /etc/security/pam_abl.conf:

- + - + - +

# /etc/security/pam_abl.conf

# %%ETCPREFIX%%/etc/pam_abl.conf

debug

host_db=/var/lib/abl/hosts.db

host_db=%%PAMABLDB%%/hosts.db

host_purge=2d

host_rule=*:10/1h,30/1d

user_db=/var/lib/abl/users.db

user_db=%%PAMABLDB%%/users.db

user_purge=2d

user_rule=!root:10/1h,30/1d

@@ -282,21 +280,19 @@

Sample PAM config fragment: