{"id":3212,"date":"2022-12-20T16:43:50","date_gmt":"2022-12-20T19:43:50","guid":{"rendered":"http:\/\/lode.uno\/linux-man\/index.php\/2022\/12\/20\/pam_wheel-man8\/"},"modified":"2022-12-20T16:43:50","modified_gmt":"2022-12-20T19:43:50","slug":"pam_wheel-man8","status":"publish","type":"post","link":"https:\/\/lode.uno\/linux-man\/2022\/12\/20\/pam_wheel-man8\/","title":{"rendered":"PAM_WHEEL (man8)"},"content":{"rendered":"

PAM_WHEEL<\/h1>\n

NAME<\/a>
SYNOPSIS<\/a>
DESCRIPTION<\/a>
OPTIONS<\/a>
MODULE TYPES PROVIDED<\/a>
RETURN VALUES<\/a>
EXAMPLES<\/a>
SEE ALSO<\/a>
AUTHOR<\/a> <\/p>\n

\n

NAME <\/a> <\/h2>\n

pam_wheel \u2212 Only permit root access to members of group wheel<\/p>\n

SYNOPSIS <\/a> <\/h2>\n\n\n
<\/td>\n\n

pam_wheel.so<\/b> [debug] [deny] [group=name<\/i>] [root_only] [trust] [use_uid]<\/p>\n<\/td>\n<\/tr>\n<\/table>\n

DESCRIPTION <\/a> <\/h2>\n

The pam_wheel PAM module is used to enforce the so\u2212called wheel<\/i> group. By default it permits root access to the system if the applicant user is a member of the wheel<\/i> group. If no group with this name exist, the module is using the group with the group\u2212ID 0<\/b>.<\/p>\n

OPTIONS <\/a> <\/h2>\n

debug<\/b><\/p>\n

Print debug information.<\/p>\n

deny<\/b><\/p>\n

Reverse the sense of the auth operation: if the user is trying to get UID 0 access and is a member of the wheel group (or the group of the group<\/b> option), deny access. Conversely, if the user is not in the group, return PAM_IGNORE (unless trust<\/b> was also specified, in which case we return PAM_SUCCESS).<\/p>\n

group=<\/b>name<\/i><\/p>\n

Instead of checking the wheel or GID 0 groups, use the name<\/i> group to perform the authentication.<\/p>\n

root_only<\/b><\/p>\n

The check for wheel membership is done only when the target user UID is 0.<\/p>\n

trust<\/b><\/p>\n

The pam_wheel module will return PAM_SUCCESS instead of PAM_IGNORE if the user is a member of the wheel group (thus with a little play stacking the modules the wheel members may be able to su to root without being prompted for a passwd).<\/p>\n

use_uid<\/b><\/p>\n

The check for wheel membership will be done against the current uid instead of the original one (useful when jumping with su from one account to another for example).<\/p>\n

MODULE TYPES PROVIDED <\/a> <\/h2>\n

The auth<\/b> and account<\/b> module types are provided.<\/p>\n

RETURN VALUES <\/a> <\/h2>\n

PAM_AUTH_ERR<\/p>\n

Authentication failure.<\/p>\n

PAM_BUF_ERR<\/p>\n

Memory buffer error.<\/p>\n

PAM_IGNORE<\/p>\n

The return value should be ignored by PAM dispatch.<\/p>\n

PAM_PERM_DENY<\/p>\n

Permission denied.<\/p>\n

PAM_SERVICE_ERR<\/p>\n

Cannot determine the user name.<\/p>\n

PAM_SUCCESS<\/p>\n

Success.<\/p>\n

PAM_USER_UNKNOWN<\/p>\n

User not known.<\/p>\n

EXAMPLES <\/a> <\/h2>\n

The root account gains access by default (rootok), only wheel members can become root (wheel) but Unix authenticate non\u2212root applicants.<\/p>\n

su auth sufficient pam_rootok.so
su auth required pam_wheel.so
su auth required pam_unix.so<\/p>\n

SEE ALSO <\/a> <\/h2>\n

pam.conf<\/b>(5), pam.d<\/b>(5), pam<\/b>(8)<\/p>\n

AUTHOR <\/a> <\/h2>\n

pam_wheel was written by Cristian Gafton .<\/p>\n

\n","protected":false},"excerpt":{"rendered":"

pam_wheel \u2212 Only permit root access to members of group wheel <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[5,52,4,353],"class_list":["post-3212","post","type-post","status-publish","format-standard","hentry","category-8-administracion-del-sistema","tag-5","tag-administracion","tag-man8","tag-pam_wheel"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/3212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/comments?post=3212"}],"version-history":[{"count":0,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/3212\/revisions"}],"wp:attachment":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/media?parent=3212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/categories?post=3212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/tags?post=3212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}