githubmirror/authselect

profiles/nis/README
114 строк3 KB
Pavel Březina
profiles: add without-pam-u2f-nouserok
25 ноя 2020, 12:37
25 ноя 2020, 12:37db94f7c
Enable NIS for system authentication
====================================

Selecting this profile will enable Network Information Services as the source
of identity and authentication providers.

NIS CONFIGURATION
-----------------

Authselect does not touch NIS configuration. Please, read NIS' documentation
to see how to configure it manually.

AVAILABLE OPTIONAL FEATURES
---------------------------

with-faillock::
    Enable account locking in case of too many consecutive
    authentication failures.

with-mkhomedir::
    Enable automatic creation of home directories for users on their
    first login.

with-ecryptfs::
    Enable automatic per-user ecryptfs.

with-fingerprint::
    Enable authentication with fingerprint reader through *pam_fprintd*.

with-pam-u2f::
    Enable authentication via u2f dongle through *pam_u2f*.

with-pam-u2f-2fa::
    Enable 2nd factor authentication via u2f dongle through *pam_u2f*.

without-pam-u2f-nouserok::
    Module argument nouserok is omitted if also with-pam-u2f-2fa is used.
    *WARNING*: Omitting nouserok argument means that users without pam-u2f
    authentication configured will not be able to log in *INCLUDING* root.
    Make sure you are able to log in before losing root privileges.

with-silent-lastlog::
    Do not produce pam_lastlog message during login.

with-pamaccess::
    Check access.conf during account authorization.

with-nispwquality::
    If this option is set pam_pwquality module will check password quality
    for NIS users as well as local users during password change. Without this
    option only local users passwords are checked.

without-nullok::
    Do not add nullok parameter to pam_unix.

DISABLE SPECIFIC NSSWITCH DATABASES
-----------------------------------

Normally, nsswitch databases set by the profile overwrites values set in
user-nsswitch.conf. The following options can force authselect to
ignore value set by the profile and use the one set in user-nsswitch.conf
instead.

with-custom-aliases::
Ignore "aliases" map set by the profile.

with-custom-automount::
Ignore "automount" map set by the profile.

with-custom-ethers::
Ignore "ethers" map set by the profile.

with-custom-group::
Ignore "group" map set by the profile.

with-custom-hosts::
Ignore "hosts" map set by the profile.

with-custom-initgroups::
Ignore "initgroups" map set by the profile.

with-custom-netgroup::
Ignore "netgroup" map set by the profile.

with-custom-networks::
Ignore "networks" map set by the profile.

with-custom-passwd::
Ignore "passwd" map set by the profile.

with-custom-protocols::
Ignore "protocols" map set by the profile.

with-custom-publickey::
Ignore "publickey" map set by the profile.

with-custom-rpc::
Ignore "rpc" map set by the profile.

with-custom-services::
Ignore "services" map set by the profile.

with-custom-shadow::
Ignore "shadow" map set by the profile.

EXAMPLES
--------
* Enable NIS with no additional modules

  authselect select nis

* Enable NIS and create home directories for users on their first login

  authselect select nis with-mkhomedir