githubmirror/authselect

profiles/local/README
85 строк2 KB
Pavel Březina
profiles: add with-group-merging feature
28 май 2026, 14:26
28 май 2026, 14:26e791266
Local users only
================

Selecting this profile will enable local files as the source of identity
and authentication providers.

AVAILABLE OPTIONAL FEATURES
---------------------------

with-faillock::
    Enable account locking in case of too many consecutive
    authentication failures.

with-mkhomedir::
    Enable automatic creation of home directories for users on their
    first login.

with-ecryptfs::
    Enable automatic per-user ecryptfs.

with-fingerprint::
    Enable authentication with fingerprint reader through *pam_fprintd*.

with-pam-gnome-keyring::
    Enable pam-gnome-keyring support.

with-pam-u2f::
    Enable authentication via u2f dongle through *pam_u2f*.

with-pam-u2f-2fa::
    Enable 2nd factor authentication via u2f dongle through *pam_u2f*.

without-pam-u2f-nouserok::
    Module argument nouserok is omitted if also with-pam-u2f-2fa is used.
    *WARNING*: Omitting nouserok argument means that users without pam-u2f
    authentication configured will not be able to log in *INCLUDING* root.
    Make sure you are able to log in before losing root privileges.

with-silent-lastlog::
    Do not produce pam_lastlog message during login.

without-lastlog-showfailed::
    Do not print number of failed login attempts during login.

with-pamaccess::
    Check access.conf during account authorization.

with-pwhistory::
    Enable pam_pwhistory module for local users.

with-altfiles::
    Use nss_altfiles for passwd and group nsswitch databases.

with-group-merging::
    Enable merging of group records from multiple NSS sources using
    [SUCCESS=merge]. Required for services like systemd-homed that
    advertise users as part of system groups.

with-mdns4::
    Enable multicast DNS over IPv4.

with-mdns6::
    Enable multicast DNS over IPv6.

with-systemd-homed::
    If set, pam_systemd_homed is enabled for all pam operations.

with-libvirt::
    Enable connecting to libvirt VMs using the hostname configured in the
    guest OS or, as a fallback, their name.

without-nullok::
    Do not add nullok parameter to pam_unix.

EXAMPLES
--------

* Enable local profile

  authselect select local

SEE ALSO
--------
* man passwd(5)
* man group(5)