LOGIN.ACCESS(5)

名称
login.access - 登录访问控制表

描述

The login.access file specifies (user, host) combinations and/or (user, tty) combinations for which a login will be either accepted or refused.

When someone logs in, the login.access is scanned for the first entry that matches the (user, host) combination, or, in case of non-networked logins, the first entry that matches the (user, tty) combination. The permissions field of that table entry determines whether the login will be accepted or refused.

登录访问控制表的每一行有“:”分隔的三个字段：

permission:users:origins

The first field should be a "+" (access granted) or "-" (access denied) character. The second field should be a list of one or more login names, group names, or ALL (always matches). The third field should be a list of one or more tty names (for non-networked logins), host names, domain names (begin with "."), host addresses, internet network numbers (end with "."), ALL (always matches) or LOCAL (matches any string that does not contain a "." character). If you run NIS you can use @netgroupname in host or user patterns.

EXCEPT 操作符让编写非常复杂的规则，成为可能。

The group file is searched only when a name does not match that of the logged-in user. Only groups are matched in which users are explicitly listed: the program does not look at a user's primary group id value.

文件

/etc/login.defs
    Shadow 密码套件配置。

参见

login(1).