PAM_TIMESTAMP(7) Standards, Environments, and Macros PAM_TIMESTAMP(7)

NAME


pam_timestamp - PAM authentication module using cached successful
authentication attempts

SYNOPSIS


pam_timestamp.so.1 [debug] [timeout=min]

DESCRIPTION


The pam_timestamp module caches successful tty-based authentication
attempts by creating user's directories and per tty timestamp files in the
common timestamp directory /var/run/tty_timestamps. Next authentication,
if the timestamp file exist and not expired, the user will not be asked for
a password, otherwise timestamp file will be deleted and user will be
prompted to enter a password.

The PAM items PAM_USER, PAM_AUSER and PAM_TTY are used by this module.
pam_timestamp is normally configured as sufficient and must be used in
conjunction with the modules that support the UNIX authentication, which
are pam_authtok_get(7), pam_unix_cred(7) and pam_unix_auth(7). Proper
authentication operation requires pam_unix_cred(7) be stacked above
pam_timestamp.

OPTIONS


debug Provides syslog(3C) debugging information at the LOG_AUTH |
LOG_DEBUG level.

timeout
Specifies the period (in minutes) for which the timestamp file is
valid. The default value is 5 minutes.

FILES


/var/run/tty_timestamps/...
stores timestamp directories and files

EXIT STATUS


PAM_SUCCESS
Timestamp file is not expired.

PAM_IGNORE
The pam_timestamp module was not able to retrieve required
credentials or timestamp file is expired or corrupt.

EXAMPLES


Example 1 Allowing su authentication
The following example is a pam.conf(5) fragment that illustrates default
settings for allowing su(8) authentication:

su auth required pam_unix_cred.so.1
su auth sufficient pam_timestamp.so.1
su auth requisite pam_authtok_get.so.1
su auth required pam_unix_auth.so.1

Example 2 Changing default timeout
The default timeout set to 10 minutes:

su auth required pam_unix_cred.so.1
su auth sufficient pam_timestamp.so.1 timeout=10
su auth requisite pam_authtok_get.so.1
su auth required pam_unix_auth.so.1

INTERFACE STABILITY


Uncommitted.

MT LEVEL


MT-Safe.

SEE ALSO


syslog(3C), pam(3PAM), pam_sm_authenticate(3PAM), pam_sm_setcred(3PAM),
pam.conf(5), su(8)

illumos November 26, 2017 illumos