'\" te
.\"  Copyright (c) 2005, Sun Microsystems, Inc.  All Rights Reserved
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH PAM_DENY 7 "August 19, 2023"
.SH NAME
pam_deny \- PAM authentication, account, session and password management PAM
module to deny operations
.SH SYNOPSIS
.nf
\fBpam_deny.so.1\fR
.fi

.SH DESCRIPTION
The \fBpam_deny\fR module implements all the PAM service module functions and
returns the module type default failure return code for all calls.
.sp
.LP
The following options are interpreted:
.sp
.ne 2
.na
\fBdebug\fR
.ad
.RS 9n
\fBsyslog\fR(3C) debugging information at the \fBLOG_AUTH\fR|\fBLOG_DEBUG\fR
levels
.RE

.SH ERRORS
The following error codes are returned:
.sp
.ne 2
.na
\fB\fBPAM_ACCT_EXPIRED\fR\fR
.ad
.RS 20n
If \fBpam_sm_acct_mgmt\fR is called.
.RE

.sp
.ne 2
.na
\fB\fBPAM_AUTH_ERR\fR\fR
.ad
.RS 20n
If \fBpam_sm_authenticate\fR is called.
.RE

.sp
.ne 2
.na
\fB\fBPAM_AUTHTOK_ERR\fR\fR
.ad
.RS 20n
If \fBpam_sm_chauthtok\fR is called.
.RE

.sp
.ne 2
.na
\fB\fBPAM_CRED_ERR\fR\fR
.ad
.RS 20n
If \fBpam_sm_setcred\fR is called.
.RE

.sp
.ne 2
.na
\fB\fBPAM_SESSION_ERR\fR\fR
.ad
.RS 20n
If \fBpam_sm_open_session\fR or \fBpam_sm_close_session\fR is called.
.RE

.SH EXAMPLES
\fBExample 1 \fRDisallowing ssh none authentication
.sp
.in +2
.nf
 sshd-none      auth       requisite   pam_deny.so.1
 sshd-none      account    requisite   pam_deny.so.1
 sshd-none      session    requisite   pam_deny.so.1
 sshd-none      password   requisite   pam_deny.so.1
.fi
.in -2
.sp

.LP
\fBExample 2 \fRDisallowing any service not explicitly defined
.sp
.in +2
.nf
 other          auth       requisite   pam_deny.so.1
 other          account    requisite   pam_deny.so.1
 other          session    requisite   pam_deny.so.1
 other          password   requisite   pam_deny.so.1
.fi
.in -2
.sp

.SH ATTRIBUTES
See \fBattributes\fR(7) for a description of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability	Evolving
_
MT Level	MT-Safe with exceptions
.TE

.SH SEE ALSO
.BR syslog (3C),
.BR libpam (3LIB),
.BR pam (3PAM),
.BR pam_sm_authenticate (3PAM),
.BR nsswitch.conf (5),
.BR pam.conf (5),
.BR attributes (7),
.BR pam_authtok_check (7),
.BR pam_authtok_get (7),
.BR pam_authtok_store (7),
.BR pam_dhkeys (7),
.BR pam_passwd_auth (7),
.BR pam_unix_account (7),
.BR pam_unix_auth (7),
.BR pam_unix_session (7),
.BR privileges (7),
.BR su (8)
.SH NOTES
The interfaces in \fBlibpam\fR(3LIB) are MT-Safe only if each thread within the
multi-threaded application uses its own PAM handle.
.sp
.LP
The \fBpam_deny\fR module is intended to deny access to a specified service.
The \fBother\fR service name may be used to deny access to services not
explicitly specified.