Zen

Source string Source string

991/10000 · 991

The string is read only.

English Actions
It is also possible to use logical expression in conditional line instead of specifying single feature name. In this case the expression will evaluate to true or false and the conditional operator will act upon the result.
The expression syntax consists of feature names (e.g. _"feature"_) which returns _true_ if the feature is defined or _false_ if it is not defined and from the following logical operators: _and_, _or_ and _not_. The expression may also be enclosed in parentheses and contain multiple subexpressions.
For example:
*{if "feature1" or "feature2":true}*
If "feature1" or "feature2" is defined, replace this operator with string "true", otherwise with an empty string.
*{if not "feature":true|false}*
If "feature" is not defined, replace this operator with string "true", otherwise with string "false".
*{if not "feature":true}*
If "feature" is not defined, replace this operator with string "true", otherwise with an empty string.
*{if "feature1" and ("feature2" or "feature3"):true}*
If "feature1" is defined, and one of "feature2" and "feature3" is defined replace this operator with string "true", otherwise with an empty string.
EXAMPLE
Here is an example of using "if" operator. If "with-sudo" feature is enabled, it will add "sss" to sudoers line.
passwd: sss files
group: sss files
netgroup: sss files
automount: sss files
services: sss files
sudoers: files {if "with-sudo":sss}
Here is an example of "continue-if" and "include-if" operators. The resulting file will be empty unless "with-smartcard" feature is enabled. If it is enabled and also "with-faillock" feature is enabled, it will also enable support for pam_faillock.
{continue if "with-smartcard"}
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth required pam_faillock.so preauth silent deny=4 unlock_time=1200 {include if "with-faillock"}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_faillock.so authfail deny=4 unlock_time=1200 {include if "with-faillock"}
auth required pam_deny.so
...
Here is an example of "continue-if" using logical expression. The file will be empty unless "with-smartcard" or "with-smartcard-required" is set. This will simplify the call of _authselect select_ command which does not have to include both features but only "with-smartcard-required" is necessary.
{continue if "with-smartcard" or "with-smartcard-required"}
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth required pam_faillock.so preauth silent deny=4 unlock_time=1200 {include if "with-faillock"}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_faillock.so authfail deny=4 unlock_time=1200 {include if "with-faillock"}
auth required pam_deny.so
...
Here is an example of "imply-if" operator. Enabling feature "with-smartcard-required" will also enable "with-smartcard" to make sure that all relevant PAM modules are used. This will achieve the same behavior as the previous example.
{imply "with-smartcard" if "with-smartcard-required"}
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth [success=1 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:kde:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid {include if "with-smartcard-required"}
auth [success=done ignore=ignore default=die] pam_sss.so require_cert_auth ignore_authinfo_unavail {include if "with-smartcard-required"}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so {exclude if "with-smartcard"}
auth [default=2 ignore=ignore success=ok] pam_localuser.so {include if "with-smartcard"}
auth [success=done authinfo_unavail=ignore user_unknown=ignore ignore=ignore default=die] pam_sss.so try_cert_auth {include if "with-smartcard"}
auth sufficient pam_unix.so {if not "without-nullok":nullok}
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
...
CREATING A NEW PROFILE
To register a new profile within authselect, create a directory in one of the authselect profile locations with the files listed above. Not all of the files must be present, only *README* is mandatory. Other files can be created on per-need basis.
You may find *authselect create-profile* command helpful when creating new profile. See *authselect(8)* manual page or *authselect create-profile --help* for more information.
SEE ALSO
authselect(8), nsswitch.conf(5), PAM(8)

Loading…

User avatar None

String updated in the repository
{continue if "with-smartcard"}
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth required pam_faillock.so preauth silent deny=4 unlock_time=1200 {include if "with-faillock"}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_faillock.so authfail deny=4 unlock_time=1200 {include if "with-faillock"}
auth required pam_deny.so
...
{continue if "with-smartcard"}
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth required pam_faillock.so preauth silent deny=4 unlock_time=1200 {include if "with-faillock"}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_faillock.so authfail deny=4 unlock_time=1200 {include if "with-faillock"}
auth required pam_deny.so
...
2 years ago
Browse all string changes

Things to check

Ellipsis

The string uses three dots (...) instead of an ellipsis character (…)

Reset

Glossary

English English
No related strings found in the glossary.

String information

Source string description
type: Plain text
Flags
c-format, ignore-same, no-wrap, read-only
Source string location
./src/man/authselect-profiles.5.adoc:163
String age
2 years ago
Last updated
a year ago
Source string age
2 years ago
Translation file
src/man/po/authselect-profiles.5.adoc.pot, string 61