NAME

     pam_alreadyloggedin — Already-logged-in PAM module

SYNOPSIS

     [service-name] module-type control-flag pam_alreadyloggedin [options]

DESCRIPTION

     The Already-logged-in authentication service module for PAM, pam_alreadyloggedin provides
     functionality for only one PAM category: authentication.  In terms of the module-type
     parameter, this is the “auth” feature.  It also provides null functions for other PAM
     categories.

   Already-logged-in Authentication Module
     The Already-logged-in authentication component (pam_sm_authenticate()), returns success if
     and only if the target user's ID is identical to a current login specified in the utmp(5)
     database and verified with matching permissions on that login's respective terminal in /dev.
     If a user shows up in w(8) output, they will generally be allowed to authenticate using this
     method.

     The following options may be passed to the authentication module:

     debug                           Enable verbose output to syslog at LOG_DEBUG level.

     no_debug                        Disable verbose output to syslog even it's enabled at
                                     compile time.

     no_root                         Never allow login with a target user ID of zero.

     restrict_tty=ttyglob*           Only allow login if the terminal device currently being
                                     authenticated on matches ttyglob*.  The ttyglob* argument is
                                     specified as a shell glob, and checked using the fnmatch(3)
                                     function. For example, restrict_tty=/dev/tty[1-6] allows
                                     logging from text consoles of physical terminal only.

     restrict_loggedin_tty=ttyglob*  Disallow recognition that the user is already logged in
                                     unless the terminal device logged in upon matches ttyglob*.

EXAMPLE

     Modify auth section of the /etc/pam.d/login file like following:

           auth required   /lib/security/pam_securetty.so
           auth sufficient /lib/security/pam_alreadyloggedin.so no_root
           auth required   /lib/security/pam_stack.so service=system-auth

BUGS

     FreeBSD version expects /dev/ prefix in restrict_tty value, but value of
     restrict_loggedin_tty should be without them.  Linux version expects /dev/ in both cases.

SEE ALSO

     fnmatch(3), getuid(2), stat(2), utmp(5), w(8), pam.conf(5), pam(8)

AUTHORS

     Adopted for Linux PAM by Ilya Evseev at Jan 2004.

     The original pam_alreadyloggedin module and this manual page were developed for the FreeBSD
     Project by NAI Labs and ThinkSec AS, the Security Research Division of Network Associates,
     Inc.  under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS
     research program.