NAME

       login — authenticate a user and start new session

SYNOPSIS

       login [-fp] [-a level] [-h hostname] [username]

DESCRIPTION

       This  manual page documents  the login program distributed with the Heimdal Kerberos 5 implementation, it
       may differ in important ways from your system version.

       The login programs logs users into the system. It is intended to be run by system daemons  like  getty(8)
       or telnetd(8).  If you are already logged in, but want to change to another user, you should use su(1).

       A username can be given on the command line, else one will be prompted for.

       A  password  is required to login, unless the -f option is given (indicating that the calling program has
       already done proper authentication). With -f the user will be logged in without further questions.

       For password authentication Kerberos 5, OTP (if  compiled  in)  and  local  (/etc/passwd)  passwords  are
       supported.  OTP  will  be  used if the the user is registered to use it, and login is given the option -a
       otp.  When using OTP, a challenge is shown to the user.

       Further options are:

       -a string
               Which authentication mode to use, the only supported value is currently “otp”.

       -f      Indicates that the user is already authenticated. This  happens,  for  instance,  when  login  is
               started by telnetd, and the user has proved authentic via Kerberos.

       -h hostname
               Indicates  which  host  the  user is logging in from. This is passed from telnetd, and is entered
               into the login database.

       -p      This tells login to preserve all environment variables. If  not  given,  only  the  TERM  and  TZ
               variables  are  preserved.  It  could be a security risk to pass random variables to login or the
               user shell, so the calling daemon should make sure it only passes “safe” variables.

       The process of logging user in proceeds as follows.

       First a check is made that logins are allowed at all. This usually means checking  /etc/nologin.   If  it
       exists, and the user trying to login is not root, the contents is printed, and then login exits.

       Then  various  system  parameters  are set up, like changing the owner of the tty to the user, setting up
       signals, setting the group list, and  user  and  group  id.  Also  various  machine  specific  tasks  are
       performed.

       Next  login  changes  to  the users home directory, or if that fails, to /.  The environment is setup, by
       adding some required variables (such as PATH), and also authentication related ones (such as KRB5CCNAME).
       If an environment file exists (/etc/environment), variables are set according to it.

       If one or more login message files are configured, their contents is printed to the terminal.

       If a login time command is configured, it is executed. A logout time  command  can  also  be  configured,
       which  makes login fork, and wait for the user shell to exit, and then run the command.  This can be used
       to clean up user credentials.

       Finally, the user's shell is executed. If the user logging in is root, and root's login  shell  does  not
       exist, a default shell (usually /bin/sh) is also tried before giving up.

ENVIRONMENT

       These environment variables are set by login (not including ones set by /etc/environment):

       PATH           the default system path
       HOME           the user's home directory (or possibly /)
       USER, LOGNAME  both set to the username
       SHELL          the user's shell
       TERM, TZ       set to whatever is passed to login
       KRB5CCNAME     if the password is verified via Kerberos 5, this will point to the credentials cache file

FILES

       /etc/environment
               Contains  a  set  of  environment  variables that should be set in addition to the ones above. It
               should contain sh-style assignments like “VARIABLE=value”.  Note that they are not parsed the way
               a shell would. No variable expansion is performed, and all strings  are  literal,  and  quotation
               marks should not be used. Everything after a hash mark is considered a comment. The following are
               all different (the last will set the variable BAR, not FOO).

                     FOO=this is a string
                     FOO="this is a string"
                     BAR= FOO='this is a string'
       /etc/login.access
               See login.access(5).
       /etc/login.conf
               This  is  a  termcap  style  configuration  file,  that  contains various settings used by login.
               Currently only the “default” capability record is used. The possible capability strings include:

               environment
                       This is a comma separated list of environment files that are read in the order specified.
                       If this is missing the default /etc/environment is used.
               login_program
                       This program will be executed just before the user's shell is started.  It will be called
                       without arguments.
               logout_program
                       This program will be executed just after the user's shell  has  terminated.  It  will  be
                       called without arguments. This program will be the parent process of the spawned shell.
               motd    A  comma  separated list of text files that will be printed to the user's terminal before
                       starting the shell. The string welcome works similarly, but points to a single file.
               limits  Points to a file containing ulimit settings for various users. Syntax is inspired by what
                       pam_limits uses, and the default is /etc/security/limits.conf.
       /etc/nologin
               If it exists, login is denied to all but root. The contents of this file is printed before  login
               exits.

       Other  login  programs  typically print all sorts of information by default, such as last time you logged
       in, if you have mail, and system message files.  This version of login does not, so there  is  no  reason
       for  .hushlogin  files  or  similar.  We feel that these tasks are best left to the user's shell, but the
       login_program facility allows for a shell independent solution, if that is desired.

EXAMPLES

       A login.conf file could look like:

             default:\
                     :motd=/etc/motd,/etc/motd.local:\
                     :limits=/etc/limits.conf:

       The limits.conf file consists of a table with four whitespace separated fields. First field is a username
       or a groupname (prefixed with ‘@’), or ‘*’.  Second field is ‘soft’, ‘hard’, or  ‘-’  (the  last  meaning
       both  soft  and  hard).   Third field is a limit name (such as ‘cpu’ or ‘core’).  Last field is the limit
       value (a number or ‘-’ for unlimited). In the case of data sizes, the value is in kilobytes, and  cputime
       is in minutes.

SEE ALSO

       su(1), login.access(5), getty(8), telnetd(8)

AUTHORS

       This  login  program  was  written  for  the Heimdal Kerberos 5 implementation. The login.access code was
       written by Wietse Venema.

HEIMDAL                                          April 22, 2005                                         LOGIN(1)