.TH pam_pseudo 5 "Aug 2001" "University of Illinois" "Authentication"
.SH NAME
pam_pseudo \- PAM module for pseudo-user authentication
.SH SYNOPSIS
.B /usr/local/lib/security/pam_pseudo.so.1
.SH DESCRIPTION
.B pam_pseudo
is a shared library which gets dynamically loaded into the PAM
framework.  It provides authentication for pseudo-user accounts to
PAM-aware applications.

The
.B pam_pseudo
module supports a local text file called
.I /etc/pam_pseudo.map
which maps local pseudo-user names to a list of real users allowed to
access them.  The file consists of lines of the format:
.IP
pseudo_user : real_user [...]
.PP
Text beginning with a '#' is ignored through the next newline.
Blank lines and incomplete lines are also ignored.
.SH OPTIONS
The
.B pam_pseudo
module accepts the optional argument
.IR unknown_user=disposition .
This option tells the module what to do when it cannot read the
.I /etc/pam_pseudo.map
file or when the
.I pseudo_user
name is not found in the file.

There are three possible values for
.IR disposition :
.TP
.B fail
The authentication will fail if the pseudo-user is not found in the
.I /etc/pam_pseudo.map
file.
.TP
.B succeed
The authentication will succeed if the pseudo-user is not found in the
.I /etc/pam_pseudo.map
file.
.TP
.B ignore
The authentication attempt will be ignored if the pseudo-user is not found
in the
.I /etc/pam_pseudo.map
file.
.PP
If this option is not specified, the default behavior is for the
authentication request to be denied.
.SH EXAMPLE
A common practice for services with multiple administrators is to
have a pseudo-user account under which the service is installed and
runs.  Each service administrator has their own login, but can su to the
pseudo-user account using their own password.

To set this up, here's what you'd put in
.IR /etc/pam.conf :
.IP
su auth sufficient /usr/local/lib/security/pam_pseudo.so.1 unknown_user=ignore
.br
su auth required /usr/lib/security/pam_unix.so.1
.PP
Then, put the pseudo-user accounts in the
.I /etc/pam_pseudo.map
file:
.IP
# John Smith and Jane Doe allowed to become news
.br
news    : smith jdoe
.PP
.SH BUGS
The
.B pam_pseudo
module only implements the functions for the "auth"
module type (\fBpam_sm_authenticate\fP(3) and \fBpam_sm_setcred\fP(3)).
The module does not implement functions for the "account", "session",
and "password" module types.
.SH FILES
.I /etc/pam_pseudo.map
.br
.I /etc/pam.conf
.SH SEE ALSO
.BR pam (3),
.BR pam.conf (4)
.SH AUTHOR
Mark D. Roth <roth@uiuc.edu>