access.conf, In The Stack And Proven With PAM Itself

pam-access

EL ships /etc/security/access.conf with no rules in it, and pam_access is not in the stack to read them. 4,671 bytes of documentation, a control that appears configured, and every account admitted from anywhere. This role writes the policy, puts the module into the authentication stack through authselect - /etc/pam.d/system-auth is a symlink into generated files, so editing it by hand does not survive - and proves each rule by asking PAM.

No download, and no version to pin. pam and authselect are EL 10 packages. What the role owns is access.conf in full and one authselect feature, and what it proves is that a named account gets in from a named place and nobody else does.

The order of the file is the policy. pam_access stops at the first rule that matches, so a blanket allow above a deny makes the deny dead. That is why the template renders the rules in a fixed order and why pam_access_prepend_rules is documented as the dangerous escape hatch rather than the convenient one.

This role can lock you out of a host, so it checks first. With pam_access_deny_all and a group list that does not include you, the next login is refused - and after - : ALL : ALL, root's ssh logins are refused too, because pam_access_allow_root_from is LOCAL by default. Before writing anything the role reads the account this play is connected as, the groups the host gives it, and whether the connection arrived over ssh, and refuses to write a policy that would shut that account out. The check has one limit, stated because it matters: it requires that a non-LOCAL origin exists for root, not that the origin is yours.

A line pam_access cannot parse is ignored, and the account is admitted. Measured: with this is not a rule in the file, the account under test was still allowed. Nothing validates access.conf - there is no checker to give a template validate: - so the live test drives PAM with pamtester rather than reading the file back, and it reads the refusal message as well as the exit code.

First match wins, in both directions. With + : ALL : ALL above - : user : ALL the user was admitted; with the deny first the same user was refused. This is the trap that makes a long access.conf unreadable: a rule added at the top for one host silently retires everything below it.

LOCAL is a real origin, not the absence of one. A rule allowing a user from 10.99.0.0/24 refused that user from 203.0.113.7 and from a console login with no remote host at all. + : root : LOCAL is what admits root on the console, and it is what makes root's network logins refused.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.