为什么我的pam_access.so不起作用？请帮我分析一下？

zw123

more /etc/security/access.conf

#
#-:wsbscaro wsbsecr wsbspac wsbsym wscosor wstaiwde:ALL
#
# All other accounts are allowed to login from anywhere.
#
_:ALL:ALL

more /etc/pam.d/sshd

auth       required     pam_stack.so service=system-auth
auth       required     pam_nologin.so
account    required     pam_access.so
account    required     pam_stack.so service=system-auth
password   required     pam_stack.so service=system-auth
session    required     pam_stack.so service=system-auth

可是我用ssh登录系统自如，根本没起到访问控制的作用？？？

zw123

然后我用一个redhat 进行测试结果如下：
May 17 22:13:45 ftp pam_access[3362]: /etc/security/access.conf: line 59: bad first field
May 17 22:13:45 ftp sshd(pam_unix)[3364]: session opened for user redhat by (uid=0)


这一行有错吗？？_:ALL:ALL

我修改了一下
+:ALL EXCCEPT redhat :164.70.12.0

然后用redhat
#tail -f /var/log/messages
May 17 22:19:45 ftp sshd(pam_unix)[3487]: session opened for user redhat by (uid=0)

为什么不起作用呢？？

谢谢啊！！

zw123

我修改了一下
+:ALL EXCCEPT redhat :164.70.12.0

然后用redhat
#tail -f /var/log/messages
May 17 22:19:45 ftp sshd(pam_unix)[3487]: session opened for user redhat by (uid=0)

为什么不起作用呢？？

谢谢啊！！

晨想

access.conf 59行是什么。。。

james_guan

如果你想限制redhat用户从164.70.12.0/24登录，可以使用
-:redhat:164.70.12.

richardliu1123

应该是顶格写
--------------------------------------/usr/share/doc/pam-0.77/txts/READ.pam_access-----------

Format of the login access control table is three fields separated by a
# ":" character:
#
#       permission : users : origins
#
# The first field should be a "+" (access granted) or "-" (access denied)
# character.
#
# The second field should be a list of one or more login names, group
# names, or ALL (always matches). A pattern of the form user@host is
# matched when the login name matches the "user" part, and when the
# "host" part matches the local machine name.
#
# The third field should be a list of one or more tty names (for
# non-networked logins), host names, domain names (begin with "."), host
# addresses, internet network numbers (end with "."), ALL (always
# matches) or LOCAL (matches any string that does not contain a "."
# character).