PAM_ABL(1)

📦
version 0.6.0 · 7 versions
, in ubuntu noble, ubuntu questing

💖 PAM_ABL(1) 💖

okay bestie, gather round, because we're talking about pam_abl — the lil command-line bestie from the User Commands fam. it's a whole separate little tool that lets you poke at the same databases the pam_abl module uses, except you don't need to be PAM to do it. iconic behavior honestly.

✨ NAME ✨

pam_abl — query or purge the databases used by the pam_abl module.

no cap, that's literally the whole job description. 💅

🌸 SYNOPSIS 🌸

pam_abl [OPTION] [CONFIG]

🦋 DESCRIPTION 🦋

so basically? it gives you a non-pam interface to all the info chilling in the pam_abl module databases. think of it like a backstage pass. 🎀

CONFIG is the name of the pam_abl config file, and it defaults to /etc/security/pam_abl.conf if you don't hand it one.

the config file gets read so the tool can figure out:

  • the names of the pam_abl databases 👑
  • the rules that control purging of old data from them 🧹
  • the commands to run when a user or host switches state 🔄

⭐ OPTIONS ⭐

🛠️ MAINTENANCE 🛠️

  • -h, --help — see this message. that's it, that's the option. self-care fr.
  • -d, --debugcommand — print the block/clear commands split in arguments. little peek behind the curtain, ngl.
  • -p, --purge — purge databases according to purge rules in config. spring cleaning energy 🌸
  • -r, --relative — display times relative to now. so instead of a timestamp you get the "3 mins ago" vibe.
  • -v, --verbose — verbose output. more words, more info, more everything ✨

🚫 NON-PAM INTERACTION 🚫

  • -f, --fail — fail user or host. yes, you can just. do that.
  • -w, --whitelist — perform whitelisting (remove from blacklist, does not provide immunity). ⚠️ listen: this is a remove from the blacklist situation, it does not grant immunity, okay? don't get it twisted.
  • -c, --check — check status. returns non-zero if currently blocked. prints name: status if verboseness is specified. if more than one host or user is given, it checks only the first host/user pair. so like. don't spam it and expect all the answers bestie 💀
  • -u, --update — update the state of all users/hosts in the db. this will also cause the appropriate scripts to be called. she does extra 👑
  • -s, --service — operate in context of specified service. defaults to none.
  • -U, --user — operate on user (wildcards are ok for whitelisting). 🎀
  • -H, --host — operate on host (wildcards are ok for whitelisting). 🌈
  • -R, --reason — only used when -f is provided (defaults to "AUTH"). specifies why the authentication failed. possible values are USER, HOST, BOTH, AUTH. pick one, it's giving multiple choice 📝
💌 okay so important thing, bestie: if you specified commands to run in your configuration, those commands will try to run if the host or user switches state (blocked <→ clear) since the last time it was checked.
the command will only be able to run, however, if you supply enough information to fill in the substitutions in the command. for instance, if your host_clr_command uses the %s parameter, you will need to specify the service with -s in order for the command to actually run. no info, no script, periodt. 🫶

🍓 EXAMPLES 🍓

obtain a list of failed hosts and users:

$ pam_abl

obtain a full list of failures listing times relative to now:

$ pam_abl -rv $ pam_abl --relative --verbose

purge old data:

$ pam_abl -p $ pam_abl --purge

unblock all example.com, somewhere.com hosts:

$ pam_abl -w -H *.example.com -H \*.somewhere.com

fail the host badguy.com and the user joe because the authentication failed:

$ pam_abl -f -H badguy.com -U joe -R AUTH

check whether joe is currently allowed to use your neato service from somehost, running the necessary commands if he switches state:

$ pam_abl -c -U joe -H somehost -s neato

because the user/host state is only updated when an attempt is made, you can manually force pam-abl to update the states and call the correct scripts:

$ pam_abl -u

💜 AUTHORS 💜

  • Lode Mertens <pam-abl@danta.be>
  • Andy Armstrong <andy@hexten.net>
  • Chris Tasma <pam-abl@deksai.com>

the founding mothers/fathers of this whole situation, we stan 👑

🐛 REPORTING BUGS 🐛

report bugs to <pam-abl@deksai.com> or using the bugtracker on sourceforge.

found a bug? tell them!! they wanna know!! don't suffer in silence bestie 😭

🌈 SEE ALSO 🌈

pam_abl.conf(5), pam_abl(8)

go read those too, iykyk 💅

⭐ AUTHOR ⭐

Chris Tasma — Author.

and that's the whole page!! this one's from the GNU girlies, dated 03/31/2024, and it lives in section PAM_ABL(1) of the manual. stay unblocked, stay iconic, mwah 🫶💖✨

📦 where this page comes from