geoip.conf(5)

✨ geoip.conf(5) — the config file for pam_geoip, bestie edition ✨

okay so you're here because you want your PAM module pam_geoip to know where people are logging in from, and this little file is where you tell it. it's giving ✨access control but make it geography✨. let's go 💅

---

💖 NAME 💖

geoip.conf — the config file for the PAM module pam_geoip. that's it, that's the name, slay 🫶

---

🌸 DESCRIPTION 🌸

so the config file (by default it lives at /etc/security/geoip.conf) is made of lines with four things on them: domain, service, action and location. what do those mean?? keep reading babes, i got you 💖

when you use the service specific config file, which is /etc/security/geoip.SERVICE.conf, the service column must not be there. and listen — if this file exists, the default file is not used, even if it's sitting right there on the command line as system_file=/file/name. no cap, it just gets ignored 🙈

if you need to match on city names that have non ascii(7) characters (think "DE, Köln" or "SE, Växjö"), you can set the character set to use in the module's arguments: "iso-8859-1" or "UTF-8" — and "UTF-8" is the default, periodt ✨

any (sub-)item except for action or the distance matching can use a single asterisk ("*") to match any value. wildcard queen 👑

🎀 the four items, explained 🎀

• domain — a user name, a group name (prefixed by "@"), or "*" for any user / group. like, everyone's invited or nobody's invited, your call 💅
• service — a list of services (or "*") separated by ",". and bestie, NO spaces allowed. i said what i said 🚫
• action — one of "allow", "deny" or "ignore". this is literally what gets returned to PAM if the location matches:
  • allow → PAM_ALLOW
  • deny → PAM_PERM_DENIED
  • ignore → PAM_IGNORE
• location — a GeoIP location, separated by ";". it can be:
  • a country code (uppercased, two characters), "*" or "UNKNOWN"
  • a country code like above, then ",", then a city name (or "*"). when you're using a GeoIP country database, this part must be "*", i.e. the full entry looks like "DE, *".
  • a distance from a given point, e.g.

50.0 { 51.513888, 7.465277 }

this one is not available when you're using a GeoIP country database. sad but true 😭

the location part is allowed to use spaces, but note this: city names must be written exactly as they are in the GeoIP database, i.e. "Mountain View", NOT "Moutain View" and NOT "MountainView". spelling matters, the database is not doing autocorrect for you 💀

the distance is measured in kilometers. in the example above we're matching a circle of 100 km diameter around Dortmund, Germany — that's 51° 30′ 50″ north, 7° 27′ 50″ east, or (51.513888888889, 7.465277777777876) if you want the numbers. coordinates to the west and to the south get given as negative values. and values must be given in decimal. fr fr 🔥

---

🌈 EXAMPLE 🌈

here's the whole vibe in one block 🧚

 #
 # /etc/security/geoip.conf - config for pam_geoip.so
 #

 #<domain>   <service>  <action>  <location>
 @wheel      sshd       allow     DE,* ; SE , Nybro
 @wheel      sshd       allow     SE, Emmaboda; SE,Växjö
 someuser    sshd       allow     50.0 { 51.513888, 7.465277 }
 someuser    sshd       allow     DE,Köln
 otheruser   sshd       allow     SE,Umeå; DK, København
 *           *          ignore    UNKNOWN
 *           *          deny      *
 ## END

or the exact same thing as /etc/security/geoip.sshd.conf — notice the service column dipped out because the filename already said sshd 💅

 #<domain>     <action>  <location>
 @wheel        allow     DE,* ; SE , Nybro
 @wheel        allow     SE, Emmaboda; SE,Växjö
 someuser      allow     50.0 { 51.513888, 7.465277 }
 someuser      allow     DE,Köln
 otheruser     allow     SE,Umeå; DK, København
 *             ignore    UNKNOWN
 *             deny      *

---

🦋 SEE ALSO 🦋

pam_geoip(8), pam_access(8), pam.d(5), pam(7) — go read these too, iykyk 📚

---

👑 AUTHOR 👑

Amish - GeoIP2 Hanno Hecker - Legacy GeoIP "<vetinari@ankh-morp.org>" — absolute legends, we love them 🫶

---

and that's the whole page bestie!! this one's from 2024-02-05, and it's the geoip.conf(5) manual page. go forth and geo-block responsibly ✨💖 bye!! 🎀