SHIELD.CONF(5)

✨ SHIELD.CONF ✨ (that's section 5 of the File Formats Manual, bestie)

okay so real talk, this is the manual page for shield.conf — yes, lowercase, yes, five, it's a file format page, not a command page, we love a config-file moment 💅

---

🎀 NAME 🎀

shield.conf — the pam_shield configuration file, aka the glow-up instructions for your login security 🫶

---

🌸 DESCRIPTION 🌸

/etc/security/shield.conf is the configuration file for the PAM module pam_shield, and what does that icon do? it locks out remote attackers trying password guessing. literally it's the bouncer at the club of your server, no cap 👑

---

⭐ OPTIONS ⭐

here's the whole menu, every single one, don't skip, i will know 🌈

• debug [on|off] — turn logging of debugging info on or off. it goes out via syslog(3) 📝
• block [all-users|unknown-users] — block literally everyone, or just the unknown ones. whether a user counts as "known" is decided by getpwnam(3) 🔍
• allow_missing_dns [yes|no] — if no, reject any connection coming from a numerical IP address that has no DNS name. that's the name you get back from pam_get_item(3) with item_type set to PAM_RHOST 💀
• allow_missing_reverse [yes|no] — if no, reject any connection from a host that has no reverse DNS entry 🙈
• allow hostname — a host or network to whitelist 🫶 these hosts get passed straight through with no checks and no logging, they're VIP, they're on the list. you can have multiple allow lines, go off. hostname can be an IP address, a hostname, a network/netmask, or a network in CIDR format ✨
• db filename — the database file where login attempts get stored 💾
• trigger_cmd command — the command to run in order to block/unblock a host. peep shield-trigger(8) and shield-trigger-iptables(8) for two example situations 🔥
• max_conns n — a host gets blocked if there are more than n connection attempts from one host within interval time 🚫
• interval n — a host gets blocked if there are more than max_conns attempts within n seconds. and instead of plain seconds you can use a suffix: s for seconds, m minutes, h hours, d days, w weeks, M months (30 days), y years ⏰
• retention n — the record of connection attempts is kept for n seconds. suffixes work here too, same as interval 💖 each host gets checked for expiration whenever it tries to connect, and the entire database gets checked whenever shield-purge(8) runs (by default, once a day) 🧹

---

🦋 FILES 🦋

• /etc/security/shield.conf — Configuration file for pam-shield 🎀

---

👑 SEE ALSO 👑

shield-purge(8), shield-trigger(8), shield-trigger-iptables(8) — go read them, they're the supporting cast and they ate 💅

---

💜 AUTHORS 💜

pam-shield was written by and copyright 2007 Walter de Jong <walter@heiho.net>. This manpage copyright 2010-2012 Jonathan Niehof <jtniehof@gmail.com>.

---

and that's the whole thing bestie, we're done here 💖 this was pam_shield 0.9.6, dated 11 May 2012 — yes the date is giving vintage but she still slays 🎀 stay safe out there, hydrate, and check your logs 🫶✨