PAM_ALREADYLOGGEDIN(8)

💖 PAM_ALREADYLOGGEDIN 💖

okay bestie, welcome to pam_alreadyloggedin — the Already-logged-in PAM module, straight out of the System Manager's Manual, section 8. pull up a chair, we're gonna vibe with authentication 💅

---

✨ NAME ✨

pam_alreadyloggedin — the Already-logged-in PAM module. that's it, that's the name, iconic behavior fr fr 🎀

---

🌸 SYNOPSIS 🌸

[service-name] module-type control-flag pam_alreadyloggedin [options]

look at that. so simple. so clean. the way she just slots into your PAM config 😭💖

---

🦋 DESCRIPTION 🦋

so, pam_alreadyloggedin is the Already-logged-in authentication service module for PAM. she provides functionality for only one PAM category: authentication. in terms of the module-type parameter, that's the "auth" feature. and for all the other PAM categories? she gives you null functions. basically she shows up, does her one job, and does not overextend herself. boundaries! we love to see it 👑

🔐 Already-logged-in Authentication Module 🔐

the Already-logged-in authentication component — that's pam_sm_authenticate() — returns success if and only if the target user's ID is identical to a current login specified in the utmp(5) database and verified with matching permissions on that login's respective terminal in /dev. periodt, no cap.

and like, the vibe check here is: if a user shows up in w(8) output, they will generally be allowed to authenticate using this method. slay 🫶

the following options may be passed to the authentication module:

• debug — turn on verbose output to syslog at LOG_DEBUG level. she's gonna talk, bestie.
• no_debug — turn off verbose output to syslog, even when it's enabled at compile time. shhh. 🤫
• no_root — never ever allow login with a target user ID of zero. protect the root account, she's sacred 💜
• restrict_tty=*ttyglob** — only allow login if the terminal device currently being authenticated on matches *ttyglob**. the *ttyglob** argument is specified as a shell glob, and checked using the fnmatch(3) function. for example, restrict_tty=/dev/tty[1-6] allows logging from text consoles of physical terminal only. very specific. very demure. 🌈
• restrict_loggedin_tty=*ttyglob** — disallow recognition that the user is already logged in unless the terminal device logged in upon matches *ttyglob**. yes, the globs are different jobs, don't get it twisted 🙈

---

⭐ EXAMPLE ⭐

modify the auth section of the /etc/pam.d/login file like the following:

auth required   /lib/security/pam_securetty.so
auth sufficient /lib/security/pam_alreadyloggedin.so no_root
auth required   /lib/security/pam_stack.so service=system-auth

see how she's sitting in there with sufficient? main character energy, no notes 🔥

---

💀 BUGS 💀

okay so this is the part where we get a lil messy, and you need to hear me out:

the FreeBSD version expects the /dev/ prefix in the restrict_tty value, but the value of restrict_loggedin_tty should be without them. the Linux version expects /dev/ in both cases.

not me having to read that twice 😭 it's giving "portability was not the priority". just. remember which platform you're on, bestie. that's all I'm saying. 🙈

---

👑 SEE ALSO 👑

fnmatch(3), getuid(2), stat(2), utmp(5), w(8), pam.conf(5), pam(8)

the whole friend group. go read them, they're all lowkey useful 🧚

---

💜 AUTHORS 💜

adopted for Linux PAM by Ilya Evseev at Jan 2004. thank you for your service, king 🫶

the original pam_alreadyloggedin module and this manual page were developed for the FreeBSD Project by NAI Labs and ThinkSec AS, the Security Research Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research program. academia said "we're gonna build authentication infrastructure" and honestly? they ate 🍓

---

and that's the whole page, bestie!! 🌸 this was Linux-PAM, dated January 30, 2004 — yeah she's an elder but she's still serving, and she lives in the PAM_ALREADYLOGGEDIN(8) chapter of the System Manager's Manual forever 💖 mwah, go configure something ✨💅