PAM_NEWNET(8)

💖 pam_newnet(8) — the login-time network-namespace glow-up 💖

System Manager's Manual · section 8 · yes bestie, this is the one that yeets your login session into its own little network bubble 🫧

---

✨ NAME ✨

pam_newnet — create a new network namespace at login 🦋

---

✨ SYNOPSIS ✨

pam_newnet.so

That's it. That's the whole synopsis. No flags on the module line itself, no args, nothing. She's lowkey mysterious like that 💅

---

✨ DESCRIPTION ✨

So the pam_newnet PAM module creates a brand new network namespace at login, but only for the girlies in the newnet group 👑

Here's the vibe: users in the newnet group can log in over a network connection (like, say, via ssh, totally normal), but their processes cannot communicate. Like, at all. The only interface they can even see is the localhost of the namespace that got made at login time. That's the whole world they get. One (1) localhost. Main character energy in a room with no doors 😭

When pam_newnet is used together with a specific cado(1) configuration, users can configure their own networking services 🛠️ (peep https://github.com/rd235/cado)

And then there's the nsutils tools — more specifically netnsjoin(1) — which let users assign placeholders to keep namespaces alive, assign meaningful tags so management is actually easy, and then later join any of their own namespaces 🌈 (peep https://github.com/rd235/nsutils)

---

✨ OPTIONS ✨

• group=groupname — the module operates on users in the group groupname instead of newnet. Custom group name? Slay, you do you 💖
• lodown — leave the localhost lo interface in the state DOWN. She's not getting up. She's resting 🛌

---

✨ RETURN VALUES ✨

• PAM_IGNORE — user does not belong to the newnet group. Not your girl, not your namespace, moving on 🙈
• PAM_ABORT — error in retrieving the user id or in the namespace creation. Something went wrong wrong 😭
• PAM_SUCCESS — success. We ate. Periodt ✨

---

✨ EXAMPLES ✨

Add the following lines to /etc/pam.d/sshd or /etc/pam.d/login:

session   required  pam_newnet.so

session   required  pam_newnet.so group=lonet lodown

Copy-paste-able, iconic, no notes 🎀

---

✨ SEE ALSO ✨

pam.conf(5), pam.d(5), pam(7) — go read these, iykyk 📚

---

✨ AUTHOR ✨

pam_newnet was written by Renzo Davoli and Eduard Caizer, University of Bologna 🎓

---

VirtualSquare Labs · October 5, 2019 · and yeah this was PAM_NEWNET(8) the whole time 💜

Ok that's the page bestie, go namespace responsibly, ily, bye 🫶🌸