PAM_USERNET(8)

📦
version 0.4 · 2 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💅 PAM_USERNET(8) — like, the pam_usernet situation

okay bestie, so this is a System Manager's Manual page for pam_usernet, and I am genuinely obsessed with what it does. let's get into it 🫶

✨ NAME ✨

pam_usernet — join the user own network namespace at login

(no cap, that's the whole vibe: you log in, you get your own little network world 🌈)

🎀 SYNOPSIS 🎀

pam_usernet.so

that's it. that's the whole synopsis. she's lowkey mysterious like that 💅

🦋 DESCRIPTION 🦋

The pam_usernet PAM module allow each user in usernet group to have their own network namespace. ✨

So here's the tea: if a network namespace having the same name as the username exists, pam runs the user shell in that namespace. If such a namespace does does not exist, it is created during the login process.

The system administrator can create a network namespace for each user in usernet group. Each namespace must be named after each username. Users will get their own network namespace at login. periodt. 👑

When pam_usernet is used together with a specific cado(1) configuration users can configure their own networking services. (see https://github.com/rd235/cado) — iykyk 🌸

💖 OPTIONS 💖

  • group=groupname — the module operates on users in the group groupname instead of usernet. so like, you could change the group, but the default is usernet and honestly she's fine as she is 💁♀️
  • lodown — leave the localhost lo interface in the state DOWN. literally just... leaving it down. bestie is not coming back up 🫠
  • rootshared — Leave the root filesystem / as shared so mounts can propagate out to the parent namespace.
⚠️ Warning: this feature can create security vulnerabilities if not properly used. no like, for real, be careful with this one. this is giving "main character energy but in a scary way" 💀

🌟 RETURN VALUES 🌟

  • PAM_IGNORE — User does not belong to the usernet group. (not you bestie, no worries 🫶)
  • PAM_ABORT — Error in retrieving the user id or in the namespace creation/joining. 😭
  • PAM_SUCCESS — Success. slay. ✨🎀

🌈 EXAMPLES 🌈

Add the following line to /etc/pam.d/sshd or /etc/pam.d/login

session   required  pam_usernet.so

literally just drop that line in and you're done. iconic. 🧚

👑 SEE ALSO 👑

pam.conf(5), pam.d(5), pam(7)

💜 AUTHOR 💜

pam_usernet was written by Renzo Davoli and Eduard Caizer, University of Bologna. absolute legends, we stan 🍓

okay that's the whole page, and to close it out with the receipts: this came from VirtualSquare Labs, dated August 17, 2016, and yeah it's the PAM_USERNET(8) page. bye bestie, go get yourself a network namespace 💖✨🦋

📦 where this page comes from