Home / server / Questions / 417423
In Process
Tom
Asked: 2012-08-15 07:59:08 +0800 CST

What service reads /etc/security/access.conf?

  • 772

I'm trying to get to the bottom of an issue with a non-root user running a cron job and I've stumbled upon /etc/security/access.conf. I have a couple of questions:

  • What service reads this file?
  • Do I need to restart anything after editing it?
  • How do I know it's even being used?

Thanks

linux

3 Answers

  1. To see which PAM-based services are using it:

    grep pam_access /etc/pam.d/*

    If it's not mentioned in /etc/pam.d/cron (which I suspect it won't be) then it shouldn't be having any effect on cron jobs. If there are any @include directives in the pam.d files, follow them to make sure you don't miss anything.

    • 5

  2. [1] What service reads this file? It is used by pam

    [chida@localhost ~]$ rpm -qf /etc/security/access.conf 
pam-1.1.5-7.fc17.x86_64

    [2] Do I need to restart anything after editing it?

    Nothing to restart. Once changed, on subsequent login event, the file is read.

    [3] How do I know it's even being used?

    $ stat /etc/security/access.conf

    For more details, do man access.conf.

    • 3

  3. The other two answers are very good, but miss something I wish I understood yesterday.

    Access.conf is indeed used by pam_access.so, but so what? You really need to know if pam_access.so is being used during login. Check for it here:

    # grep pam_access.so /etc/pam.d/*-auth
/etc/pam.d/fingerprint-auth:account     required      pam_access.so
/etc/pam.d/password-auth:account     required      pam_access.so
/etc/pam.d/smartcard-auth:account     required      pam_access.so
/etc/pam.d/system-auth:account     required      pam_access.so

    Here is the thing: Do not edit these files to add/remove pam_access.so. Other services may overwrite those changes. You have to dive into the dark arts of authentication to change these things... doing so without full understanding can lead to a burned tush.

    But the others are correct: changes to access.conf are immediate, requiring no reboot nor service restart.

    • 2