LOGIN(1)

NAME
login - start an interactive session on the system

SYNOPSIS
login [-p] [-h hostname] [-f] [--] [username]

DESCRIPTION
The login application opens an interactive session with a Linux workstation. It is one of the first applications a user interacts with, but is generally not invoked by a normal user. Instead some program like getty(1m) will invoke login.

Following a successful application for service, the login application makes entries in the utmp(5) and wtmp(5) databases. In this way the number of users logged-into the system can be tracked with commands like, who(1) and w(1). Following the termination of the user's login shell, login removes the corresponding utmp(5) entry. Login is configured to work through the Linux-PAM API. Essentially, it initializes itself as a "login" service with Linux-PAM and utilizes the configured account, authentication, password and session modules to authenticate and then invoke a session with the assumed user's identity. In the case that the accounting module reports that a user's authentication token(s) has(have) expired, the user is required to enter suitable replacements before proceeding. Such updates are performed by the password module(s).

A simple entry in the /etc/pam.conf configuration file for this service would be:

 #
 # login service, most management service is provided
 # by pwdb, however securetty prevents root from
 # login in on an insecure terminal. Cracklib is used
 # to ensure that the user's new password is strong.
 #
 login auth requisite pam_securetty.so
 login auth required pam_pwdb.so
 login account required pam_pwdb.so
 login password required pam_cracklib.so retry=2
 login password required pam_pwdb.so use_authtok
 login session required pam_pwdb.so
 #

(To generate the equivalent /etc/pam.d/login file, you should simply remove the first field ("login") from the above example.) Note, account, auth, password and session module-types are all required for this application to function correctly.

For continuity of service, the administrator might wish to make the su(1) and login module configurations similar.

Login will timeout after 80 seconds. It will warn the user that they should type something after 65 seconds.

The arguments passed to login are generally used by other applications, and have the following meanings:

username
    The prospective name of the user requesting services on the system.

-p  This argument is used by applications like telnetd(8) to instruct login to preserve the environment variables it is invoked with; these may include variables like TERM and DISPLAY, which give the system information about the remote applicant's connection. (Note, these environment variables may be over-written by those modules configured to perform authentication tasks for the login application. In particular, the following POSIX environment variables LOGNAME and HOME, are set to their appropriate values by the login application.)

-h hostname
    This option is used to explicitly indicate the name of the remote host from which this login-service application originated. It is typically used by telnetd(8).

-f  Ignore the need to authenticate the user - trust that this has already been performed by a parent application. This option instructs login to not call pam_authenticate(2). However, login will call pam_acct_mgmt(2) to establish whether the user is permitted access at this time.

--  There are no more arguments. The subsequent argument is to be interpreted as the user's name. The only possible use for this flag is to allow a username to begin with a `-'. It is unclear how useful a feature this is, but it is supported to allow for certain pedantic getty(1m)s.

EXIT CODE
On successful completion of its task, login will complete with exit code 0. An exit code of 1 indicates an error occurred. Textual errors are written to the standard error stream.

FILES
By way of suggestions for modules to attach to this application, pam_lastlog(session) and pam_mail(auth) may be desired to make this application operate as it did historically.

CONFORMING TO
Linux-PAM (Pluggable Authentication modules for Linux).
Note, your distribution of Linux-PAM will likely store the modules in /usr/lib/security or /lib/security/.

BUGS

None known.

SEE ALSO
su(1) and pam(8)

For more complete information on how to configure this application with Linux-PAM, see the Linux-PAM System Administrators' Guide at
<http://linux.kernel.org/pub/linux/libs/pam/index.html>