Linux login control

Updated: 03/13/2021 by Figurer Hope

login command

On Unix-like operating systems, the login command begins a new login session on the system.

This page covers the Linux version of login.

Description

The login program is used to establish a new session with the organisation. It is normally invoked automatically by responding to the "login:" prompt on the user'southward terminal. login may be special to the shell and may not be invoked equally a sub-procedure. When called from a shell, login should exist executed as exec login which causes the user to exit from the current crush (and thus prevents the new logged in user to render to the session of the caller). Attempting to execute login from whatsoever shell just the login crush produces an error message.

The user is so prompted for a password, where appropriate. Echoing is disabled to forbid revealing the countersign. But a modest number of password failures are permitted before login exits and the communications link is severed.

If countersign aging is enabled for your account, you lot may be prompted for a new countersign earlier proceeding. Y'all will be forced to provide your old countersign and the new password before continuing; refer to our passwd for more information.

Your user and grouping ID will exist ready according to their values in the /etc/passwd file. The value for $Domicile, $SHELL, $PATH, $LOGNAME, and $MAIL are set according to the appropriate fields in the password entry. ulimit, umask and overnice values may also exist set according to entries in the GECOS field.

On some installations, the environment variable $TERM volition be initialized to the terminal blazon on your tty line, as specified in /etc/ttytype.

An initialization script may also be executed; check the documentation of your command interpreter for information on init scripts.

A subsystem login is indicated by the presence of a "*" equally the first character of the login trounce. The given habitation directory will be used as the root of a new file organisation which the user is really logged into.

Syntax

login [-p] [-h            host] [username] [ENV=VAR...]
login [-p] [-h            host] -f            username          
login [-p] -r            host

Options

-f Practice not perform authentication; user is pre-authenticated. In that example, username is mandatory.
-h Name of the remote host for this login.
-p Preserve environment.
-r Perform autologin protocol for rlogin.

Configuration

The following configuration variables in /etc/login.defs change the behavior of this tool:

name type description
CONSOLE_GROUPS string List of groups to add to the user's supplementary groups fix when logging in on the console (as determined by the CONSOLE setting). Default is none.

Use with caution - information technology is possible for users to proceeds permanent access to these groups, even when not logged in on the console.
DEFAULT_HOME boolean Indicate if login is immune if we can't cd to the abode directory. Default is no.

If set to yep, the user volition login in the root (/) directory if it's not possible to cd to the user'southward home directory.
ENV_PATH string If set up, it volition be used to define the PATH environment variable when a regular user login. The value is a colon separated list of paths (for example /bin:/usr/bin) and tin can exist preceded past PATH=. The default value is PATH=/bin:/usr/bin.
ENV_SUPATH string If set, it volition be used to define the PATH environment variable when the superuser logs in. The value is a colon separated list of paths (for example /sbin:/bin:/usr/sbin:/usr/bin) and can exist preceded by PATH=. The default value is PATH=/sbin:/bin:/usr/sbin:/usr/bin.
ERASECHAR number Last Erase grapheme (010 = backspace, 0177 = Del).

The value can be prefixed "0" for an octal value, or "0x" for a hexadecimal value.
FAIL_DELAY number Filibuster in seconds before being allowed another attempt after a login failure.
FAKE_SHELL string If set, login volition execute this shell instead of the users' shell specified in /etc/passwd.
HUSHLOGIN_FILE string If divers, this file can inhibit all the usual chatter during the login sequence. If a full pathname is specified, and so hushed mode will be enabled if the user'south name or beat out are constitute in the file. If not a full pathname, then hushed fashion will exist enabled if the file exists in the user'southward home directory.
KILLCHAR number Terminal KILL character (025 = ^U).

The value can be prefixed "0" for an octal value, or "0x" for a hexadecimal value.
LOGIN_RETRIES number Maximum number of login retries in instance of bad password.

This will most likely be overridden by PAM since the default pam_unix module has its own congenital-in of 3 retries. However, this is a safety fallback in case y'all are using an hallmark module that does not enforce PAM_MAXTRIES.
LOGIN_TIMEOUT number Max time in seconds for login.
LOG_OK_LOGINS boolean Enable logging of successful logins.
LOG_UNKFAIL_ENAB boolean Enable brandish of unknown usernames when login failures are recorded.

Notation! Logging unknown usernames may be a security outcome if a user enters their password instead of their login name, equally the typo would then exist logged.
TTYGROUP, TTYPERM cord The concluding permissions: the login tty will be owned by the TTYGROUP group, and the permissions will exist set to TTYPERM.

By default, the ownership of the terminal is set to the user's main grouping and the permissions are ready to 0600.

TTYGROUP tin can be either the name of a group or a numeric group identifier.

If you have a write program which is "setgid" to a special grouping which owns the terminals, define TTYGROUP to the grouping number and TTYPERM to 0620. Otherwise, leave TTYGROUP commented out and assign TTYPERM to either 622 or 600.
TTYTYPE_FILE string If divers, file which maps the tty line to the TERM environs parameter. Each line of the file is in a format such as "vt100 tty01".
USERGROUPS_ENAB boolean If set to yes, userdel removes the user's group if it contains no more members, and useradd creates (by default) a group with the proper noun of the user.

Files

/var/run/utmp List of current login sessions.
/var/log/wtmp List of previous login sessions.
/etc/passwd User account information.
/etc/shadow Secure user account information.
/etc/motd System message of the day file.
/etc/nologin Forestall non-root users from logging in.
/etc/ttytype List of terminal types.
$HOME/.hushlogin Suppress printing of system messages.
/etc/login.defs Shadow password suite configuration.

The -r, -h and -f options are only used when login is invoked by root.

Examples

login computerhope.com

Attempts to log in to the host computerhope.com.

csh — The C shell command interpreter.
leave — Exit the command shell.
init — The parent of all processes on the organisation.
ksh — The Korn shell control interpreter.
mail service — Read, etch, and manage postal service.
mailx — Procedure postal service messages.
newgrp — Log into a new group.
passwd — Modify a user's password.
rlogin — Begin a session on a remote system.
rsh — Execute a control on a remote shell.
sh — The Bourne shell command interpreter.
telnet — Connect to a remote system using the telnet protocol.
umask — Get or set the file mode creation mask.