NAME¶

pam_newnet - create a new network namespace at login

SYNOPSIS¶

pam_newnet.so

DESCRIPTION¶

The pam_newnet PAM module creates a new network namespace at login for users in the newnet group.

Users in the newnet group can log-in through a network connection (e.g. by ssh) but their processes cannot communicate. The only interface they can see is the localhost of the namespace created at login time.

When pam_newnet is used together with a specific cado(1) configuration users can configure their own networking services. (see https://github.com/rd235/cado)

The nsutils tools, and more specfically netnsjoin(1), allow users to assign placeholders to keep namespaces alive, assign meaningful tags for an easier management, and later join any of their own namespaces (see https://github.com/rd235/nsutils)

OPTIONS¶

group=groupname

lodown

RETURN VALUES¶

PAM_IGNORE

PAM_ABORT

PAM_SUCCESS

EXAMPLES¶

Add the following lines to /etc/pam.d/sshd or /etc/pam.d/login

SEE ALSO¶

pam.conf(5), pam.d(5), pam(7)

AUTHOR¶

pam_newnet was written by Renzo Davoli and Eduard Caizer, University of Bologna