pam_env — PAM module to set/unset environment variables

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

DESCRIPTION

The pam_env PAM module allows the (un)setting of environment variables.
Supported is the use of previously set environment variables as well as
PAM_ITEMs such as PAM_RHOST.

By default rules for (un)setting of variables is taken from the config file /
etc/security/pam_env.conf if no other file is specified.

This module can also parse a file with simple KEY=VAL pairs on separate lines
(/etc/environment by default). You can change the default file to parse, with
the envfile flag and turn it on or off by setting the readenv flag to 1 or 0
respectively.

OPTIONS

conffile=/path/to/pam_env.conf

    Indicate an alternative pam_env.conf style configuration file to override
    the default. This can be useful when different services need different
    environments.

debug

    A lot of debug information is printed with syslog(3).

envfile=/path/to/environment

    Indicate an alternative environment file to override the default. This can
    be useful when different services need different environments.

readenv=0|1

    Turns on or off the reading of the file specified by envfile (0 is off, 1
    is on). By default this option is on.

user_envfile=filename

    Indicate an alternative .pam_environment file to override the default. This
    can be useful when different services need different environments. The
    filename is relative to the user home directory.

user_readenv=0|1

    Turns on or off the reading of the user specific environment file. 0 is
    off, 1 is on. By default this option is on.

EXAMPLES

These are some example lines which might be specified in /etc/security/
pam_env.conf.

Set the REMOTEHOST variable for any hosts that are remote, default to
"localhost" rather than not being set at all

      REMOTEHOST     DEFAULT=localhost OVERRIDE=@{PAM_RHOST}


Set the DISPLAY variable if it seems reasonable

      DISPLAY        DEFAULT=${REMOTEHOST}:0.0 OVERRIDE=${DISPLAY}


Now some simple variables

      PAGER          DEFAULT=less
      MANPAGER       DEFAULT=less
      LESS           DEFAULT="M q e h15 z23 b80"
      NNTPSERVER     DEFAULT=localhost
      PATH           DEFAULT=${HOME}/bin:/usr/local/bin:/bin\
      :/usr/bin:/usr/local/bin/X11:/usr/bin/X11


Silly examples of escaped variables, just to show how they work.

      DOLLAR         DEFAULT=\$
      DOLLARDOLLAR   DEFAULT=        OVERRIDE=\$${DOLLAR}
      DOLLARPLUS     DEFAULT=\${REMOTEHOST}${REMOTEHOST}
      ATSIGN         DEFAULT=""      OVERRIDE=\@