As of version 1.35, the login program recognizes the file

	/etc/usertty

where the administrator may link certain usernames with certain terminal
lines and/or domain names or IP address ranges. Using this feature it is
possible to allow certain users to only log in via the net from certain
hosts or domains. It can also be used to restrict modem log in 
privileges, so a certain user may be allowed to log in via a certain
set of modems or not via modem at all.

Also, restricting modem log-in ability to those (few) who have a 
legitimate need may prove a good idea. Hackers with a stolen password
will often attack a machine via modem in order to hide their true
identity, so limiting the number of accounts permitting modem login
limits the chances that such an attack will work.

You may also want to restrict access via a high speed modem to 
a chosen few, and forcing others to use a slower line.

As of version 1.35 we dropped the PTY specification (use @localhost instead) 
and added the possibility of default specifications and host patterns.

Each line in the /etc/usertty file has the following format:
(the items on a line are separated by spaces or tabs)

<username>	<line1> <line2>...

or

*	<line1> <line2>...

Comments start with a # and extend to the end of the line.
A line starting with a * is a default specification, and matches any user 
not mentioned explicitly.

The <line1>, <line2> and so on may each be one of two things:

- the name of a device file except the leading /dev/ prefix, for example
  tty1 or ttyS1;

- a hostclass specification.

A hostclass specification is a declation of a class of hosts, starting with 
an @ sign.

@localhost	means the local host only, the machine where the login
		process runs;

@.some.dom	the suffix of a fully qualified domain name, this must match
		the corresponding suffix of the remote host trying to log
		in, in a case-insensitive manner. For example:
		@.mit.EDU matches all hosts with names ending in .mit.edu, such
		as athena.mit.edu.

@x.x.x.x/y.y.y.y	A specification of an IPv4 address (x) and bitmask (y) 
		in the standard dotted quad decimal format. The remote hosts IP
		address AND'ed with the bitmask (y) must equal the address x
		AND'ed with the bitmask (y).
		For example: @130.225.16.0/255.255.255.0 matches all the IP
		addresses in the range 130.225.16.0 - 130.225.16.255.

The classes: @localhost @0.0.0.0/0.0.0.0 together specifies any host...

Here's an example /etc/usertty file:
---------------------------
# /etc/usertty, for certain users, allow login
# only on certain tty's from certain hosts
root	tty1 @consolehost
brian	tty1 tty2
dennis	@.att.com
stduser	tty1 tty2 ttyS0
*	tty1 @localhost @128.14.188.0/255.255.254.0
---------------------------
This example file allows root login only on tty1 (the first virtual 
console) and via rlogin/telnet from consolehost. Brian is 
allowed to login only on tty1 and tty2. Dennis is only allowed to 
rlogin/telnet from hosts in the .att.com domain. Stduser may login
on tty1, tty2 and ttyS0. All other users may login on tty1, telnet/
rlogin from the host into itself and from hosts with IP addresses in
the range 128.14.188.0 - 128.14.189.255.

Another example, eg. for a dial-up IP provider:

------------------------------
# /etc/usertty example 2
admin	ttyS0 @.provider.com
root	tty1 @localhost
*	ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 ttyS8 @localhost
------------------------------

The above file reserves the first modem (ttyS0) for administrative logins, 
and also allows the administrator to rlogin from any host in the 
Provider.COM domain. Root logins are restricted to the first virtual console, 
and we let root re-login to the host with the @localhost specification.
All other users are restricted to login via the remaining modems (ttyS1 - 
ttyS8), and they are allowed to re-login to the same host, but they can't
rlogin/telnet from the outside, a plus for example if a user's password
is stolen and the hacker tries to hack Provider.COM from the internet.


It might be a good idea to restrict root-logins to the console. But
be careful not to lock yourself or root out!

If there's no default specification (a line starting with a *) users not
mentioned explicitly in the file are allowed to login on any line from
any hosts, as is standard behaviour.

If the file does not exist, all users are allowed login on all tty's, ie.
good old standard behaviour.

7-Aug-95
	- Peter <poe@daimi.aau.dk>
