LOGIN(1)

NAME
login - sign on

SYNOPSIS
login [ name ]
login -p
login -h hostname
login -f name

DESCRIPTION
login is used when signing onto a system. It can also be used to switch from one user to another at any time (most modern shells have support for this feature built into them, however). If an argument is not given, login prompts for the username. If the user is not root, and if /etc/nologin exists, the contents of of this file are printed to the screen, and the login is terminated. This is typically used to prevent logins when the system is being taken down. If special access restrictions are specified for the user in /etc/usertty, these must be met, or the log in attempt will be denied and a syslog message will be generated. See the section on "Special Access Restrictions". If the user is root, then the login must be occuring on a tty listed in /etc/securetty. Failures will be logged with the syslog facility. After these conditions are checked, the password will be requested and checks (if a password is required for this username). Ten attempts are allowed before login dies, but after the first three, the response starts to get very slow. Login failures are reported via the syslog facility. This facility is also used to report any successful root logins. If the file .hushlogin exists, then a "quiet" login is performed (this disables the checking of the checking of mail and the printing of the last login time and message of the day). Otherwise, if /var/log/lastlog exists, the last login time is printed (and the current login is recorded). Random administrative things, such as setting the UID and GID of the tty are performed. The TERM environment variable is preserved, if it exists (other environment variables are preserved if the -p option is used). Then the HOME, PATH, SHELL, TERM, MAIL, and LOGNAME environment variables are set. PATH defaults to /usr/local/bin:/bin:/usr/bin:. for normal users, and to /sbin:/bin:/usr/sbin:/usr/bin for root. Last, if this is not a "quiet" login, the message of the day is printed and the file with the user's name in /usr/spool/mail will be checked, and a message printed if it has non-zero length. The user's shell is then started. If no shell is specified for the user in /etc/passwd, then /bin/sh is used. If there is no directory specified in /etc/passwd, then / is used (the home directory is checked for the .hushlogin file described above).

OPTIONS

-p  Used by getty(8) to tell login not to destroy the environment

-f  Used to skip a second login authentication. This specifically does not work for root, and does not appear to work well under Linux.

-h  Used by other servers (i.e., telnetd(8)) to pass the name of the remote host to login so that it may be placed in utmp and wtmp. Only the superuser may use this option.

SPECIAL ACCESS RESTRICTIONS
The file /etc/securetty lists the names of the ttys where root is allowed to log in. One name of a tty device without the /dev/ prefix must be specified on each line. If the file does not exist, root is allowed to log in on any tty.

The file /etc/usertty specifies additional access restrictions for specific users. If this file does not exist, no additional access restrictions are imposed. Each line in this file specifies for a given user the allowed origin of the log in, be it a set of tty lines, a suffix of an internet domain name or a range of IP addresses. Each line in /etc/usertty has the format:

<username>	<origin1> <origin2>...

<username> is a username as stated in the passwd file, or it may be the single character * specifying a default rule matching any user not explicitly mentioned. Each <originN> is a string specifying an allowed origin for that user. Each line must be at most 255 characters wide.

A origin string may have one of these formats:

o   The name of a tty device without the /dev/ prefix, for example tty1 or ttyS0.

o   The string @localhost, meaning that the user is allowed to telnet/rlogin from the local host to the same host. This also allows the user to for example run the command: xterm -e /bin/login.

o   A domain name suffix such as @.some.dom, meaning that the user may rlogin/telnet from any host whose domain name has the suffix .some.dom.

o   A range of IPv4 addresses, written @x.x.x.x/y.y.y.y where x.x.x.x is the IP address in the usual dotted quad decimal notation, and y.y.y.y is a bitmask in the same notation specifying which bits in the address to compare with the IP address of the remote host. For example @130.225.16.0/255.255.254.0 means that the user may rlogin/telnet from any host whose IP address is in the range 130.225.16.0 - 130.225.17.255.

If no default rule is given then users not mentioned in /etc/usertty are allowed to log in from anywhere as is standard behavior.

FILES
/var/run/utmp
/var/log/wtmp
/var/log/lastlog
/usr/spool/mail/*
/etc/motd
/etc/passwd
/etc/nologin
/etc/usertty
.hushlogin

SEE ALSO
init(8), getty(8), mail(1), passwd(1), passwd(5), environ(7), shutdown(8)

BUGS
Linux, unlike other draconian operating systems, does not check quotas. The undocumented BSD -r option is not supported. This may be required by some rlogind(8) programs.

AUTHOR
Derived from BSD login 5.40 (5/9/89) by Michael Glad (glad@daimi.dk) for HP-UX
Ported to Linux 0.12: Peter Orbaek (poe@daimi.aau.dk)