LOGIN_DURESS(8)

NAME
login_duress - provide duress or standard password authentication type

SYNOPSIS
login_duress [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class]

DESCRIPTION
The login_duress utility can be called by login(1), su(1), and others to authenticate the user with passwd-style authentication, using a password defined in the duress database. If the user is not present in the database or the password does not match, the user is authenticated against the system password database similar to login_passwd(8).

The user argument is the login name of the user to be authenticated.

The service argument specifies which protocol to use with the invoking program. The allowed protocols are login, challenge, and response. (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based).

If the wheel argument is specified and is not set to yes, then the user will be rejected as not being in group “wheel”. This is used by su(1).

If the lastchance argument is specified and is equal to yes, then if the user's password in the standard password database has expired, and it has not been expired longer than “password-dead” seconds (see login.conf(5)), the user will be able to log in one last time to change the password.

login_duress will prompt the user for a password. If the password supplied matches the user's duress password contained in /etc/duress, login_duress will execute the command contained in that file as the user before reporting successful authentication.

If the password does not match the duress password or the user is not present in the duress database, login_duress will attempt to authenticate the password against the standard system password database similar to login_passwd(8).

DATABASE FORMAT
The /etc/duress database should contain one user per line, with the following fields separated by a colon:

name
    User's login name.
password
    User's encrypted password.
command
    User's duress command.

The password field can be generated with the encrypt(1) utility:

    $ encrypt -b10 -p

FILES
/etc/duress
    user database with duress passwords and commands

SEE ALSO
encrypt(1), login(1), login_passwd(1), passwd(1), su(1), login.conf(5)