|HP-UX Reference > L
HP-UX 11i Version 3: February 2007
login — sign on, start terminal session
The login command is used at the beginning of each terminal session to properly identify a prospective user. login can be invoked as a user command or by the system as an incoming connection is established. login can also be invoked by the system when a previous user shell terminates but the terminal does not disconnect.
If login is invoked as a command, it must replace the initial command interpreter (the user's login shell). This is accomplished with the shell command
The user's login name is requested, if it is not specified on the command line, and the corresponding password is obtained, if required, with the following prompts:
Terminal echo is turned off (where possible) during password entry to prevent written records of the password. If the account does not have a password, and the authentication profile for the account requires one, login invokes pam_chauthtok() to establish one for the account.
On a trusted system, login displays the last successful and unsuccessful login times and terminal devices. On a standard system, login optionally displays the last successful and unsuccessful login times. See the DISPLAY_LAST_LOGIN attribute in security(4).
As a security precaution, some installations use an option that requires a second "dialup" password. This occurs only for dialup connections, and is requested with the prompt:
Both passwords must be correct for a successful login (see dialups(4) for details on dialup security).
If password aging is activated, the user's password may have expired. pam_chauthtok() is invoked to change the password. On a standard system, the user is required to re-login after a successful password change (see passwd(1)).
After three unsuccessful login attempts, a HANGUP signal is issued. If a login is not successfully completed within a certain period of time (for example, one minute), the terminal is silently disconnected.
After a successful login, the accounting files are updated, user and group IDs, group access list, and working directory are initialized, and the user's command interpreter (shell) is determined from corresponding user entries in the files /etc/passwd and /etc/logingroup (see passwd(4) and group(4)). If /etc/passwd does not specify a shell for the user name, /usr/bin/sh is used by default. login then forks the appropriate shell by using the last component of the shell path name preceded by a - (for example, -sh or -ksh). When the command interpreter is invoked with its name preceded by a minus in this manner, the shell performs its own initialization, including execution of profile, login, or other initialization scripts.
For example, if the user login shell is the Korn or POSIX shell (see ksh(1) or sh-posix(1), respectively), the shell executes the profile files /etc/profile and $HOME/.profile if they exist (and possibly others as well). Depending on what these profile files contain, messages regarding mail in the user's mail file or any messages the user may have received since the user's last login may be displayed.
If the command name field is *, a chroot() to the directory named in the directory field of the entry is performed. At that point, login is re-executed at the new level, which must have its own root structure, including a /usr/bin/login command and an /etc/passwd file.
For the normal user, the basic environment variables (see environ(5)) are initialized to:
HOME=login_directory LOGNAME=login_name MAIL=/var/mail/login_name PATH=:/usr/bin SHELL=login_shell
login_directory, login_name, and login_shell are taken from the corresponding fields of the passwd file entry (see passwd(4)).
For superuser, PATH is set to:
In the case of a remote login, the environment variable TERM is also set to the remote user's terminal type.
The environment can be expanded or modified by supplying additional arguments to login, either at execution time or when login requests the user's login name. The arguments can take either the form value or varname=value, where varname is a new or existing environment variable name and value is a value to be assigned to the variable.
An argument in the first form (without an equals sign) is placed in the environment as if it were entered in the form
where n is a number starting at 0 that is incremented each time a new variable name is required.
An argument in the second form (with an equals sign) is placed into the environment without modification.
If the variable name (Ln or varname) already appears in the environment, the new value replaces the older one.
There are two exceptions. The variables PATH and SHELL cannot be changed. This prevents users logged in with restricted shell environments from spawning secondary shells that are not restricted.
Both login and getty understand simple single-character quoting conventions. Typing a backslash in front of a character quotes it and allows the inclusion of such things as spaces and tabs.
The user accounting database, /etc/utmps, is updated by the utmpd daemon (see utmpd(1M)). This is the database of currently logged-in users.
If /var/adm/btmps exists, all unsuccessful login attempts are logged to that file. The lastb command, (see last(1)), displays a summary of bad login attempts for users with read access to btmps.
If the /etc/securetty file is present, login security is in effect, i.e., root is allowed to log in successfully only on the ttys listed in this file. Restricted ttys are listed by device name, one per line. Valid tty names are dependent on the installation. An example is
console tty01 ttya1 etc.
Note that this feature does not inhibit a normal user from using the su command (see su(1)).
HP-UX Smart Card Login
If the user account is configured to use a Smart Card, the user password is stored in the card. This password has characteristics identical to a normal password stored on the system.
In order to login using a Smart Card account, the card must be inserted into the Smart Card reader. The user is prompted for a PIN (personal identification number) instead of a password during authentication. The prompts are:
login: Enter PIN:
The password is retrieved automatically from the Smart Card when a valid PIN is entered. Therefore, it is not necessary to know the password, only the PIN.
The card is locked if an incorrect PIN is entered three consecutive times. It may be unlocked only by the card issuer.
On a standard system, login prohibits a user from logging in if any of the following is true:
On a trusted system, login prohibits a user from logging in if any of the following is true:
On a trusted system, login allows superuser to log in on the console unless /etc/securetty exists and does not contain console.
Refer to the /etc/default/security file in the security(4) manpage for detailed information on configurable attributes that affect the behavior of this command. Currently supported attributes are:
The following diagnostics appear if the associated condition occurs:
.rhosts is a soft link
Bad .rhosts ownership
Bad group id
Bad user id
Cannot open password file
Locuser too long
No /usr/bin/login or /etc/login on root
No Root Directory
No utmp entry. You must exec "login" from the lowest level "sh"
Remuser too long
Terminal type too long
Unable to change to directory name
Your password has expired. Choose a new one
If /etc/group is linked to /etc/logingroup, and group membership for the user trying to log in is managed by the Network Information Service (NIS), and no NIS server is able to respond, login waits until a server does respond.
HP-UX 11i Version 3 is the last release to support trusted systems functionality.
Pluggable Authentication Modules (PAM)
PAM is an Open Group standard for user authentication, password modification, and validation of accounts. In particular, pam_authenticate() is invoked to perform all functions related to login. This includes retrieving the password, validating the account, and displaying error messages. pam_chauthtok() is invoked during password expiration or establishment.
HP Process Resource Manager
If the optional HP Process Resource Manager (PRM) software is installed and configured, the login shell is launched in the user's initial process resource group. If the user's initial group is not defined, the shell runs in the user default group (PRMID=1). See prmconfig(1) for a description of how to configure HP PRM, and prmconf(4) for a description of how the user's initial process resource group is determined.
csh(1), groups(1), ksh(1), last(1), mail(1), newgrp(1), passwd(1), sh(1), sh-posix(1), su(1), getty(1M), userstat(1M), initgroups(3C), btmps(4), dialups(4), group(4), passwd(4), profile(4), security(4), shadow(4), utmpd(1M), wtmps(4), environ(5).