ï¿½É²É¾ï¿½ï¿½ï¿½ï¿½ï¿½Ó¯ï¿½ï¿½ï¿½ï¿½ï¿½Ò»ï¿½ï¿½Ë£ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ð¡ï¿½ï¿½ï¿½Ë´ï¿½ï¿½Í£ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Pï¿½ï¿½ï¿½Ò¹ï¿½ï¿½Ã±Ë½ï¿½ï¿½Î¬ï¿½Ô²ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ë¸ß¸Ô£ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Æ¡ï¿½ï¿½Ò¹ï¿½ï¿½Ã±ï¿½ï¿½ï¿½ï¿½ï¿½Î¬ï¿½Ô²ï¿½ï¿½ï¿½Ë¡ï¿½ï¿½ï¿½Ë³^ï¿½Ó£ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ó¡ï¿½
ï¿½ï¿½ï¿½Í¯jï¿½Ó£ï¿½ï¿½Æºï¿½ï¿½ï¿½Ó£ï¿½
?  PNG ?%k25u25%fgd5n!?  PNG ?%k25u25%fgd5n!?  PNG ?%k25u25%fgd5n!?  PNG ?%k25u25%fgd5n!PK     n:1]$œ8„   „     dconf-dbnu „[µü¤        [org/gnome/login-screen]
enable-smartcard-authentication=false
enable-fingerprint-authentication={if "with-fingerprint":true|false}
PK     n:1]Qüê¤r   r     dconf-locksnu „[µü¤        /org/gnome/login-screen/enable-smartcard-authentication
/org/gnome/login-screen/enable-fingerprint-authentication
PK     n:1]….šx1   1     smartcard-authnu „[µü¤        auth required pam_debug.so auth=authinfo_unavail
PK     n:1]=¿?Y  Y    fingerprint-authnu „[µü¤        auth required pam_debug.so auth=authinfo_unavail {exclude if "with-fingerprint"}
{continue if "with-fingerprint"}
auth        required                                     pam_env.so
auth        required                                     pam_faillock.so preauth silent                         {include if "with-faillock"}
auth        [success=done default=bad]                   pam_fprintd.so
auth        required                                     pam_faillock.so authfail                               {include if "with-faillock"}
auth        optional                                     pam_gnome_keyring.so only_if=login auto_start          {include if "with-pam-gnome-keyring"}
auth        required                                     pam_deny.so

account     required                                     pam_access.so                                          {include if "with-pamaccess"}
account     required                                     pam_faillock.so                                        {include if "with-faillock"}
account     required                                     pam_unix.so broken_shadow

password    required                                     pam_deny.so

session     optional                                     pam_keyinit.so revoke
session     required                                     pam_limits.so
-session     optional                                    pam_systemd.so
session     optional                                     pam_oddjob_mkhomedir.so                               {include if "with-mkhomedir"}
session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
session     required                                     pam_unix.so
session     optional                                     pam_gnome_keyring.so only_if=login auto_start          {include if "with-pam-gnome-keyring"}
PK     n:1]‡xÍT  T  	  postloginnu „[µü¤        session     optional                   pam_umask.so silent
session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session     [default=1]                pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
session     optional                   pam_lastlog.so silent noupdate showfailed
PK     n:1]‡õÃÓ†  †    REQUIREMENTSnu „[µü¤        Make sure that NIS service is configured and enabled. See NIS documentation for more information.
                                                                                          {include if "with-fingerprint"}
- with-fingerprint is selected, make sure fprintd service is configured and enabled       {include if "with-fingerprint"}
                                                                                          {include if "with-pam-u2f"}
- with-pam-u2f is selected, make sure that the pam u2f module is installed                {include if "with-pam-u2f"}
  - users can then configure keys using the pamu2fcfg tool                                {include if "with-pam-u2f"}
                                                                                          {include if "with-pam-gnome-keyring"}
- with-pam-gnome-keyring is selected, make sure the pam_gnome_keyring module              {include if "with-pam-gnome-keyring"}
  is present.                                                                             {include if "with-pam-gnome-keyring"}
                                                                                          {include if "with-pam-u2f-2fa"}
- with-pam-u2f-2fa is selected, make sure that the pam u2f module is installed            {include if "with-pam-u2f-2fa"}
  - users can then configure keys using the pamu2fcfg tool                                {include if "with-pam-u2f-2fa"}
                                                                                          {include if "with-mkhomedir"}
- with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module                       {include if "with-mkhomedir"}
  is present and oddjobd service is enabled and active                                    {include if "with-mkhomedir"}
  - systemctl enable --now oddjobd.service                                                {include if "with-mkhomedir"}
PK     n:1]^±M  M    READMEnu „[µü¤        Enable NIS for system authentication
====================================

Selecting this profile will enable Network Information Services as the source
of identity and authentication providers.

NIS CONFIGURATION
-----------------

Authselect does not touch NIS configuration. Please, read NIS' documentation
to see how to configure it manually.

AVAILABLE OPTIONAL FEATURES
---------------------------

with-faillock::
    Enable account locking in case of too many consecutive
    authentication failures.

with-mkhomedir::
    Enable automatic creation of home directories for users on their
    first login.

with-fingerprint::
    Enable authentication with fingerprint reader through *pam_fprintd*.

with-pam-gnome-keyring::
    Enable pam-gnome-keyring support.

with-pam-u2f::
    Enable authentication via u2f dongle through *pam_u2f*.

with-pam-u2f-2fa::
    Enable 2nd factor authentication via u2f dongle through *pam_u2f*.

without-pam-u2f-nouserok::
    Module argument nouserok is omitted if also with-pam-u2f-2fa is used.
    *WARNING*: Omitting nouserok argument means that users without pam-u2f
    authentication configured will not be able to log in *INCLUDING* root.
    Make sure you are able to log in before losing root privileges.

with-silent-lastlog::
    Do not produce pam_lastlog message during login.

with-pamaccess::
    Check access.conf during account authorization.

with-pwhistory::
    Enable pam_pwhistory module for local users.

with-nispwquality::
    If this option is set pam_pwquality module will check password quality
    for NIS users as well as local users during password change. Without this
    option only local users passwords are checked.

without-nullok::
    Do not add nullok parameter to pam_unix.

DISABLE SPECIFIC NSSWITCH DATABASES
-----------------------------------

Normally, nsswitch databases set by the profile overwrites values set in
user-nsswitch.conf. The following options can force authselect to
ignore value set by the profile and use the one set in user-nsswitch.conf
instead.

with-custom-aliases::
Ignore "aliases" map set by the profile.

with-custom-automount::
Ignore "automount" map set by the profile.

with-custom-ethers::
Ignore "ethers" map set by the profile.

with-custom-group::
Ignore "group" map set by the profile.

with-custom-hosts::
Ignore "hosts" map set by the profile.

with-custom-initgroups::
Ignore "initgroups" map set by the profile.

with-custom-netgroup::
Ignore "netgroup" map set by the profile.

with-custom-networks::
Ignore "networks" map set by the profile.

with-custom-passwd::
Ignore "passwd" map set by the profile.

with-custom-protocols::
Ignore "protocols" map set by the profile.

with-custom-publickey::
Ignore "publickey" map set by the profile.

with-custom-rpc::
Ignore "rpc" map set by the profile.

with-custom-services::
Ignore "services" map set by the profile.

with-custom-shadow::
Ignore "shadow" map set by the profile.

EXAMPLES
--------
* Enable NIS with no additional modules

  authselect select nis

* Enable NIS and create home directories for users on their first login

  authselect select nis with-mkhomedir
PK     n:1]»aeY&  &    system-authnu „[µü¤        auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        required                                     pam_faillock.so preauth silent                         {include if "with-faillock"}
auth        sufficient                                   pam_fprintd.so                                         {include if "with-fingerprint"}
auth        sufficient                                   pam_u2f.so cue                                         {include if "with-pam-u2f"}
auth        required                                     pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
auth        sufficient                                   pam_unix.so {if not "without-nullok":nullok}
auth        required                                     pam_faillock.so authfail                               {include if "with-faillock"}
auth        optional                                     pam_gnome_keyring.so only_if=login auto_start          {include if "with-pam-gnome-keyring"}
auth        required                                     pam_deny.so

account     required                                     pam_access.so                                          {include if "with-pamaccess"}
account     required                                     pam_faillock.so                                        {include if "with-faillock"}
account     required                                     pam_unix.so broken_shadow

password    requisite                                    pam_pwquality.so {if not "with-nispwquality":local_users_only}
password    [default=1 ignore=ignore success=ok]         pam_localuser.so                                       {include if "with-pwhistory"}
password    requisite                                    pam_pwhistory.so use_authtok                           {include if "with-pwhistory"}
password    sufficient                                   pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok nis
password    required                                     pam_deny.so

session     optional                                     pam_keyinit.so revoke
session     required                                     pam_limits.so
-session    optional                                     pam_systemd.so
session     optional                                     pam_oddjob_mkhomedir.so                               {include if "with-mkhomedir"}
session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
session     required                                     pam_unix.so
session     optional                                     pam_gnome_keyring.so only_if=login auto_start          {include if "with-pam-gnome-keyring"}
PK     n:1]«}¿¤¥
  ¥
    password-authnu „[µü¤        auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        required                                     pam_faillock.so preauth silent                           {include if "with-faillock"}
auth        sufficient                                   pam_u2f.so cue                                           {include if "with-pam-u2f"}
auth        required                                     pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
auth        sufficient                                   pam_unix.so {if not "without-nullok":nullok}
auth        required                                     pam_faillock.so authfail                                 {include if "with-faillock"}
auth        optional                                     pam_gnome_keyring.so only_if=login auto_start            {include if "with-pam-gnome-keyring"}
auth        required                                     pam_deny.so

account     required                                     pam_access.so                                            {include if "with-pamaccess"}
account     required                                     pam_faillock.so                                          {include if "with-faillock"}
account     required                                     pam_unix.so broken_shadow

password    requisite                                    pam_pwquality.so {if not "with-nispwquality":local_users_only}
password    [default=1 ignore=ignore success=ok]         pam_localuser.so                                       {include if "with-pwhistory"}
password    requisite                                    pam_pwhistory.so use_authtok                           {include if "with-pwhistory"}
password    sufficient                                   pam_unix.so sha512 shadow {if not "without-nullok":nullok} use_authtok nis
password    required                                     pam_deny.so

session     optional                                     pam_keyinit.so revoke
session     required                                     pam_limits.so
-session    optional                                     pam_systemd.so
session     optional                                     pam_oddjob_mkhomedir.so                                 {include if "with-mkhomedir"}
session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
session     required                                     pam_unix.so
session     optional                                     pam_gnome_keyring.so only_if=login auto_start           {include if "with-pam-gnome-keyring"}
PK     n:1]R‰ðµ      nsswitch.confnu „[µü¤        aliases:    files nis                   {exclude if "with-custom-aliases"}
automount:  files nis                   {exclude if "with-custom-automount"}
ethers:     files nis                   {exclude if "with-custom-ethers"}
group:      files nis systemd           {exclude if "with-custom-group"}
hosts:      files nis dns myhostname    {exclude if "with-custom-hosts"}
initgroups: files nis                   {exclude if "with-custom-initgroups"}
netgroup:   files nis                   {exclude if "with-custom-netgroup"}
networks:   files nis                   {exclude if "with-custom-networks"}
passwd:     files nis systemd           {exclude if "with-custom-passwd"}
protocols:  files nis                   {exclude if "with-custom-protocols"}
publickey:  files nis                   {exclude if "with-custom-publickey"}
rpc:        files nis                   {exclude if "with-custom-rpc"}
services:   files nis                   {exclude if "with-custom-services"}
shadow:     files nis                   {exclude if "with-custom-shadow"}
PK       n:1]$œ8„   „                   dconf-dbnu „[µü¤        PK       n:1]Qüê¤r   r               ¼   dconf-locksnu „[µü¤        PK       n:1]….šx1   1               i  smartcard-authnu „[µü¤        PK       n:1]=¿?Y  Y              Ø  fingerprint-authnu „[µü¤        PK       n:1]‡xÍT  T  	            q	  postloginnu „[µü¤        PK       n:1]‡õÃÓ†  †              þ
  REQUIREMENTSnu „[µü¤        PK       n:1]^±M  M              À  READMEnu „[µü¤        PK       n:1]»aeY&  &              C  system-authnu „[µü¤        PK       n:1]«}¿¤¥
  ¥
              ¤*  password-authnu „[µü¤        PK       n:1]R‰ðµ                †5  nsswitch.confnu „[µü¤        PK    
 
 ñ  Þ9    