---
name: "pam_alreadyloggedin"
section: "8"
platform: "linux"
package: "libpam-alreadyloggedin"
version: "0.3-12"
release: "Debian 12 (Bookworm)"
platforms: ["linux"]
url: "https://new.carta.tech/pam_alreadyloggedin"
---

# pam\_alreadyloggedin(8)

Already-logged-in PAM module

## NAME

**pam\_alreadyloggedin** – Already-logged-in PAM module

## SYNOPSIS

\[*service-name*\] *module-type* *control-flag* *pam\_alreadyloggedin* \[*options*\]

## DESCRIPTION

The Already-logged-in authentication service module for PAM, **pam\_alreadyloggedin** provides functionality for only one PAM category: authentication. In terms of the *module-type* parameter, this is the “auth” feature. It also provides null functions for other PAM categories.

### Already-logged-in Authentication Module

The Already-logged-in authentication component (**pam\_sm\_authenticate**()), returns success if and only if the target user's ID is identical to a current login specified in the [utmp(5)](/utmp/5.md) database and verified with matching permissions on that login's respective terminal in */dev*. If a user shows up in w(8) output, they will generally be allowed to authenticate using this method.

The following options may be passed to the authentication module:

- **debug**

  Enable verbose output to syslog at LOG\_DEBUG level.

- **no\_debug**

  Disable verbose output to syslog even it's enabled at compile time.

- **no\_root**

  Never allow login with a target user ID of zero.

- **restrict\_tty**=*ttyglob\**

  Only allow login if the terminal device currently being authenticated on matches *ttyglob\**. The *ttyglob\** argument is specified as a shell glob, and checked using the [fnmatch(3)](/fnmatch/3.md) function. For example, **restrict\_tty=/dev/tty\[1-6\]** allows logging from text consoles of physical terminal only.

- **restrict\_loggedin\_tty**=*ttyglob\**

  Disallow recognition that the user is already logged in unless the terminal device logged in upon matches *ttyglob\**.

## EXAMPLE

Modify **auth** section of the */etc/pam.d/login* file like following:

```
auth required   /lib/security/pam_securetty.so
auth sufficient /lib/security/pam_alreadyloggedin.so no_root
auth required   /lib/security/pam_stack.so service=system-auth
```

## BUGS

FreeBSD version expects */dev/* prefix in **restrict\_tty** value, but value of **restrict\_loggedin\_tty** should be without them. Linux version expects */dev/* in both cases.

## SEE ALSO

[fnmatch(3)](/fnmatch/3.md), [getuid(2)](/getuid/2.md), [stat(2)](/stat/2.md), [utmp(5)](/utmp/5.md), w(8), [pam.conf(5)](/pam.conf/5.md), [pam(8)](/pam/8.md)

## AUTHORS

Adopted for Linux PAM by Ilya Evseev at Jan 2004.

The original **pam\_alreadyloggedin** module and this manual page were developed for the FreeBSD Project by NAI Labs and ThinkSec AS, the Security Research Division of Network Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.