---
name: "pam_login_access"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/pam_login_access"
---

# pam\_login\_access(8)

login.access PAM module

## NAME

**pam\_login\_access** – login.access PAM module

## SYNOPSIS

\[*service-name*\] *module-type* *control-flag* *pam\_login\_access* \[*options*\]

## DESCRIPTION

The *login.access* service module for PAM, **pam\_login\_access** provides functionality for only one PAM category: account management. In terms of the *module-type* parameter, this is the “account” feature.

### Login.access Account Management Module

The *login.access* account management component (**pam\_sm\_acct\_mgmt**()), returns success if and only the user is allowed to login on the specified tty (in the case of a local login) or from the specified remote host (in the case of a remote login), according to the restrictions listed in [login.access(5)](/login.access/5.md).

- **accessfile**=*pathname*

  specifies a non-standard location for the *login.access* configuration file (normally located in */etc/login.access*).

- **nodefgroup**

  makes tokens not enclosed in parentheses only match users, requiring groups to be specified in parentheses. Without **nodefgroup** user and group names are intermingled, with user entries taking precedence over group entries. This is not backwards compatible with legacy *login.access* configuration files. However this mitigates confusion between users and groups of the same name.

- **fieldsep**=*separators*

  changes the field separator from the default ":". More than one separator may be specified.

- **listsep**=*separators*

  changes the field separator from the default space (''), tab (\\t) and comma (,). More than one separator may be specified. For example, listsep=; will replace the default with a semicolon (;). This option may be useful when specifying Active Directory groupnames which typically contain spaces.

## SEE ALSO

[pam(3)](/pam/3.md), [syslog(3)](/syslog/3.md), [login.access(5)](/login.access/5.md), [pam.conf(5)](/pam.conf/5.md)

## AUTHORS

The [login.access(5)](/login.access/5.md) access control scheme was designed and implemented by Wietse Venema.

The **pam\_login\_access** module and this manual page were developed for the FreeBSD Project by ThinkSec AS and NAI Labs, the Security Research Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.