---
name: "pam_newnet"
section: "8"
platform: "linux"
package: "libpam-net"
version: "0.4-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/pam_newnet"
---

# pam\_newnet(8)

create a new network namespace at login

## NAME

pam\_newnet - create a new network namespace at login

## SYNOPSIS

**pam\_newnet.so**

## DESCRIPTION

The pam\_newnet PAM module creates a new network namespace at login for users in the *newnet* group.

Users in the *newnet* group can log-in through a network connection (e.g. by ssh) but their processes cannot communicate. The only interface they can see is the localhost of the namespace created at login time.

When pam\_newnet is used together with a specific **[cado(1)](/cado/1.md)** configuration users can configure their own networking services. (see https://github.com/rd235/cado)

The nsutils tools, and more specfically **netnsjoin(1)**, allow users to assign placeholders to keep namespaces alive, assign meaningful tags for an easier management, and later join any of their own namespaces (see https://github.com/rd235/nsutils)

## OPTIONS

**group=***groupname*

the module operates on users in the group *groupname* instead of *newnet*.

**lodown**

leave the localhost *lo* interface in the state DOWN.

## RETURN VALUES

PAM\_IGNORE

User does not belong to the *newnet* group.

PAM\_ABORT

Error in retrieving the user id or in the namespace creation.

PAM\_SUCCESS

Success.

## EXAMPLES

Add the following lines to /etc/pam.d/sshd or /etc/pam.d/login

session   required  pam\_newnet.so

session   required  pam\_newnet.so group=lonet lodown

## SEE ALSO

[**pam.conf**(5)](/pam.conf/5.md), [**pam.d**(5)](/pam.d/5.md), [**pam**(7)](/pam/7.md)

## AUTHOR

pam\_newnet was written by Renzo Davoli and Eduard Caizer, University of Bologna