text:
German/Grammar/Nouns

What Is a Noun?
A noun is a word that can be used to refer to a person, place, thing, quality, or idea, that is, a part of speech. It can serve as the subject or object of a verb. For example, a table (ein Tisch, eine Tafel) or a computer (ein Computer). What makes nouns in German special is that they must start with a capital letter in the written language.

Plurals
German, unlike English, has more than one way to make nouns plural, and plural form, like gender, must be memorized with every noun.

There are twelve different ways to form plurals in German. They are formed by affixes at the end of the word, and the umlaut of the vowel of the stem. They are - (changing nothing); -¨; -e; -¨e; -n; -¨n; -en; -¨en; -er; -¨er; -nen (to feminine suffix -in); -s (mainly with English loan-words); adding "foreign" endings (mainly Latin words); and changing suffixes (mainly Latin words).

When German nouns are used in the plural, their gender becomes irrelevant. The plural can almost be thought of as a gender on its own. In the plural, the definite article is always "die" when using the nominative and accusative cases.

When using the dative case, "den" is the definite article of all plurals. All plurals not ending in -n or -s affix an -n.

The definite article of the plural in the genitive case is "der".

Examples

Nominative: Die alten Männer spielen Schach. The old men are playing chess.

Accusative: Ich sah die alten Männer beim Schachspielen. I saw the old men as they played chess.

Dative: Ich spielte mit den alten Männern Schach. I played chess with the old men.

Genitive: Das Schachspiel der alten Männer war nicht sehr spannend. The old men's chess game was not very exciting.

Suffixes
Although gender and plural form are often arbitrary, there exist certain suffixes whose gender and plural form are regular. They are mainly feminine.

-ung, -heit, -keit, -schaft, -ion, and -tät

These are all feminine endings, which are pluralized by -en.

 * Diskussion(en)
 * Discussion(s)

 * Universtät(en)
 * University(ies)

-unft

This ending is feminine and is pluralized by changing the stem vowel and adding -e

 * Unterkunft
 * Lodging

 * Unterkünfte
 * Lodgings

-ik

This ending often doesn't have a plural. When it does however, you add '-en

 * Technik(en)
 * Technique(s)

Other

When verb infinitives transform into nouns, they do not have a plural form.

 * das Sprechen
 * Language

Many masculine nouns are formed by verbal stems without a suffix. Many of these receive an umlaut in their plural form.

Gender
German, like many other languages, gives each noun a gender: Masculine, Feminine, and Neuter. Plural nouns also act differently not only with the verb of the sentence, but the article preceding it.

The way any particular word is classified may not be logical.

Examples: das Mädchen      the girl (neuter) die Person       the person (feminine - even when talking about a man)

However, not all German Nouns are randomly allocated a gender. The following notes will apply to most nouns but not all.

A note on Mädchen:

This is derived from the diminutive form of Maid (old, rarely used) - Maidchen. Grammatically it is neuter, but when referenced, nowadays the logical feminine gender can take over: "Das Mädchen und ihr Hund", instead of "Das Mädchen und sein Hund".

Compound nouns have the same gender as the last noun. Example: die Armbanduhr (wristwatch) (der Arm, das Band, die Uhr)

Masculine
There are far more masculine nouns than of either of the other genders. The masculine nominative definite article is der.

Semantic Groups Which Are Masculine
days             z.B. der Montag times of the day z.B. der Morgen months           z.B. der August seasons          z.B. der Sommer compass points: Norden, Osten, Süden, Westen, Nordwesten, ... (male) animals     z.B. der Löwe, der Hahn, der Ochse alcohol**        z.B. der Wein, der Likör, der Alkohol, der Champagner car***           z.B. der Wagen, der Opel, der Mercedes, der BMW

** However, it is das Bier, die Spirituose (because of the ending "-ose"), das Pils (because it is a beer), das Methanol (because it is a scientific term of a substance) *** Excepting "das Auto".

Nouns meaning a male person are usually masculine. Typical endings for such nouns are -er, -iker, -or, -ar, -är, -ent, -ant, -ist, -loge, -graph, -graf, -eur, -arch.
 * Examples (masculine): Mann, Sohn, Bub, Junge, Bruder, Vater, Enkel, Onkel, König, Lehrer, Mathematiker, Student, Arzt, Professor, Ingenieur, Demonstrant, Kommissar, Tourist, Meteorologe, Fotograf, Biograph, Monarch, Millionär
 * Exceptions: die Person, das Kind, das Baby, das Opfer, die Geisel (These words can mean a male or a female person but the gender stays the same.)

Words with Certain Endings
Nouns ending with -ismus are always masculine: der Kommunismus, der Anglizismus, der Terrorismus Nouns ending with -smus or -thmus are usually masculine: der Algorithmus, der Logarithmus, der Rhythmus, der Enthusiasmus, der Sarkasmus, der Orgasmus Nouns ending with -ling that are not English words are usually masculine (if they mean a person, they can mean a male or a female person): der Flüchtling (refugee), der Lehrling (apprentice), der Liebling (darling), der Schmetterling (butterfly), der Setzling, der Zwilling

Nouns ending with -or are often masculine: der Motor, der Rotor, der Faktor, der Vektor, der Prozessor, Äquator, Monitor Exceptions: das Labor (because it is short for das Laboratorium)

Nouns ending in -en are usually masculine (but not infinitives used as nouns. They are neuter: das Rauchen, das Lachen). Examples (masculine): Kuchen (cake), Frieden (peace), Glauben (faith), Balken, Bogen (bow), Socken (sock), Brocken, Stecken, Samen, Daumen (thumb), Boden, Busen, Degen, Reigen, Faden, Hafen, Haken, Laden, Orden, Rasen, Braten, Spaten, Ballen, Barren, Batzen, Drachen, Felsen (rock), Fetzen, Funken, Garten (garden), Galgen, Gaumen, Graben, Haufen, Hopfen, Klumpen, Kasten, Karren, Besen, Schuppen, Karpfen, Krapfen, Knoten, Kolben, Korken, Kragen, Lappen, Brunnen, Rahmen, Schaden, Ofen, Magen, Zapfen, Schinken, Knochen, Pfropfen, Topfen, Regen (rain), Reifen, Streifen, Tropfen, Hoden, Loden, Fladen, Roggen, Weizen, Segen, Husten, Schnupfen, Nacken, Packen, Rücken, Zacken, Zinken, Rachen, Rechen, Rochen, Wagen

Exceptions (neuter): Leben, Wissen, Essen, Küken, Laken, Leinen, Nomen, Becken, Examen, Fohlen, Wappen, Kissen, Eisen, Beben, Volumen, Treffen, Schreiben, Wesen, Zeichen

The following groups of nouns are relatively often masculine if they do not begin with the unstressed syllable Ge-: Nouns ending in -el (but not stressed on the last syllable): der Vogel Nouns ending in -er (but not -ier): der Hamster

Examples (-el, masculine): Vogel (bird), Apfel (apple), Himmel (sky, heaven), Nebel (fog), Hagel (hail), Nagel (nail), Nabel (navel), Schnabel (beak), Hebel (lever), Kübel (bucket), Löffel (spoon), Hügel (hill), Gipfel (peak), Wipfel (treetop), Schlüssel (key), Deckel (lid), Henkel (handle), Beutel (bag), Schenkel, Tempel, Zirkel, Würfel, Handel (trade), Flügel (wing), Gürtel (belt), Mantel (coat), Kegel, Ziegel, Knödel, Esel (donkey), Igel, Dackel, Pudel, Pinsel (paint brush), Titel (title), Ärmel, Muskel, Knöchel, Knorpel, Tunnel (tunnel), Artikel (article), Pegel, Pickel, Winkel (angle), Stapel, Zettel, Sessel (chair), Jubel, Trubel, Mörtel, Meißel, Kessel (kettle), Kittel, Sockel, Tümpel, Mangel, Büffel, Rüssel, Säbel, Bügel, Dübel, Egel, Engel (angel), Erpel, Pöbel

Exceptions (-el, feminine): Schachtel (box), Schüssel (bowl), Amsel, Drossel, Wachtel, Kordel, Kurbel, Achsel, Dattel, Ampel, Insel (island), Muschel, Regel (rule), Wurzel (root), Bibel, Fabel, Gabel (fork), Nadel (needle), Nudel, Kugel, Fackel, Gondel, Kapsel, Tafel, Rodel, Orgel, Formel (formula), Geisel, Distel, Eichel, Angel

Exceptions (-el, neuter): Segel (sail), Kabel (cable), Pendel (pendulum), Kapitel (chapter), Rätsel, Wiesel, Ziesel, Orakel, Ferkel, Übel, Paddel, Debakel, Rudel, Nickel

Examples (-er, masculine): Acker, Ärger, Anker, Eifer, Eimer, Eiter, Hafer, Käfer, Biber, Tiger, Kater, Kader, Köder, Laser, Polster, Bagger, Becher, Bohrer, Hammer, Hamster, Bunker, Donner, Dotter, Dünger, Fächer, Falter, Fehler, Filter, Finger, Fühler, Höcker, Hocker, Hummer, Hunger, Ingwer, Jammer, Keller, Kerker, Kleber, Körper, Koffer, Krater, Kühler, Kummer, Luster, Ordner, Panzer, Puffer, Sender, Sommer, Teller, Walzer, Wecker, Winter, Zauber, Zeiger, Zucker

Exceptions (-er, feminine): Ader, Butter, Dauer, Faser, Leiter, Feder, Feier, Leber, Mauer, Oper, Elster, Folter, Kammer, Nummer, Steuer, Trauer, Wimper, Ziffer

Exceptions (-er, neuter): Alter, Messer, Fenster, Feuer, Futter, Wasser, Wetter, Lager, Leder, Opfer, Puder, Pulver, Ruder, Ufer, Banner, Fieber, Gatter, Gitter, Kupfer, Muster, Poster, Silber, Wunder, Zimmer

Nouns that end with -pf but do not begin with Ge- are often masculine. Examples (masculine): Kopf, Zopf, Napf, Sumpf, Strumpf, Dampf, Kampf, Rumpf, Tropf, Knopf, Kropf, Krampf, Stumpf, Trumpf, Propf, Schopf, Topf, Unterschlupf, Gugelhupf

Nouns ending in -aum are often masculine.

Examples: Baum, Traum, Schaum, Raum, Saum, Flaum

Nouns ending in -ang are often masculine.

Examples: Drang, Fang, Gang, Hang, Klang, Rang, Anfang, Empfang, Gesang, Tang

Nouns ending in -und are often masculine.

Examples: Bund, Grund, Schund, Hund, Fund, Schwund, Schlund, Mund

Exceptions: neuter: Pfund

Nouns ending in -all are often masculine.

Examples: Ball, Fall, Krawall, Drall, Hall, Wall, Aufprall, Kristall, Knall, Schall, Zufall, Abfall, Vorfall, Schwall

Exceptions: neuter: All, Metall, Intervall feminine: Nachtigall

Feminine
The feminine Gender article is die. It is used in the nominative and accusative singular case. It is also used to indicate nominative and accusative plural for nouns of any gender.

e.g. die Katze — Feminine —or— die Katzen — feminine plural die Männer - masculine plural die Mädchen - neuter plural

Semantic Groups Which Are Feminine
Female persons and (female) animals are usually feminine (very few exceptions).

Examples: die Frau (woman) die Schwester (sister) die Mutter (mother)

To change a designation to explicitly feminine, one often uses the ending -in. der Lehrer - die Lehrerin (teacher) der Kaiser - die Kaiserin (emperor and empress) der König - die Königin (king and queen) der Arzt - die Ärztin (doctor) der Löwe - die Löwin (lion and lioness)

Exceptions das Mädchen (girl) das Kind (child) das Fräulein (old fashioned for Miss)

A lot of trees and other plants are also feminine.

Examples: die Buche (beech) die Eiche (oak) die Rose (rose) die Tulpe (tulip) die Nelke (carnation)

Exceptions: das Veilchen (violet), der Farn (fern) ...

Words With Certain Endings
Words with these endings are feminine: -heit: die Gesundheit (health), die Wahrheit (truth) -keit: die Möglichkeit (possibility) -schaft: die Wirtschaft, die Freundschaft -ei: die Türkei, die Mongolei, die Bäckerei*

Exceptions * das Ei (egg) has nothing to do with the ending -ei. Das Ei is neuter, including all words derived from: z.B. das Spiegelei, das Rührei, das Vogelei (different types of eggs) * der Papagei (parrot)

Words with the suffix -ung are feminine (they are usually derived from verbs). But: der Sprung, der Schwung, der Dung. Examples (feminine): die Beobachtung (observation; v: beobachten), die Verfolgung (persecution; v: verfolgen), Wohnung, Zeitung, Bildung, Währung, Werbung, Landung, Warnung, Erfahrung, Forschung, Übung, Beziehung, Richtung, Bewegung, Vorlesung, Bedeutung, Erziehung, Erklärung, Ordnung, Spannung, Bedingung, Siedlung, Öffnung, Handlung, Zeichnung, Lösung, Verbindung, Stimmung, Endung, Erzählung, Wirkung, Regierung, Einführung, Sammlung, Beratung, Neigung, Prüfung, Veränderung, Abteilung, Sendung, Rettung, Erfindung, Verletzung, Leistung

Words derived from verbs (mostly irregular verbs) and ending in -t are feminine: die Handschrift (hand writing (n), derived from schreiben), die Fahrt (journey, trip or ride, derived from fahren)

Many German nouns end with an -e that is pronounced [ə]. They are usually feminine if they do not mean a male person and do not begin with the unstressed syllable Ge-. Examples: die Lampe (lamp), die Karte (card, map), Liebe, Freude, Erde, Tasse, Masse, Klasse, Rasse, Rolle, Brücke, Lücke, Krücke, Ecke, Zecke, Decke, Strecke, Matte, Ratte, Krabbe, Ebbe, Sonne, Tonne, Wonne, Nonne, Farbe, Narbe, Nase, Zunge, Lunge, Wange, Zange, Spange, Lippe, Frage, Sprache, Suche, Seite, Kante, Bitte, Socke, Hose, Jacke, Kreide, Waffe, Sekunde, Minute, Stunde, Straße, Gasse, Suppe, Speise, Reise, Oase, Diagnose, Analyse, Krise, Seele, Flagge, Fahne, Falle, Bremse, Beute, Adresse, Presse, Messe, Toilette, Pause, Tomate, Banane, Melone, Kirsche, Pflaume, Ameise, Motte, Fliege, Biene, Wespe, Schlange, Schnecke, Giraffe, Spinne, Blume, Pflanze, Vase, Tanne, Kanne, Pfanne, Lüge, Sorge, Kappe, Liste, Summe, Zelle, Trompete, Flöte, Gitarre, Violine, Ehe, Schokolade, Wiese, Sache, Schule, Oboe, Treue, Kleie

Exceptions: der Name, der Wille, der Käse (cheese), der Friede, der Glaube, der Buchstabe (letter (symbol)), das Ende (end), das Interesse (interest), das Auge (eye), das Erbe (heritage), der Löwe (lion), der Hase (hare), der Affe (monkey), der Rabe, der Falke, der Drache, das Karate, der Rüde, das Genre, das Prozedere, der Ochse, der Welpe, das Finale

Foreign words: Words with the endings given below are stressed on the last syllable. They are feminine. -anz: die Eleganz, die Toleranz -enz: die Intelligenz (intelligence), die Konsequenz (consequence) -logie: die Biologie, die Meteorologie -grafie/graphie: die Biografie, die Orthografie -tät: die Universität, Majestät, Lokalität, Pietät, Integrität, Qualität, Aktivität, Priorität, Nationalität, Kapazität -tion, -sion, -gion, -xion, -lion, -nion: die Nation, die Mission, die Religion, die Reflexion, die Million, die Union -thek: die Bibliothek, die Diskothek

Words with the endings given below are usually feminine. -ie (but not English words, e.g. das Selfie): die Philosophie (philosophy), die Melodie (melody), die Familie, die Studie, die Demokratie -ik: die Musik (music), die Politik (politics), die Physik, die Klassik, die Gotik, die Romantik, Kritik -ur (but not -eur): die Kultur (culture), die Natur, die Temperatur, die Literatur, die Frisur, die Tastatur, die Armatur, die Glasur Exceptions: das Genie, das Mosaik, das Abitur, der Merkur, der Purpur

Words ending with -age are often feminine. Examples: Garage, Montage, Etage, Spionage, Persiflage, Blamage

Neuter
The neutral Gender article is das for the nominative and accusative case.

Semantic Groups Which Are Neuter
The letters of the alphabet are neuter: das A, das z, das scharfe S

Names of colors are neuter: das Blau, das Rot, das Gelb, das Hellgrün, das Dunkelbraun

Languages are usually neuter. Examples: Deutsch, Englisch, Esperanto, Latein

Countries with the ending -ien, -land, -reich or -stan are always neuter.

Examples: Italien, Spanien, Deutschland, England, Österreich, Frankreich, Vereinigtes Königreich, Afghanistan, Pakistan

Other countries are often neuter.

Examples (neuter): China, Japan, Mexiko, Kanada, Peru, Chile, Nigeria, Bangladesch, Ägypten, Vietnam, Südafrika, Polen Exceptions: masculine: Irak, Iran, Jemen, Senegal, Sudan, Niger feminine: Schweiz, Slowakei, Türkei, Mongolei, Ukraine

The definite article of neuter countries is only used when there is an adjective, e.g. you have to say "ich bin in Österreich", not "ich bin im Österreich", but you say "ich bin im schönen Österreich". The definite article of masculine and feminine countries is always used, e.g. "ich bin in der Schweiz", "ich bin in der schönen Schweiz", "ich bin im Senegal".

Afrika, Amerika, Asien, Europa and Ozeanien are neuter. Arktis and Antarktis are feminine.

Words With Certain Endings
Words with the diminutive endings -lein and -chen are always neuter: das Mädchen (girl), das Häuschen (little house), das Büchlein (little book)

Words with the ending -tum are often neuter. Examples: Judentum, Heldentum, Rittertum, Rowdytum, Schrifttum, Sklaventum, Spießertum, Volkstum, Wachstum, Altertum, Brauchtum, Bürgertum, Christentum, Eigentum, Fürstentum, Heiligtum

Exceptions: der Reichtum, der Irrtum

Words with these endings are often neuter: ending -um if the word has Latin origin: das Zentrum, das Museum, Studium, Stadium, Kriterium, Maximum, Minimum, Optimum, Jubiläum, Evangelium, Gymnasium, Ministerium, Album, Opium, Podium, Serum, Vakuum, Visum, Aquarium, Terrarium, Bakterium, Auditorium, Publikum, Forum, Datum, Impressum, Individuum, Ultimatum Exceptions: der Konsum ending -ment: das Parlament (parliament), das Fundament (base, basis), das Element (element), Dokument, Experiment, Instrument, Kompliment, Medikament, Temperament, Abonnement, Management, Fragment, Monument, Ornament, Pergament, Segment, Testament, Argument, Pigment, Sortiment, Apartment, Equipment, Exkrement, Reglement, Sakrament, Statement Exceptions: der Zement, der Konsument

Words that end with -em and are stressed on the last syllable are often neuter.

Examples: Problem, Theorem, System, Extrem, Emblem, Ekzem, Diadem, Phonem, Ödem Also these words with the stress on the first syllable are neuter: Modem, Totem, Tandem, Requiem But these words with the stress on the first syllable are masculine: Atem, Harem, Moslem

Foreign words that end with -ett and are stressed on the last syllable are often neuter.

Examples: Tablett, Etikett, Korsett, Parkett, Kabarett, Ballett

Words that end with -ma are often neuter.

Examples: Thema, Trauma, Drama, Dilemma, Prisma, Schema, Koma, Klima, Komma, Karma, Lama, Dogma, Paradigma, Charisma, Magma, Panorama, Plasma, Stigma, Aroma

Exceptions: feminine: Firma masculine: Puma

Words that end with -om or -ym are often neuter.

Examples: Syndrom, Palindrom, Phantom, Polynom, Binom, Monom, Atom, Axiom, Genom, Symptom, Diplom, Kondom, Chromosom, Metronom; Enzym, Pseudonym, Synonym, Akronym

Foreign words from English with the ending -ing are usually neuter. Examples (neuter): Training, Stalking, Jogging, Mobbing, Lobbying, Marketing, Recycling Exceptions: feminine: Holding (because it is short for die Holdinggesellschaft)

Words that end with -skop, -fon, -phon or -gramm are usually neuter. Examples: Mikroskop, Teleskop, Periskop, Kaleidoskop, Horoskop, Telefon, Mikrophon, Megaphon, Grammophon, Programm, Diagramm, Parallelogramm, Kilogramm, Autogramm, Hologramm, Telegramm

Words With Certain Beginnings
Nouns that begin with the unstressed syllable Ge-, do not mean a person and do not end with the feminine suffix -heit, -keit, -schaft or -ung are often neuter.

Examples: Gedicht (poem), Gericht (court, dish), Gesicht (face), Gewicht (weight), Geheimnis (secret), Gebirge (mountains), Geschirr (dishes), Gedächtnis (memory), Gebiet, Gespenst, Gewissen, Gesetz (law), Getränk (drink), Gewand, Gewitter (thunderstorm), Geschenk (present), Gespräch (talk), Gebäude (building), Gehäuse (case), Gemüse (vegetable), Geschäft (shop), Getreide (cereal), Gerücht (rumor), Gewerbe, Gefühl (feeling), Gepäck (luggage), Gehirn (brain), Gewürz (spice), Gemälde (painting), Gebet (prayer), Gerät (device), Gebiss, Gesindel, Gerangel, Gelaber, Getue, Gewehr, Gesuch, Gelenk, Geweih, Gewinde, Geschrei, Gebäck, Gewirr, Gebell, Gewühl, Gewölbe, Gewieher, Gejaule, Gewässer, Gewebe, Gewächs, Gestrüpp, Gestüt, Gestein, Gestell, Gestirn, Getöse, Geschlecht, Geschoss, Geschoß, Geschütz, Geschwader, Geschick, Geschwür, Gespür, Geschehen, Gesäß, Gerede, Gerippe, Geröll, Gerüst, Gerinnsel, Gerümpel, Gelände, Gelächter, Gemäuer, Gelage, Gemenge, Gemetzel, Gemüt, Genick, Geräusch, Gefäß, Geschöpf, Geschwätz

Exceptions: masculine: Gedanke (thought), Genuss (enjoyment), Geschmack (taste), Gewinn (prize, profit), Geruch (smell), Gestank (stink), Gebrauch (use), Gesang (singing), Gefallen (favor) feminine: Gewalt (violence), Gestalt, Geschichte (story, history), Gemeinde, Gefahr (danger), Geduld (patience), Gewähr, Gebühr, Geburt (birth), Gebärde

Nouns Derived From Infinitives
Verbs used as noun (roughly corresponding to the gerund) are neuter: das Rauchen (Smoking), das Lesen (Reading)

Masculine or Neuter
Words that end with a double consonant, -ck, -tz or -ß are usually masculine or neuter if they do not end with -ness. Exceptions (feminine): Nuss, Null, Nachtigall, Hatz, Hetz, Geiß, Maß (different meaning than das Maß)

Examples (masculine): Pass, Biss, Sinn, Damm, Zoll, Stoff, Griff, Tipp, Müll, Witz, Schluck, Rock, Ritt, Tritt, Kuss, Fluss, Schluss, Schuss, Schlamm, Gruß, Fuß, Fraß, Scheiß, Stoß, Schoß, Fleiß, Grieß, Kloß, Löss/Löß, Ruß, Spaß, Spieß, Schweiß, Strauß

Examples (neuter): Ass, Fass, Kinn, Fell, Schiff, Kaff, Netz, Deck, Glück, Bett, Brett, Lamm, Schloss, Maß, Floß, Gefäß, Gesäß, Edelweiß, Geschoß/Geschoss

Words that end with -kt are usually masculine or neuter. Examples (masculine): Prospekt, Sekt, Takt, Pakt, Trakt, Markt, Punkt, Aspekt, Defekt, Effekt, Infekt, Affekt, Dialekt, Infarkt, Kontakt, Akt, Respekt, Instinkt, Konflikt, Kontrakt, Architekt, Intellekt, Katarakt Examples (neuter): Projekt, Produkt, Objekt, Subjekt, Edikt, Delikt, Insekt, Relikt, Konfekt, Verdikt, Artefakt, Konstrukt, Perfekt Examples (masculine and neuter): Fakt, Extrakt, Aquädukt, Viadukt

Exceptions (feminine): Katarakt (different meaning than der Katarakt)

Words that end with -o are usually neuter or masculine.

Examples (neuter): Auto, Video, Kino, Kilo, Büro, Sakko, Solo, Ego, Deo, Bistro, Manko, Banjo, Tempo, Motto, Fresko, Embargo, Esperanto, Studio, Ghetto, Foto, Echo, Piano, Cello, Kasino, Klo, Duo, Trio, Ufo, Konto, Go, Judo, Logo, Veto, Karo, Polo, Lasso, Lotto, Porto, Rodeo, Bingo, Intro, Credo/Kredo, Mikro, Makro, Rollo, Rondo, Risiko, Rokoko, Cabrio, Eldorado, Fiasko, Cembalo, Inferno, Placebo, Shampoo, Inkasso, Kommando, Libretto, Neutrino, Szenario, Portfolio, Abo, Intermezzo, Montenegro, Marokko, Monaco, Mexiko, Memo

Examples (masculine): Euro, Tango, Fango, Espresso, Embryo, Torpedo, Salto, Po, Kakao, Zoo, Pluto, Saldo, Torso, Korso, Gecko, Ginkgo, Porno, Macho, Tacho, Torero, Sombrero, Trafo, Bolero, Dynamo, Eskimo, Gigolo, Kimono, Pharao, Poncho, Oregano, Tornado, Calypso, Schirokko, Flamenco, Flamingo, Cappuccino, Mungo, Dingo, Gusto

Examples (neuter and masculine): Radio, Silo, Storno, Tattoo, Techno, Indigo, Kosovo

Exceptions (feminine): Demo, Disko, Limo, Info (because they are short for die Demonstration, die Diskothek, die Limonade/Limousine, die Information); Uno/UNO, NATO, NGO (because the O stands for die Organisation); Mango, Avocado, Libido

Neuter or Feminine
Words with the ending -nis are usually neuter or feminine. Examples (neuter): Zeugnis, Hindernis, Bekenntnis, Ereignis, Geheimnis, Gefängnis, Gedächtnis, Erlebnis, Ärgernis, Bildnis, Hemmnis, Bündnis, Wagnis, Verzeichnis, Bedürfnis, Begräbnis, Besäufnis, Erzeugnis, Geständnis, Verhältnis, Zerwürfnis, Ergebnis, Verständnis

Examples (feminine): Wildnis, Kenntnis, Befugnis, Ödnis, Fäulnis, Erlaubnis, Bitternis, Bedrängnis, Finsternis

Birds
Bird species that end with -e or -el are often feminine. Examples (feminine): Amsel (blackbird), Drossel (thrush), Wachtel (quail), Taube (dove, pigeon), Möwe (gull), Krähe (crow), Meise (tit), Ente (duck), Eule (owl), Lerche (lark), Schwalbe (swallow, martin)

Exceptions (masculine): Tölpel (gannet, booby), Rabe (raven), Falke (hawk, falcon)

Bird species that end with -chen are often neuter. Examples (neuter): Rotkehlchen (robin)

Other bird species are often masculine. Vogel (bird) is masculine too. Examples (masculine): Uhu (eagle owl), Papagei (parrot), Kuckuck (cuckoo), Star, Reiher, Spatz, Fink, Adler (eagle), Geier, Habicht, Pinguin, Pelikan, Albatros, Kormoran, Schwan, Pfau, Kolibri, Wellensittich, Strauß, Kakadu, Emu, Kasuar, Kiwi, Storch, Kranich, Wiedehopf, Tukan, Nandu

Exceptions (feminine): Elster, Gans (goose), Nachtigall (nightingale)

Exceptions (neuter): Huhn (chicken)

Fish
Fish species that end with -e are often feminine. Examples (feminine): Forelle, Makrele, Scholle, Sardine, Äsche, Groppe, Seekatze, Seezunge

Exceptions (neuter): Neunauge

Exceptions (masculine): Meerrabe

Other fish species are often masculine. Fisch (fish) is masculine too. Dolphins and whales are not fish, but Delphin (dolphin) and Wal (whale) are masculine too. Examples (masculine): Karpfen (carp), Hai (shark), Stör, Hecht, Piranha, Aal, Wels, Barsch, Rochen, Hering, Lachs, Goldfisch, Thunfisch, Kabeljau, Zander, Saibling, Zobel, Barrakuda, Steinbutt, Dorsch

Exceptions (feminine): Grundel, Flunder, Seenadel

Rivers
Rivers in Europe and Russia are usually feminine or masculine. Other rivers are usually masculine. Examples (feminine, Europe/Russia): Donau, Wolga, Seine, Themse, Elbe, Oder, Weichsel, Loire, Maas, Weser, Moldau, Isar Examples (masculine, Europe/Russia): Rhein, Main, Po, Tiber, Don, Dnjepr, Tajo, Ebro, Inn, Neckar Examples (masculine, not Europe/Russia): Nil, Amazonas, Mississippi, Rio Grande, Ganges, Jangtsekiang, Kongo, Yukon River, Orinoco, Euphrat, Tigris

Chemical Elements
The chemical elements with the ending -stoff are masculine (because of der Stoff): Wasserstoff, Sauerstoff, Stickstoff, Kohlenstoff. The others are usually neuter: Gold, Silber, Eisen, Kupfer, Aluminium, Platin, Helium, Neon, Chlor, ... Exceptions: der Schwefel, der Phosphor

Tips For Learning
As most German articles can not be attributed to certain rule, it is best to always learn the article when learning the noun. You may think of the article as necessary information belonging to every noun. You avoid a lot of looking-up-time that way.

Looking Up Gender in Dictionaries
Most dictionaries do not give the article. Instead, you find different sets of abbreviations which tell you to which class the noun in question belongs.

The most common sets of abbreviations are: r, e, and s. r: der, masculine; e: die, feminine; s: das, neuter. The abbreviations of this type are usually given before the noun.

m., f., and n.. m.: masculine; f.: feminine; n.: neuter. The abbreviations of this type are usually given after the noun.

m., w., and s.. m.: männlich, masculine; w.: weiblich, feminine; s.: sächlich, neuter. The abbreviations of this type are usually given after the noun.

Contents

 * /Adjectival Nouns/
 * /Weak Nouns/
 * /Mixed Nouns/

title: German/Grammar/Nouns


text:
Japanese/Vocabulary/Video games

=Videogame Vocabulary=

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

title: Japanese/Vocabulary/Video games


text:
LPI Linux Certification/LPIC2 Exam 202/DNS

Section Overview

 * Basic BIND 8 configuration
 * Create and maintain DNS zones
 * Securing a DNS server

Setting up a caching-only nameserver
To speed up the cumbersome process of DNS queries, DNS servers usually cache answers from other DNS servers – even negative queries (i.e an authoritative server's answer « name does not exist » is also cached by your local DNS)

Configuring BIND as a caching-only nameserver involves setting up only a «. » zone, that is, only tell it about the root nameservers and not specifying any zones, as follows :

zone «. » in { type hint; file « named.cache »; };

The file named.cache can be generated by using dig @a.root-servers.net Logging in BIND is controlled by two main concepts : channels and categories A channel specifies where logged data goes : to syslog, to a file, etc... A category specifies what data is logged

Channels allows you to filter messages by priority, like syslog's priorities. They are essentially the same, but two more are available for BIND : debug and dynamic, which affect debug level logging Debug sets a debug level, which will be active after the first trace command is given via ndc; dynamic will increment and decrement debug levels after each trace command is given via ndc

Example of logging configuration:

logging { channel my_syslog { syslog daemon; severity info; }; channel my_file { file « log.msgs »; severity dynamic; }; category statistics { my_syslog; my_file; }; category queries { my_file; }; };

To activate logging, after bind is started, issue a command :

ndc trace

Key terms, files and utilities : /etc/named.conf /usr/sbin/ndc /usr/sbin/named-bootconf Kill

Exercises
.

Create and maintain DNS zones
DNS zone files are composed mostly by resources records (RR) Resource records must start in the first column of a line The order in which they appear is not important, but most people tend to follow the order in the DNS RFCs SOA (Start Of Authority) : indicates authority for this zone NS (NameServer) : lists a nameserver for this zone Other records :

A : name-to-address mapping PTR : address-to-name mapping CNAME (canonical name) : aliases Don't forget to create a zone for 127.0.0 ! Create and maintain DNS zones Usual zone file format :

$TTL . IN SOA. . ( serial number ; refresh value ; retry value ;  expire value ;  negative caching TTL of 1 day .  IN  NS  . .  IN  NS  . ... .  IN  A   .  IN  A   ...

Create and maintain DNS zones For reverse mappings : $TTL .in-addr.arpa. IN SOA . . ( serial number ; refresh value ; retry value ;  expire value ;  negative caching TTL of 1 day .in-addr.arpa.  IN  NS  . .in-addr.arpa.  IN  NS  . ... .in-addr.arpa.  IN  PTR  . .in-addr.arpa.  IN  PTR  . ...

Key terms, files and utilities : Content of /var/named Zone file syntax Resources record formats Dig Nslookup Host

Exercises
.

Securing a DNS server
First of all, check security mailing lists and web sites for new versions of BIND. Particularly, versions prior to 8.2.3 are vulnerable to known attacks.

Hide your version number from foreign queries – it could be used to craft a special attack against you. Since BIND 8.2, you may use in named.conf:

options { version « None of your business »; };

You can also restrict queries : Globally :

options { allow-query { address-match-list; }; };

Or per-zone (which take precedence over global ACLs) :

zone « test.com » { type slave; file « db.test »; allow-query { 192.168.0.0/24; }; };

Even more important, make sure only real slave DNS can transfer your zones from your master. Use the keyword allow-transfer : Globally (in an « options » statement), applies to all zones Per-zone On the slaves, disable zone transfers! Use « allow-transfer { none; }; »

Don't run BIND as root ! Since 8.1.2, there are options to change the user (-u ) and group (-g) under which BIND runs. Use a non-privileged user (i.e create a new one, without shell access). Make sure your zone files have their correct permission (named.conf is read while BIND is still under root's permissions, so don't change this file's permissions)

Also, run bind in a chroot jail. Since 8.1.2, there is option -t to specify the directory for the nameserver to chroot to. Make sure all the files needed by BIND (i.e log files, etc..) are under the root-jail If you plan to use ndc with a chroot'ed BIND, don't forget to pass the new pathname to the UNIX socket to ndc !

Here's a little bit on how to setup a chrooted bind9 environment in Debian. As the configuration in bind9 is very similar, the same procedure applies to bind8 for creating a chrooted environment. /etc/init.d/bind9 stop OPTIONS="-u bind -t /var/lib/named" SYSLOGD="-a /var/lib/named/dev/log" mkdir /var/lib/named mkdir -p /var/lib/named/var/run/bind/run mkdir /var/lib/named/etc mkdir /var/lib/named/dev mkdir /var/lib/named/var/cache mv /etc/bind /var/lib/named/etc/bind ln -s /var/lib/named/etc/bind /etc/bind chown -R bind:bind /var/lib/named/var/* chown -R bind:bind /var/lib/named/etc/bind mknod /var/lib/named/dev/null c 1 3 mknod /var/lib/named/dev/random c 1 8 chown 666 /var/lib/named/dev/random /var/lib/named/dev/null /etc/init.d/sysklogd restart /etc/init.d/bind9 start
 * Stop the currently running bind.
 * In order to chroot bind in a jail, we need to specify what environment in /etc/default/bind9:
 * We still want logging in our /var/log/syslog, so we change /etc/default/syslogd that it opens an extra socket to which the chrooted bind can log through into /var/log/syslog.
 * Run a couple of mkdir's for the environment
 * Move over our existing config
 * Link it
 * Change ownership in the chrooted var and etc
 * Create some devices & set permissions
 * Restart syslogd & start bind

If bind does not start and there are error messages in the syslog, keep in mind that these messages where created from inside the chrooted domain, hence a permission problem about /var/run/bind/run/named.pid would mean that it is really a problem about /var/lib/named/var/run/bind/run/named.pid

Key terms, files and utilities : SysV init files /etc/named.conf /etc/passwd


text:
LPI Linux Certification/LPIC2 Exam 202/Web Services

Section Overview
Implementing a web server Maintaining a web server Implementing a proxy server

Implementing a Web server
Key terms, files and utilities :
 * access.log
 * .htaccess
 * httpd.conf
 * mod_auth
 * Htpasswd
 * Htgroup

Exercises Key terms, files and utilities :
 * Maintaining a Web server
 * Maintaining a Web server
 * httpd.conf

Exercises
 * Implementing a proxy server

We will be using the squid web proxy server version 2.4 and Linux kernel version 2.4.

Proxying can be done in two ways : normal proxying and transparent proxying
 * In normal proxying, the client specifies the hostname and port number of a proxy in his web browsing software. The browser then makes requests to the proxy, and the proxy forwards them to the origin servers.
 * In transparent proxying, ...

Use transparent proxying if : You want to force clients on your network to use the proxy, whether they want to or not. You want clients to use a proxy, but don't want them to know they're being proxied. You want clients to be proxied, but don't want to go to all the work of updating the settings in hundreds or thousands of web browsers.

There are two types of transparent proxying :

 * Squid on the gateway
 * Squid on a separate box than the gateway

Squid on the gateway box
Setting up squid for ordinary proxying is quite simple : after installing squid, edit the default configuration file squid.conf Find the following directives, uncomment them, and change them to the appropriate values: Next, look at the cache_effective_user and cache_effective_group directives, and set them up with a dedicated user and group (i.e squid/squid)
 * httpd_accel_host virtual
 * httpd_accel_port 80
 * httpd_accel_with_proxy on
 * httpd_accel_uses_host_header on

Finally, look at the http_access directive. The default is usually ``http_access deny all''. This will prevent anyone from accessing squid. For now, you can change this to ``http_access allow all'', but once it is working, you will probably want to read the directions on ACLs (Access Control Lists), and setup the cache such that only people on your local network (or whatever) can access the cache.

ACLs in squid will enable you to restrict access to the proxy. The general format for an ACL rule is : acl aclname acltype string1 ... ACL rules can then be used in the http_access directive

ACL types are : acl aclname src 172.16.1.0/24 acl aclname dst 172.16.1.0/24 acl ACLTIME time M 9:00-17:00 acl acceleratedport port 80 acl aclname proto HTTP FTP acl aclname method GET POST acl twoconn maxconn 5
 * Src : acl aclname src ip-address/netmask
 * Dst : acl aclname dst ip-address/netmask
 * Time : acl aclname time [day-abbreviations: M,T,W,H,F,A,S] [h1:m1-h2:m2]
 * Port : acl aclname port port-no
 * Proto : acl aclname proto protocol
 * Method : acl aclname method method-type
 * Maxconn : acl aclname maxconn integer

Next, initialize the cache directories with squid -z (if this is a not a new installation of squid, you should skip this step). Next, launch squid via the /etc/init.d/squid script, and you should be able to set your web browser's proxy settings to the IP of the box and port 3128 (unless you changed the default port number) and access squid as a normal proxy. Implementing a proxy server Transparent proxying can be set up in two different ways : on the router or on another (remote) host Transparent proxying on the router will involve setting up squid in the « normal », and configuring the packet filtering subsystem to redirect clients' connections to squid The kernel's networking options required are :
 * Under 'General Setup'
 * Networking support
 * Sysctl support

 * Under 'Networking Options'
 * Network packet filtering
 * TCP/IP networking

 * Under 'Networking Options' -> IP: Netfilter Configuration
 * Connection tracking
 * IP tables support
 * Full NAT
 * REDIRECT target support

 * Under 'File Systems'
 * /proc filesystem support

You must say NO to Fast switching under Networking Options !

Once you have your new kernel up and running, make sure you have IP forwarding enabled. Next, to configure iptables to enable transparent proxying, all you have to do is : iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3128

Transparent proxying to a remote box
Let's assume we have two boxes called squid-box and iptables-box, and that they are on the network local-network. First, on the machine that squid will be running on, squid-box, you do not need iptables or any special kernel options on this machine, just squid. You *will*, however, need the 'http_accel' options as described above. Now, on the machine that iptables will be running on, iptables-box, you will need to configure the kernel as described above, except that you don't need the REDIRECT target support. You will need 2 iptables rules : '''iptables -t nat -A PREROUTING -i eth0 -s ! squid-box -p tcp --dport 80 -j DNAT --to squid-box:3128''' iptables -t nat -A POSTROUTING -o eth0 -s local-network -d squid-box -j SNAT --to iptables-box The first one sends the packets to squid-box from iptables-box. The second makes sure that the reply gets sent back through iptables-box, instead of directly to the client. This is very important, because otherwise squid will never receive the answer from the target web server (and thus, no caching can take place!)

Key terms, files and utilities :
 * squid.conf
 * Acl
 * http_access
 * Exercises


text:
LPI Linux Certification/LPIC2 Exam 202/Network Client Management

Section Overview

 * DHCP configuration
 * NIS configuration
 * LDAP configuration
 * PAM authentication
 * DHCP configuration

Overview
Description: ''The candidate should be able to configure a DHCP server and set default options, create a subnet, and create a dynamically-allocated range. This objective includes adding a static host, setting options for a single host, and adding bootp hosts. Also included is to configure a DHCP relay agent, and reload the DHCP server after making changes.''

Key files, terms, and utilities include:

dhcpd.conf dhcpd.leases

DHCP?
Most people reading this will already know the DHCP protocol. Just as a quick reminder. DHCP stands for Dynamic Host Configuration Protocol and is commonly used to distribute specific network settings in networks. Settings such as the default gateway, nameservers, IP addresses and much more.

As for a small illustration of the protocol itself.

Configuring dhcpd
After the installation of dhcpd the main configuration file can be found at /etc/dhcpd.conf. For Debian installations, one should edit /etc/default/dhcp as soon as the installation is finished and change the following line according to your setup.

INTERFACES="eth1" # or "eth1 eth2", whatever interfaces you wish to serve ip's.

The dhcpd.conf file is divided in global parameters and subnet specific parameters. Each subnet can override the global parameters. The most commonly used parameters are the following.

option domain-name "example.com"; option domain-name-servers "192.168.0.1, 193.190.63.172" option subnet-mask 255.255.255.0; # global Subnet mask default-lease-time 600; # Seconds each DHCP lease is granted and after which a request for the same ip is launched. max-lease-time 7200; # If DHCP server does not respond, keep IP till 7200 seconds are passed. subnet 192.168.0.0 netmask 255.255.255.240 { # Subnet for first 13 devices, 10 of which are servers, 3 printers range 192.168.0.10 192.168.0.13; # Range of IP's for our printers option subnet-mask 255.255.255.240; option broadcast-address 192.168.0.15; # This is the subnets broadcast address option routers 192.168.0.14; # The gateway of this subnet option time-servers 192.168.0.14; # Gateway is running a timeserver option ntp-servers 192.168.0.14; # Gateway running a timeserver } subnet 192.168.0.16 netmask 255.255.255.224 { # Subnet for 29 computers range 192.168.0.17 192.168.0.45; option subnet-mask 255.255.255.224; option broadcast-address 192.168.0.47; option routers 192.168.0.46; } group { host server1 { # the first fixed server for subnet 192.168.0.0/28 server-name server1; hardware ethernet 0f:45:d3:23:11:90; fixed-address 192.168.0.1; } host server2 { server-name server2; hardware ethernet 0f:45:d3:23:11:91; fixed-address 192.168.0.2; } }

This example is just providing a hint about possible options and overrides.

More info can be found on dhcpd.conf and dhcp-options in man pages. Look in those pages too for information about using the DHCP server to serve BOOTP as well, useful for diskless clients..

Overview
Description: ''The candidate should be able to configure an NIS server and create NIS maps for major configuration files. This objective includes configuring a system as a NIS client, setting up an NIS slave server, and configuring ability to search local files, DNS, NIS, etc. in nsswitch.conf.''

Key files, terms, and utilities include:

nisupdate, ypbind, ypcat, ypmatch, ypserv, ypswitch, yppasswd, yppoll, yppush, ypwhich, rpcinfo nis.conf, nsswitch.conf, ypserv.conf /etc/nis/netgroup /etc/nis/nicknames /etc/nis/securenets

NIS
NIS stands for Network Information Service. Its purpose is to provide information, that has to be known throughout the network, to all machines on the network. Information likely to be distributed by NIS is login names/passwords/home directories (/etc/passwd) and group information (/etc/group)

If, for example, your password entry is recorded in the NIS passwd database, you will be able to login on all machines on the network which have the NIS client programs running.

Within a network there must be at least one machine acting as a NIS server. You can have multiple NIS servers, each serving different NIS "domains" - or you can have cooperating NIS servers, where one is the master NIS server, and all the other are so-called slave NIS servers (for a certain NIS "domain", that is!) - or you can have a mix of them...

Slave servers only have copies of the NIS databases and receive these copies from the master NIS server whenever changes are made to the master's databases. Depending on the number of machines in your network and the reliability of your network, you might decide to install one or more slave servers. Whenever a NIS server goes down or is too slow in responding to requests, a NIS client connected to that server will try to find one that is up or faster.

NIS databases are in so-called DBM format, derived from ASCII databases. For example, the files /etc/passwd and /etc/group can be directly converted to DBM format using ASCII-to-DBM translation software ("makedbm", included with the server software). The master NIS server should have both, the ASCII databases and the DBM databases.

Slave servers will be notified of any change to the NIS maps, (via the "yppush" program), and automatically retrieve the necessary changes in order to synchronize their databases. NIS clients do not need to do this since they always talk to the NIS server to read the information stored in it's DBM databases.

To run any of the software mentioned below you will need to run the program /usr/sbin/portmap. The RPC portmapper (portmap(8)) is a server that converts RPC program numbers into TCP/IP (or UDP/IP) protocol port numbers. It must be running in order to make RPC calls (which is what the NIS/NIS+ client software does) to RPC servers (like a NIS or NIS+ server) on that machine. When an RPC server is started, it will tell portmap what port number it is listening to, and what RPC program numbers it is prepared to serve. When a client wishes to make an RPC call to a given program number, it will first contact portmap on the server machine to determine the port number where RPC packets should be sent.

Since RPC servers could be started by inetd(8), portmap should be running before inetd is started. For secure RPC, the portmapper needs the Time service. Make sure, that the Time service is enabled in /etc/inetd.conf on all hosts:

# time   stream  tcp     nowait  root    internal time   dgram   udp     wait    root    internal
 * 1) Time service is used for clock synchronization.

IMPORTANT: Don't forget to restart inetd after changes on its configuration file !

What do you need to set up NIS?

Determine whether you are a Server, Slave or Client : Your machine is going to be part of a network with existing NIS servers You do not have any NIS servers in the network yet

In the first case, you only need the client programs (ypbind, ypwhich, ypcat, yppoll, ypmatch). The most important program is ypbind. This program must be running at all times, which means, it should always appear in the list of processes. It is a daemon process and needs to be started from the system's startup file (eg. /etc/init.d/nis, /sbin/init.d/ypclient, /etc/rc.d/init.d/ypbind, /etc/rc.local). As soon as ypbind is running your system has become a NIS client.

In the second case, if you don't have NIS servers, then you will also need a NIS server program (usually called ypserv). Section 9 describes how to set up a NIS server on your Linux machine using the "ypserv" daemon.

Setting Up the NIS Client
The ypbind daemon

Newer ypbind versions have a configuration file called /etc/yp.conf. You can hard code a NIS server there - for more info see the manual page for ypbind(8). You also need this file for NYS. An example:

ypserver 10.10.0.1 ypserver 10.0.100.8 ypserver 10.3.1.1

If the system cam resolv the hostnames without NIS, you may use the name, otherwise you have to use the IP address. ypbind 3.3 has a bug and will only use the last entry (ypserver 10.3.1.1 in the example). All other entries are ignored. ypbind-mt handle this correct and uses that one, which answered at first.

It might be a good idea to test ypbind before incorporating it in the startup files. To test ypbind do the following:

Make sure you have your YP-domain name set. If it is not set then issue the command: /bin/domainname nis.domain

where nis.domain should be some string _NOT_ normally associated with the DNS-domain name of your machine! The reason for this is that it makes it a little harder for external crackers to retrieve the password database from your NIS servers. If you don't know what the NIS domain name is on your network, ask your system/network administrator.

Start up "/usr/sbin/portmap" if it is not already running. Create the directory "/var/yp" if it does not exist. Start up "/usr/sbin/ypbind"

Use the command "rpcinfo -p localhost" to check if ypbind was able to register its service with the portmapper. The output should look like:

program vers proto  port 100000   2   tcp    111  portmapper 100000   2   udp    111  portmapper 100007   2   udp    637  ypbind 100007   2   tcp    639  ypbind

Or like this (depending on the version of ypbind you are using) :

program vers proto  port 100000   2   tcp    111  portmapper 100000   2   udp    111  portmapper 100007   2   udp    758  ypbind 100007   1   udp    758  ypbind 100007   2   tcp    761  ypbind 100007   1   tcp    761  ypbind

You may also run "rpcinfo -u localhost ypbind". This command should produce something like:

program 100007 version 1 ready and waiting program 100007 version 2 ready and waiting

The output depends on the ypbind version you have installed. Important is only the "version 2" message. At this point you should be able to use NIS client programs like ypcat, etc... For example, "ypcat passwd.byname" will give you the entire NIS password database.

IMPORTANT: If you skipped the test procedure then make sure you have set the domain name, and created the directory /var/yp. This directory MUST exist for ypbind to start up successfully. To check if the domainname is set correct, use the /bin/ypdomainname from yp-tools 2.2. It uses the yp_get_default_domain function which is more restrict. It doesn't allow for example the "(none)" domainname, which is the default under Linux and makes a lot of problems.

If the test worked you may now want to change your startupd files so that ypbind will be started at boot time and your system will act as a NIS client. Make sure that the domainname will be set before you start ypbind. Well, that's it. Reboot the machine and watch the boot messages to see if ypbind is actually started. For host lookups you must set (or add) "nis" to the lookup order line in your /etc/host.conf file. Please read the manpage "resolv+.8" for more details. Add the following line to /etc/passwd on your NIS clients:

+::::::

You can also use the + and - characters to include/exclude or change users. If you want to exclude the user guest just add -guest to your /etc/passwd file. You want to use a different shell (e.g. ksh) for the user "linux"? No problem, just add "+linux::::::/bin/ksh" (without the quotes) to your /etc/passwd. Fields that you don't want to change have to be left empty. You could also use Netgroups for user control.

For example, to allow login-access only to miquels, dth and ed, and all members of the sysadmin netgroup, but to have the account data of all other users available use:

+miquels::::::: +ed::::::: +dth::::::: +@sysadmins::::::: -ftp +:*::::::/etc/NoShell

Note that in Linux you can also override the password field, as we did in this example. We also remove the login "ftp", so it isn't known any longer, and anonymous ftp will not work. The netgroup would look like :

sysadmins (-,software,) (-,kukuk,)

The nsswitch.conf File
The Network Services switch file /etc/nsswitch.conf determines the order of lookups performed when a certain piece of information is requested, just like the /etc/host.conf file which determines the way host lookups are performed. For example, the line :

hosts: files nis dns

specifies that host lookup functions should first look in the local /etc/hosts file, followed by a NIS lookup and finally through the domain name service (/etc/resolv.conf and named), at which point if no match is found an error is returned. This file must be readable for every user! You can find more information in the man-page nsswitch.5 or nsswitch.conf.5.

A good /etc/nsswitch.conf file for NIS is:

passwd:    compat group:     compat
 * 1) /etc/nsswitch.conf

shadow:    compat passwd_compat: nis group_compat: nis shadow_compat: nis hosts:     nis files dns services:  nis [NOTFOUND=return] files networks:  nis [NOTFOUND=return] files protocols: nis [NOTFOUND=return] files rpc:       nis [NOTFOUND=return] files ethers:    nis [NOTFOUND=return] files netmasks:  nis [NOTFOUND=return] files netgroup:  nis bootparams: nis [NOTFOUND=return] files publickey: nis [NOTFOUND=return] files automount: files aliases:   nis [NOTFOUND=return] files
 * 1) For libc5, you must use shadow: files nis

Setting up a NIS Server
The Server Program ypserv

If you run your server as master, determine what files you require to be available via NIS and then add or remove the appropriate entries to the "all" rule in /var/yp/Makefile. You always should look at the Makefile and edit the Options at the beginning of the file.

There was one big change between ypserv 1.1 and ypserv 1.2. Since version 1.2, the file handles are cached. This means you have to call makedbm always with the -c option if you create new maps. Make sure, you are using the new /var/yp/Makefile from ypserv 1.2 or later, or add the -c flag to makedbm in the Makefile. If you don't do that, ypserv will continue to use the old maps, and not the updated one.

Now edit /var/yp/securenets and /etc/ypserv.conf. For more information, read the ypserv(8) and ypserv.conf(5) manual pages.

Make sure the portmapper (portmap(8)) is running, and start the server ypserv. The command « rpcinfo -u localhost ypserv » should output something like :

program 100004 version 1 ready and waiting program 100004 version 2 ready and waiting

The "version 1" line could be missing, depending on the ypserv version and configuration you are using. It is only necessary if you have old SunOS 4.x clients.

Now generate the NIS (YP) database. On the master, run :

% /usr/lib/yp/ypinit -m

On a slave make sure that ypwhich -m works. This means, that your slave must be configured as NIS client before you could run « /usr/lib/yp/ypinit -s masterhost » to install the host as NIS slave. That's it, your server is up and running.

If you have bigger problems, you could start ypserv and ypbind in debug mode on different xterms. The debug output should show you what goes wrong.

If you need to update a map, run make in the /var/yp directory on the NIS master. This will update a map if the source file is newer, and push the files to the slave servers. Please don't use ypinit for updating a map. You might want to edit root's crontab *on the slave* server and add the following lines:

20 *   * * *    /usr/lib/yp/ypxfr_1perhour 40 6   * * *    /usr/lib/yp/ypxfr_1perday 55 6,18 * * *   /usr/lib/yp/ypxfr_2perday

This will ensure that most NIS maps are kept up-to-date, even if an update is missed because the slave was down at the time the update was done on the master.

You can add a slave at every time later. At first, make sure that the new slave server has permissions to contact the NIS master. Then run :

% /usr/lib/yp/ypinit -s masterhost

on the new slave. On the master server, add the new slave server name to /var/yp/ypservers and run make in /var/yp to update the map.

The Program rpc.ypxfrd
rpc.ypxfrd is used for speed up the transfer of very large NIS maps from a NIS master to NIS slave servers. If a NIS slave server receives a message that there is a new map, it will start ypxfr for transfering the new map. ypxfr will read the contents of a map from the master server using the yp_all function. This process can take several minutes when there are very large maps which have to store by the database library.

The rpc.ypxfrd server speeds up the transfer process by allowing NIS slave servers to simply copy the master server's map files rather than building their own from scratch. rpc.ypxfrd uses an RPC-based file transfer protocol, so that there is no need for building a new map.

rpc.ypxfrd can be started by inetd. But since it starts very slow, it should be started with ypserv. You need to start rpc.ypxfrd only on the NIS master server.

The Program rpc.yppasswdd
Whenever users change their passwords, the NIS password database and probably other NIS databases, which depend on the NIS password database, should be updated. The program "rpc.yppasswdd" is a server that handles password changes and makes sure that the NIS information will be updated accordingly. rpc.yppasswdd is now integrated in ypserv. You don't need the older, separate yppasswd-0.9.tar.gz or yppasswd-0.10.tar.gz, and you shouldn't use them any longer. The rpc.yppasswdd in ypserv 1.3.2 has full shadow support. yppasswd is now part of yp-tools-2.2.tar.gz.

You need to start rpc.yppasswdd only on the NIS master server. By default, users are not allowed to change their full name or the login shell. You can allow this with the -e chfn or -e chsh option. If your passwd and shadow files are not in another directory then /etc, you need to add the -D option. For example, if you have put all source files in /etc/yp and wish to allow the user to change his shell, you need to start rpc.yppasswdd with the following parameters:

rpc.yppasswdd -D /etc/yp -e chsh or rpc.yppasswdd -s /etc/yp/shadow -p /etc/yp/passwd -e chsh

There is nothing more to do. You just need to make sure, that rpc.yppasswdd uses the same files as /var/yp/Makefile. Errors will be logged using syslog.

If everything is fine (as it should be), you should be able to verify your installation with a few simple commands. Assuming, for example, your passwd file is being supplied by NIS, the command :

% ypcat passwd

should give you the contents of your NIS passwd file. The command :

% ypmatch userid passwd

(where userid is the login name of an arbitrary user) should give you the user's entry in the NIS passwd file. The "ypcat" and "ypmatch" programs should be included with your distribution of traditional NIS or NYS. Once you have NIS correctly configured on the server and client, you do need to be sure that the configuration will survive a reboot. On RedHat, create or modify the variable NISDOMAIN in the file /etc/sysconfig/network.

Exercises
.

Overview
Key terms, files and utilities : Slapd slapd.conf

PAM authentication
test

PAM (Pluggable Authentication Modules) is a flexible mechanism for authenticating users. Since the beginnings of UNIX, authenticating a user has been accomplished via the user entering a password and the system checking if the entered password corresponds to the encrypted official password that is stored in /etc/passwd. The idea being that the user *is* really that user if and only if they can correctly enter their secret password. That was in the beginning. Since then, a number of new ways of authenticating users have become popular. Including more complicated replacements for the /etc/passwd file, and hardware devices Smart cards etc.. The problem is that each time a new authentication scheme is developed, it requires all the necessary programs (login, ftpd etc...) to be rewritten to support it. PAM provides a way to develop programs that are independent of authentication scheme. These programs need "authentication modules" to be attatched to them at run-time in order to work. Which authentication module is to be attatched is dependent upon the local system setup and is at the discretion of the local system administrator. PAM authentication Linux-PAM (Pluggable Authentication Modules for Linux) is a suite of shared libraries that enable the local system administrator to choose how applications authenticate users. In other words, without (rewriting and) recompiling a PAM-aware application, it is possible to switch between the authentication mechanism(s) it uses. Indeed, one may entirely upgrade the local authentication system without touching the applications themselves. Historically an application that has required a given user to be authenticated, has had to be compiled to use a specific authentication mechanism. For example, in the case of traditional UN*X systems, the identity of the user is verified by the user entering a correct password. This password, after being prefixed by a two character ``salt'', is encrypted (with crypt(3)). The user is then authenticated if this encrypted password is identical to the second field of the user's entry in the system password database (the /etc/passwd file). On such systems, most if not all forms of privileges are granted based on this single authentication scheme. Privilege comes in the form of a personal user-identifier (uid) and membership of various groups. Services and applications are available based on the personal and group identity of the user. Traditionally, group membership has been assigned based on entries in the /etc/group file. PAM authentication Unfortunately, increases in the speed of computers and the widespread introduction of network based computing, have made once secure authentication mechanisms, such as this, vulnerable to attack. In the light of such realities, new methods of authentication are continuously being developed. It is the purpose of the Linux-PAM project to separate the development of privilege granting software from the development of secure and appropriate authentication schemes. This is accomplished by providing a library of functions that an application may use to request that a user be authenticated. This PAM library is configured locally with a system file, /etc/pam.conf (or a series of configuration files located in /etc/pam.d/) to authenticate a user request via the locally available authentication modules. The modules themselves will usually be located in the directory /lib/security and take the form of dynamically loadable object files (see dlopen(3)). PAM authentication Overview For the uninitiated, we begin by considering an example. We take an application that grants some service to users; login is one such program. Login does two things, it first establishes that the requesting user is whom they claim to be and second provides them with the requested service: in the case of login the service is a command shell (bash, tcsh, zsh, etc.) running with the identity of the user. Traditionally, the former step is achieved by the login application prompting the user for a password and then verifying that it agrees with that located on the system; hence verifying that as far as the system is concerned the user is who they claim to be. This is the task that is delegated to Linux-PAM. From the perspective of the application programmer (in this case the person that wrote the login application), Linux-PAM takes care of this authentication task -- verifying the identity of the user. PAM authentication The flexibility of Linux-PAM is that you, the system administrator, have the freedom to stipulate which authentication scheme is to be used. You have the freedom to set the scheme for any/all PAM-aware applications on your Linux system. That is, you can authenticate from anything as naive as simple trust (pam_permit) to something as paranoid as a combination of a retinal scan, a voice print and a one-time password! To illustrate the flexibility you face, consider the following situation: a system administrator (parent) wishes to improve the mathematical ability of her users (children). She can configure their favorite ``Shoot 'em up game'' (PAM-aware of course) to authenticate them with a request for the product of a couple of random numbers less than 12. It is clear that if the game is any good they will soon learn their multiplication tables. As they mature, the authentication can be upgraded to include (long) division! PAM authentication Linux-PAM deals with four separate types of (management) task. These are: authentication management; account management; session management; and password management. The association of the preferred management scheme with the behavior of an application is made with entries in the relevant Linux-PAM configuration file. The management functions are performed by modules specified in the configuration file. The Linux-PAM library consults the contents of the PAM configuration file and loads the modules that are appropriate for an application. These modules fall into one of four management groups and are stacked in the order they appear in the configuration file. These modules, when called by Linux-PAM, perform the various authentication tasks for the application. Textual information, required from/or offered to the user, can be exchanged through the use of the application-supplied conversation function. PAM authentication Linux-PAM is designed to provide the system administrator with a great deal of flexibility in configuring the privilege granting applications of their system. The local configuration of those aspects of system security controlled by Linux-PAM is contained in one of two places: either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. Linux-PAM specific tokens in this file are case insensitive. The module paths, however, are case sensitive since they indicate a file's name and reflect the case dependence of typical Linux file-systems. The case-sensitivity of the arguments to any given module is defined for each module in turn. In addition to the lines described below, there are two special characters provided for the convenience of the system administrator: comments are preceded by a `#' and extend to the next end-of-line; also, module specification lines may be extended with a `\' escaped newline. A general configuration line of the /etc/pam.conf file has the following form: : service-name  module-type   control-flag   module-path   args PAM authentication Below, we explain the meaning of each of these tokens. The second (and more recently adopted) way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory. Once we have explained the meaning of the above tokens, we will describe this method.

Service-name The name of the service associated with this entry. Frequently the service name is the conventional name of the given application. For example, `ftpd', `rlogind' and `su', etc.. There is a special service-name, reserved for defining a default authentication mechanism. It has the name `OTHER' and may be specified in either lower or upper case characters. Note, when there is a module specified for a named service, the `OTHER' entries are ignored.

PAM authentication Module-type One of (currently) four types of module. The four types are as follows:

auth; this module type provides two aspects of authenticating the user. Firstly, it establishes that the user is who they claim to be, by instructing the application to prompt the user for a password or other means of identification. Secondly, the module can grant group membership (independently of the /etc/groups file discussed above) or other privileges through its credential granting properties.

account; this module performs non-authentication based account management. It is typically used to restrict/permit access to a service based on the time of day, currently available system resources (maximum number of users) or perhaps the location of the applicant user---`root' login only on the console.

session; primarily, this module is associated with doing things that need to be done for the user before/after they can be given service. Such things include the logging of information concerning the opening/closing of some data exchange with a user, mounting directories, etc..

password; this last module type is required for updating the authentication token associated with the user. Typically, there is one module for each `challenge/response' based authentication (auth) module-type. PAM authentication Control-flag The control-flag is used to indicate how the PAM library will react to the success or failure of the module it is associated with. Since modules can be stacked (modules of the same type execute in series, one after another), the control-flags determine the relative importance of each module. The application is not made aware of the individual success or failure of modules listed in the `/etc/pam.conf' file. Instead, it receives a summary success or fail response from the Linux-PAM library. The order of execution of these modules is that of the entries in the /etc/pam.conf file; earlier entries are executed before later ones. As of Linux-PAM v0.60, this control-flag can be defined with one of two syntaxes. The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the severity of concern associated with the success or failure of a specific module. There are four such keywords: required, requisite, sufficient and optional. PAM authentication Control-flag The Linux-PAM library interprets these keywords in the following manner: required; this indicates that the success of the module is required for the module-type facility to succeed. Failure of this module will not be apparent to the user until all of the remaining modules (of the same module-type) have been executed.

requisite; like required, however, in the case that such a module returns a failure, control is directly returned to the application. The return value is that associated with the first required or requisite module to fail. Note, this flag can be used to protect against the possibility of a user getting the opportunity to enter a password over an unsafe medium. It is conceivable that such behavior might inform an attacker of valid accounts on a system. This possibility should be weighed against the not insignificant concerns of exposing a sensitive password in a hostile environment.

sufficient; the success of this module is deemed `sufficient' to satisfy the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no previous required module has failed, no more `stacked' modules of this type are invoked. (Note, in this case subsequent required modules are not invoked.). A failure of this module is not deemed as fatal to satisfying the application that this module-type has succeeded.

Optional; as its name suggests, this control-flag marks the module as not being critical to the success or failure of the user's application for service. In general, Linux-PAM ignores such a module when determining if the module stack will succeed or fail. However, in the absence of any definite successes or failures of previous or subsequent stacked modules this module will determine the nature of the response to the application. One example of this latter case, is when the other modules return something like PAM_IGNORE. PAM authentication Control-flag : The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control over how the user is authenticated. This form of the control flag is delimited with square brackets and consists of a series of value=action tokens: [value1=action1 value2=action2 ...] Here, valueI is one of the following return values: success; open_err; symbol_err; service_err; system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries; new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err; authtok_err; authtok_recover_err; authtok_lock_busy; authtok_disable_aging; try_again; ignore; abort; authtok_expired; module_unknown; bad_item; and default. The last of these (default) can be used to set the action for those return values that are not explicitly defined. The actionI can be a positive integer or one of the following tokens: ignore; ok; done; bad; die; and reset. A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated stack of modules with a number of different paths of execution. Which path is taken can be determined by the reactions of individual modules. PAM authentication

ignore - when used with a stack of modules, the module's return status will not contribute to the return code the application obtains.

bad - this action indicates that the return code should be thought of as indicative of the module failing. If this module is the first in the stack to fail, its status value will be used for that of the whole stack.

die - equivalent to bad with the side effect of terminating the module stack and PAM immediately returning to the application.

ok - this tells PAM that the administrator thinks this return code should contribute directly to the return code of the full stack of modules. In other words, if the former state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override this value. Note, if the former state of the stack holds some value that is indicative of a modules failure, this 'ok' value will not be used to override that value.

done - equivalent to ok with the side effect of terminating the module stack and PAM immediately returning to the application.

reset - clear all memory of the state of the module stack and start again with the next stacked module. PAM authentication Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in terms of the [...] syntax. They are as follows:

required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad]

requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die]

sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore]

optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore]

Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63, the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support machine-machine authentication using the transport protocol inherent to the client/server application. With the ``[ ... value=action ... ]'' control syntax, it is possible for an application to be configured to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication mode for older, legacy, applications. PAM authentication Module-path The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended to the default module path: /lib/security

Args The args are a list of tokens that are passed to the module when it is invoked. Much like arguments to a typical Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments are ignored by a module, however, when encountering an invalid argument, the module is required to write an error to syslog(3). For a list of generic options see the next section.

Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the side of caution) to make the authentication process fail. A corresponding error is written to the system log files with a call to syslog(3). PAM authentication Directory based configuration More flexible than the single configuration file, as of version 0.56, it is possible to configure libpam via the contents of the /etc/pam.d/ directory. In this case the directory is filled with files each of which has a filename equal to a service-name (in lower-case): it is the personal configuration file for the named service. Linux-PAM can be compiled in one of two modes. The preferred mode uses either /etc/pam.d/ or /etc/pam.conf configuration but not both. That is to say, if there is a /etc/pam.d/ directory then libpam only uses the files contained in this directory. However, in the absence of the /etc/pam.d/ directory the /etc/pam.conf file is used (this is likely to be the mode your preferred distribution uses). The other mode is to use both /etc/pam.d/ and /etc/pam.conf in sequence. In this mode, entries in /etc/pam.d/ override those of /etc/pam.conf. The syntax of each file in /etc/pam.d/ is similar to that of the /etc/pam.conf file and is made up of lines of the following form: module-type  control-flag   module-path   arguments The only difference being that the service-name is not present. The service-name is of course the name of the given configuration file. For example, /etc/pam.d/login contains the configuration for the login service. PAM authentication This method of configuration has a number of advantages over the single file approach. We list them here to assist the reader in deciding which scheme to adopt: A lower chance of misconfiguring an application. There is one less field to mis-type when editing the configuration files by hand. Easier to maintain. One application may be reconfigured without risk of interfering with other applications on the system. It is possible to symbolically link different services configuration files to a single file. This makes it easier to keep the system policy for access consistent across different applications. (It should be noted, to conserve space, it is equally possible to hard link a number of configuration files. However, care should be taken when administering this arrangement as editing a hard linked file is likely to break the link.) A potential for quicker configuration file parsing. Only the relevant entries are parsed when a service gets bound to its modules. It is possible to limit read access to individual Linux-PAM configuration files using the file protections of the filesystem. Package management becomes simpler. Every time a new application is installed, it can be accompanied by an /etc/pam.d/xxxxxx file. PAM authentication The following are optional arguments which are likely to be understood by any module. Arguments (including these) are in general optional. Debug : Use the syslog(3) call to log debugging information to the system log files. no_warn : Instruct module to not give warning messages to the application. use_first_pass : The module should not prompt the user for a password. Instead, it should obtain the previously typed password (from the preceding auth module), and use that. If that doesn't work, then the user will not be authenticated. (This option is intended for auth and password modules only). try_first_pass : The module should attempt authentication with the previously typed password (from the preceding auth module). If that doesn't work, then the user is prompted for a password. (This option is intended for auth modules only). use_mapped_pass : This argument is not currently supported by any of the modules in the Linux-PAM distribution because of possible consequences associated with U.S. encryption exporting restrictions. Within the U.S., module developers are, of course, free to implement it (as are developers in other countries). expose_account : In general the leakage of some information about user accounts is not a secure policy for modules to adopt. Sometimes information such as users names or home directories, or preferred shell, can be used to attack a user's account. In some circumstances, however, this sort of information is not deemed a threat: displaying a user's full name when asking them for a password in a secured environment could also be called being 'friendly'. The expose_account argument is a standard module argument to encourage a module to be less discrete about account information as it is deemed appropriate by the local administrator. PAM authentication Example configuration file entries Default policy : If a system is to be considered secure, it had better have a reasonably secure `OTHER' entry. The following is a paranoid setting (which is not a bad place to start!): OTHER  auth     required       pam_deny.so OTHER   account  required       pam_deny.so OTHER   password required       pam_deny.so OTHER   session  required       pam_deny.so
 * 1) default; deny access
 * 1) default; deny access

Whilst fundamentally a secure default, this is not very sympathetic to a misconfigured system. For example, such a system is vulnerable to locking everyone out should the rest of the file become badly written. The module pam_deny is not very sophisticated. For example, it logs no information when it is invoked so unless the users of a system contact the administrator when failing to execute a service application, the administrator may go for a long while in ignorance of the fact that his system is misconfigured. PAM authentication The addition of the following line before those in the above example would provide a suitable warning to the administrator. OTHER  auth     required       pam_warn.so OTHER   password required       pam_warn.so
 * 1) default; wake up! This application is not configured
 * 1) default; wake up! This application is not configured

Having two ``OTHER auth'' lines is an example of stacking. On a system that uses the /etc/pam.d/ configuration, the corresponding default setup would be achieved with the following file: auth    required       pam_warn.so auth     required       pam_deny.so account  required       pam_deny.so password required       pam_warn.so password required       pam_deny.so session  required       pam_deny.so PAM authentication On a less sensitive computer, one on which the system administrator wishes to remain ignorant of much of the power of Linux-PAM, the following selection of lines (in /etc/pam.conf) is likely to mimic the historically familiar Linux setup.
 * 1) default configuration: /etc/pam.d/other
 * 1) default configuration: /etc/pam.d/other

OTHER  auth     required       pam_unix.so OTHER   account  required       pam_unix.so OTHER   password required       pam_unix.so OTHER   session  required       pam_unix.so
 * 1) default; standard UN*X access
 * 1) default; standard UN*X access

PAM authentication Key terms, files and utilities : /etc/pam.d /etc/pam.conf /lib/libpam.so.*