1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
|
.\" iucvtty.8
.\"
.\"
.\" Copyright IBM Corp. 2008, 2017
.\" s390-tools is free software; you can redistribute it and/or modify
.\" it under the terms of the MIT license. See LICENSE for details.
.\" ----------------------------------------------------------------------
.TH iucvtty "8" "March 2009" "s390-tools" "IUCV terminal applications"
.
.ds t \fBiucvtty\fP
.ds i \fBiucvconn\fP
.
.
.
.SH NAME
iucvtty \- allow remote logins over z/VM IUCV
.
.
.
.SH SYNOPSIS
.B iucvtty
.RB [ \-h | \-\-help ]
.br
.B iucvtty
.RB [ \-v | \-\-version ]
.br
.B iucvtty
.RB [ \-a | \-\-allow-from
.IR regex ]
.IR terminal_id
.RB [\-\-
.IR login_program " [" login_options ]]
.
.
.
.SH DESCRIPTION
The \*t application provides full-screen terminal access to a Linux instance
running as a z/VM guest operating system.
The \*i application is used to connect to a running \*t instance.
The terminal connection is based on the z/VM Inter-User Communication Vehicle
(IUCV). z/VM IUCV establishes a communication path between two z/VM guest
virtual machines on the same z/VM instance.
Because z/VM IUCV is independent from TCP/IP, Linux instances with no external
network can be accessed.
\fIterminal_id\fP identifies the z/VM IUCV connection and is similar to a port
number in TCP/IP communications. \fIterminal_id\fP is case-sensitive and
consists of up to 8 alphanumeric characters.
It must be specified as a parameter in connection requests against
a \*t instance.
When a connection is established, \*t starts a login program.
When the login program ends, \*t also exits. Consider an
.BR inittab (5)
entry
.\"or an upstart job file
to ensure that \*t is restarted and ready for the next terminal session.
.
.
.
.SH OPTIONS
.TP
.BR \-\^h ", " \-\^\-help
Display a short help text and exit.
.
.TP
.BR \-\^v ", " \-\^\-version
Display the version number of \*t, then exit.
.
.TP
.BR \-\^a ", " \-\^\-allow-from " " \fIregex\fP
Limit permissions for incoming connections to z/VM user IDs that match
the regular expression \fIregex\fP. The connection is refused if the ID
does not match. If this parameter is omitted, connections are permitted
from any z/VM user ID.
.
.TP
.I login_program
\fIlogin_program\fP specifies the absolute path to the login program to be
started when a connection is established.
The default is
.BR /bin/login (1).
.br
The \fIlogin_program\fP must be separated by two dashes (--).
.
.TP
.I login_options
Depending on the particular login program used, \fIlogin_options\fP specifies
additional options.
.
.
.
.SH EXAMPLES
To allow remote logins using the terminal identifier "lnxterm":
.PP
.ft CW
.in +0.25in
.nf
iucvtty lnxterm
.fi
.in -0.25in
.ft
To only allow users from LNXSYS01 to connect to terminal "lnxterm":
.PP
.ft CW
.in +0.25in
.nf
iucvtty -a LNXSYS01 lnxterm
.fi
.in -0.25in
.ft
To only allow users from LNXSYS10 through LNXSYS19 to connect to terminal
"lnxterm":
.PP
.ft CW
.in +0.25in
.nf
iucvtty -a "LNXSYS1[0-9]" lnxterm
.fi
.in -0.25in
.ft
To use \fB/sbin/sulogin\fP instead of \fB/bin/login\fP for terminal "suterm":
.PP
.ft CW
.in +0.25in
.nf
iucvtty suterm -- /sbin/sulogin
.fi
.in -0.25in
.ft
An entry in \fB/etc/inittab\fP to facilitate user logins on terminal "lnxterm"
with \fB/bin/login\fP could be:
.PP
.ft CW
.in +0.25in
.nf
t1:2345:respawn:/sbin/iucvtty lnxterm
.fi
.in -0.25in
.ft
An entry in \fB/etc/inittab\fP to facilitate user logins on terminal "suterm"
with \fB/sbin/sulogin\fP in single user mode could be:
.PP
.ft CW
.in +0.25in
.nf
s1:S:respawn:/sbin/iucvtty suterm -- /sbin/sulogin
.fi
.in -0.25in
.ft
.
.
.
.SH DIAGNOSTICS
If the Linux kernel does not include kernel support for the AF_IUCV network
addressing family, \*t exits and displays the message
.I 'AF_IUCV address family is not available: Address family not supported by
.IR protocol' "."
.
.
.
.SH SECURITY
.SS Linux
The \*t program can be used by regular users.
Depending on the particular login program, \*t must be started with superuser
privileges for user authentication and authorization. For instance,
\fB/bin/login\fP requires superuser privileges and, thus, regular users
must use a different login program.
Each connection attempt is logged to the \fBauthpriv\fP syslog facility.
\*t uses pseudo-terminal (pts) devices to communicate with the
login program. For security reasons, some login programs, like
\fB/bin/login\fP, do not permit root logins on pseudo-terminal devices (see also
.BR /etc/securetty "(5))."
To permit root logins, consider using HVC terminal devices that are provided by
the z/VM IUCV hypervisor console (HVC) device driver.
.\"Enabling root logins on pseudo-terminal devices can compromise system security.
.\"To avoid this potential security exposure, consider using HVC terminal devices
.\"that are provided by the z/VM IUCV hypervisor console (HVC) device driver.
.
.
.
.SS z/VM guest virtual machine
See the
.BR af_iucv (7)
manual page for details about IUCV authorizations.
.
.
.
.SH "SEE ALSO"
.BR iucvconn (1),
.BR login (1),
.BR pts (4),
.BR regex (7),
.BR securetty (5),
.BR af_iucv (7),
.BR hvc_iucv (9)
|
