pam_krb5 - Kerberos 5 authentication


SYNOPSIS

       auth required /lib/security/pam_krb5.so
       session optional /lib/security/pam_krb5.so


DESCRIPTION

       pam_krb5.so  is  designed  to  allow smooth integration of
       Kerberos 5  password-  checking  with  applications  built
       using PAM.  It also supports session-specific ticket files
       (which are neater) and Kerberos IV ticket  file  grabbing.
       Its  main  use is as an authentication module, but it also
       supplies the same functions as a session-management module
       to  better support poorly-written applications, and a cou­
       ple of other workarounds as well.

       When a user logs in, the module's authentication  function
       performs a simple password check and, if possible, obtains
       Kerberos 5 and Kerberos IV credentials, caching  them  for
       later  use.   When the application requests initialization
       of credentials (or opens  a  session),  the  usual  ticket
       files  are  created.   When  the  application subsequently
       requests deletion of credentials or closing  of  the  ses­
       sion, the module deletes the ticket files.

       Some  applications (notably, wu-ftpd, wu-imapd, and Samba)
       neither create credentials nor open sessions.   For  these
       applications,  it's best to use the tokens option to force
       token-grabbing during the password check, which is usually
       the right thing to do for these server apps.


ARGUMENTS

       debug  turns  on  debugging via syslog(3).  Debugging mes­
              sages are logged with priority LOG_DEBUG.

       addressless
              tells pam_krb5.so  to  obtain  credentials  without
              address  lists.  This may be necessary if your net­
              work uses NAT, and should otherwise not be used.

       hosts=host
              tells pam_krb5.so to obtain credentials  using  the
              address  of  the  given  host  in  addition  to the
              addresses of interfaces on the  local  workstation.
              For  example,  if your workstation is behind a mas­
              querading firewall, specifying the firewall's  out­
              ward-facing  address  here  should  allow  Kerberos
              authentication to succeed.

       banner=Kerberos
            tells pam_krb5.so how to identify itself  when  users
            attempt to change their passwords.

            tells  pam_krb5.so which directory to use for storing
            credential caches.

       forwardable
            tells pam_krb5.so that credentials it obtains  should
            be forwardable.

       keytab=/etc/krb5.keytab
            tells  pam_krb5.so  the  location  of a keytab to use
            when validating credentials obtained from KDCs.

       krb4_convert
            tells pam_krb5.so to obtain Kerberos  IV  credentials
            for users, in addition to Kerberos 5 credentials.

       minimum_uid=0
            tells  pam_krb5.so  to ignore authentication attempts
            by users with UIDs below the specified number.

       no_user_check
            tells pam_krb5.so to not check if a  user  exists  on
            the local system, and to create ccache files owned by
            the current process's UID.  This is useful for situa­
            tions  where a non-privileged server process needs to
            use Kerberized services on behalf of remote users who
            may  not  have local access.  Note that such a server
            should have an encrypted connection with  its  client
            in  order to avoid allowing the user's password to be
            eavesdropped.

       proxiable
            tells pam_krb5.so that credentials it obtains  should
            be proxiable.

       realm=realm
            overrides  the  default  realm set in /etc/krb5.conf,
            which pam_krb5.so will attempt to authenticate  users
            to.

       renew_lifetime=36000
            sets  the default renewable lifetime for credentials.

       skip_first_pass
            tells pam_krb5.so to not bother checking  a  password
            that  has  been set by a module listed earlier in the
            stack.  This option is included mainly for  complete­
            ness.

       ticket_lifetime=36000
            sets the default lifetime for credentials.

       try_first_pass
            tells  pam_krb5.so  to  check  the  password  as with

            one  if the previously-entered one fails. This is the
            default mode of operation.

       use_first_pass
            tells pam_krb5.so to get the user's entered  password
            as  it  was  stored by a module listed earlier in the
            stack,  usually  pam_unix  or  pam_pwdb,  instead  of
            prompting the user for it.

       use_authtok
            tells  pam_krb5.so to never prompt for passwords when
            changing passwords.  This is useful if you are  using
            pam_cracklib.so  to  try to enforce use of less-easy-
            to-guess passwords.

       validate
            tells pam_krb5.so to verify  that  the  TGT  obtained
            from the realm's servers has not been spoofed.


FILES

       /etc/krb5.conf


SEE ALSO

       pam_krb5(5)


BUGS

       Probably,  but  let's  hope  not.  If you find any, please
       email the author.


AUTHOR

       Nalin Dahyabhai <nalin@redhat.com>


Man(1) output converted with man2html