pam_krb5afs - Kerberos 5 authentication with AFS support


SYNOPSIS

       auth required /lib/security/pam_krb5afs.so
       session optional /lib/security/pam_krb5afs.so


DESCRIPTION

       pam_krb5afs.so  is designed to allow smooth integration of
       Kerberos 5  password-  checking  with  applications  built
       using PAM.  It also supports session-specific ticket files
       (which are neater), Kerberos IV ticket file grabbing,  and
       AFS  token-grabbing.  Its main use is as an authentication
       module, but it also supplies the same functions as a  ses­
       sion-management  module  to  better support poorly-written
       applications, and a couple of other workarounds as well.

       When a user logs in, the module's authentication  function
       performs a simple password check and, if possible, obtains
       Kerberos 5 and Kerberos IV credentials, caching  them  for
       later  use.   When the application requests initialization
       of credentials (or opens  a  session),  the  usual  ticket
       files  are  created and AFS tokens are obtained.  When the
       application subsequently requests deletion of  credentials
       or  closing of the session, the module destroys the tokens
       for the current PAG and deletes the ticket files.

       Some applications (notably, wu-ftpd, wu-imapd, and  Samba)
       neither  create  credentials nor open sessions.  For these
       applications, it's best to use the tokens option to  force
       token-grabbing during the password check, which is usually
       the right thing to do for these server apps.


ARGUMENTS

       debug  turns on debugging via syslog(3).   Debugging  mes­
              sages are logged with priority LOG_DEBUG.

       addressless
              tells  pam_krb5afs.so to obtain credentials without
              address lists.  This may be necessary if your  net­
              work uses NAT, and should otherwise not be used.

       hosts=host
              tells  pam_krb5afs.so  to  obtain credentials using
              the address of the given host in  addition  to  the
              addresses  of  interfaces on the local workstation.
              For example, if your workstation is behind  a  mas­
              querading  firewall, specifying the firewall's out­
              ward-facing  address  here  should  allow  Kerberos
              authentication to succeed.

       afs_cells=cell
              tells  pam_krb5afs.so to obtain tokens for users in


       banner=Kerberos
            tells pam_krb5afs.so  how  to  identify  itself  when
            users attempt to change their passwords.

       ccache_dir=/tmp
            tells pam_krb5afs.so which directory to use for stor­
            ing credential caches.

       forwardable
            tells  pam_krb5afs.so  that  credentials  it  obtains
            should be forwardable.

       keytab=/etc/krb5.keytab
            tells  pam_krb5afs.so the location of a keytab to use
            when validating credentials obtained from KDCs.

       krb4_convert
            tells pam_krb5afs.so to obtain  Kerberos  IV  creden­
            tials  for  users,  in addition to Kerberos 5 creden­
            tials.

       minimum_uid=0
            tells   pam_krb5afs.so   to   ignore   authentication
            attempts  by users with UIDs below the specified num­
            ber.

       no_user_check
            tells pam_krb5afs.so to not check if a user exists on
            the local system, and to create ccache files owned by
            the current process's UID.  This is useful for situa­
            tions  where a non-privileged server process needs to
            use Kerberized services on behalf of remote users who
            may  not  have local access.  Note that such a server
            should have an encrypted connection with  its  client
            in  order to avoid allowing the user's password to be
            eavesdropped.

       proxiable
            tells  pam_krb5afs.so  that  credentials  it  obtains
            should be proxiable.

       realm=realm
            overrides  the  default  realm set in /etc/krb5.conf,
            which pam_krb5afs.so  will  attempt  to  authenticate
            users to.

       renew_lifetime=36000
            sets  the default renewable lifetime for credentials.

       skip_first_pass
            tells pam_krb5afs.so to not bother checking  a  pass­
            word  that has been set by a module listed earlier in

            pleteness.

       ticket_lifetime=36000
            sets the default lifetime for credentials.

       tokens
            tells  pam_krb5afs.so  to get AFS tokens for the user
            immediately if the password check succeeds.  This  is
            necessary  for some programs that never open sessions
            or attempt to initialize credentials  (PAM's  creden­
            tials,  not  Kerberos's).   If  you have a server app
            that requires access to the user's  file  space,  you
            might need this.

       try_first_pass
            tells  pam_krb5afs.so  to  check the password as with
            use_first_pass, but to prompt the  user  for  another
            one  if the previously-entered one fails. This is the
            default mode of operation.

       use_first_pass
            tells pam_krb5afs.so to get the user's entered  pass­
            word  as  it was stored by a module listed earlier in
            the stack, usually pam_unix or pam_pwdb,  instead  of
            prompting the user for it.

       use_authtok
            tells  pam_krb5afs.so  to  never prompt for passwords
            when changing passwords.  This is useful if  you  are
            using  pam_cracklib.so to try to enforce use of less-
            easy-to-guess passwords.

       validate
            tells pam_krb5afs.so to verify that the TGT  obtained
            from the realm's servers has not been spoofed.


FILES

       /etc/krb5.conf


SEE ALSO

       pam_krb5afs(5)


BUGS

       Probably,  but  let's  hope  not.  If you find any, please
       email the author.


AUTHOR

       Nalin Dahyabhai <nalin@redhat.com>


Man(1) output converted with man2html