src/pam/pam_afs.5

   1 .TH pam_afs 5 "5 August 2002"
   2
   3 .SH NAME
   4 pam_afs, pam_afs.so \- pluggable authentication modules for OpenAFS
   5
   6 .SH SYNOPSIS
   7 .B pam_afs.so.1, pam_afs.krb.so.1
   8
   9 .SH DESCRIPTION
  10 The OpenAFS pluggable authentication module provides module support
  11 for authentication, session management, and password management, which
  12 coorespond to the auth, session, and  password directives in a PAM
  13 configuration file, respectively.
  14
  15 The
  16 .B pam_afs.krb.so
  17 module additionally keeps users' Kerberos 4 TGT available for users
  18 to use in other applications.  The
  19 .B pam_afs.so
  20 module does not do this.
  21
  22 The
  23 .B pam_afs.krb.so
  24 module has nothing to do with Kerberos 5 authentication.  Users
  25 with a Kerberos 5 integrated AFS environment should not use
  26 either of these modules, but instead use
  27 .B pam_krb5.so
  28 directly.
  29
  30 .SH OPTIONS
  31 The following arguments are supported.  In parenthesis next to
  32 each option are the environments in which it works.
  33
  34 .IP "cell cell_name"
  35 (auth) Specify a
  36 .I cell_name
  37 to authenticate to other than the local cell.
  38 .IP debug
  39 (all) Provide extra debugging information to syslog.
  40 .IP dont_fork
  41 (auth) Do not use a fork() when authenticating.  Forking is a good idea,
  42 because sockets and memory used by the authentication function get
  43 cleaned up automatically.  This option should only be used if a
  44 PAM application fails when a fork() is issued.  This option cannot
  45 be used with
  46 .B use_klog.
  47 .IP ignore_root
  48 (auth, password) If user root is authenticating, simply return PAM_SUCCESS without
  49 any AFS authentication attempt.  Presumably, authentication would fall through
  50 to a secondary mechanism.
  51 .IP "ignore_uid uid"
  52 (auth) Similar to ignore_root but it allows you to specify a
  53 .I uid
  54 such that any user authenticating with uid less than or equal to
  55 .I uid
  56 will not have AFS authentication performed.
  57 .IP no_unlog
  58 (session) Does not destroy a token during logout.  This is useful if
  59 users have background jobs still running under their PAG that
  60 need access to AFS after they log out.
  61 .IP nowarn
  62 (auth, password) Prevents warning from being written to syslog.
  63 .IP refresh_token
  64 (auth) Obtains a token without first obtaining a PAG.  This is useful for
  65 screensavers to update the lifetime of a user's token.
  66 .IP remain
  67 (session) Causes AFS tokens to remain for 5 minutes after logout.
  68 .IP "remainlifetime lifetime"
  69 (session) Specify, in seconds, how long tokens should remain after
  70 logout.
  71 .IP set_token
  72 (auth) If set_token is specified, the token obtained in the authentication
  73 phase is not destroyed.  Ordinarily, tokens are obtained in the
  74 setcred() phase of authentication.  For PAM applications which do not
  75 call setcred(), the
  76 .B set_token
  77 directive should be used.
  78 .IP setenv_password_expires
  79 (auth) Sets the PASSWORD_EXPIRES environment variable to the time when your
  80 AFS token will expire.
  81 .IP try_first_pass
  82 (auth, password) This will first try a password entered to a previous module and if it
  83 fails, prompt for the user's AFS password.
  84 If
  85 .B pam_afs.so
  86 is the first module called, it will generate a failed login attempt
  87 with a NULL password for every user logging in.
  88 .IP use_first_pass
  89 (auth, password) This option is similar to
  90 .B try_first_pass
  91 except that it will not prompt for the user's AFS password if the first
  92 password fails.  If this option is specified and
  93 .B pam_afs.so
  94 is the first module listed in the PAM configuration, authentication
  95 will fail.
  96 .IP use_klog
  97 (auth) This directs
  98 .B pam_afs.so
  99 to exec klog for authentication instead of calling the authentication
 100 functions in the AFS libraries directly.
 101
 102 .SH FILES
 103 .I /etc/pam.conf
 104 .RS
 105 This is the PAM configuration file on Solaris systems.
 106 .RE
 107
 108 .I /etc/pam.d/*
 109 .RS
 110 These are the PAM configuration files on Linux systems.
 111 .RE
 112
 113 .I /etc/pam.d/system-auth
 114 .RS
 115 This file controls all system authentication on many
 116 Linux distributions.
 117 .RE
 118 .SH EXAMPLE
 119
 120 Standard
 121 .I auth
 122 settings for
 123 .I /etc/pam.d/system-auth
 124 on Linux using OpenAFS:
 125 .RS
 126 auth required /lib/security/pam_env.so
 127 .br
 128 auth sufficient /lib/security/pam_afs.so.1 \\
 129 .br
 130      setenv_password_expires ignore_root
 131 .br
 132 auth sufficient /lib/security/pam_unix.so likeauth \\
 133 .br
 134      nullok try_first_pass
 135 .br
 136 auth required /lib/security/pam_deny.so
 137 .RE
 138
 139 Suggested settings for
 140 .I auth
 141 in
 142 .I /etc/pam.d/xscreensaver
 143 .RS
 144 auth sufficient /lib/security/pam_afs.so.1 \\
 145 .br
 146      refresh_token ignore_root
 147 .br
 148 auth required /lib/security/pam_stack.so \\
 149 .br
 150      service=system-auth
 151 .RE
 152
 153 .SH AUTHOR
 154 Charles Clancy <tcc@xauth.net>
 155 .SH "SEE ALSO"
 156 .BR klog (1),
 157 .BR klog.krb (1),
 158 .BR pagsh (1)