6a56450bfb
compiled in. This involves a commented out sshd line to match the remainder of the commented out pam_kerberosIV.so entries. This doesn't quite restore the correct behavior, as ticket files are not managed properly, but it's an improvement. Forgotten by: green
50 lines
1.9 KiB
Plaintext
50 lines
1.9 KiB
Plaintext
# Configuration file for Pluggable Authentication Modules (PAM).
|
|
#
|
|
# This file controls the authentication methods that login and other
|
|
# utilities use. See pam(8) for a description of its format.
|
|
#
|
|
# Note: the final entry must say "required" -- otherwise, things don't
|
|
# work quite right. If you delete the final entry, be sure to change
|
|
# "sufficient" to "required" in the entry before it.
|
|
#
|
|
# $FreeBSD$
|
|
|
|
# If the user can authenticate with S/Key, that's sufficient; allow clear
|
|
# password. Try kerberos, then try plain unix password.
|
|
login auth sufficient pam_skey.so
|
|
login auth requisite pam_cleartext_pass_ok.so
|
|
#login auth sufficient pam_kerberosIV.so try_first_pass
|
|
login auth required pam_unix.so try_first_pass
|
|
|
|
# Same requirement for ftpd as login
|
|
ftpd auth sufficient pam_skey.so
|
|
ftpd auth requisite pam_cleartext_pass_ok.so
|
|
#ftpd auth sufficient pam_kerberosIV.so try_first_pass
|
|
ftpd auth required pam_unix.so try_first_pass
|
|
|
|
# OpenSSH with PAM support requires similar modules. The session one is
|
|
# a bit strange, though...
|
|
sshd auth sufficient pam_skey.so
|
|
#sshd auth sufficient pam_kerberosIV.so try_first_pass
|
|
sshd auth required pam_unix.so try_first_pass
|
|
sshd session required pam_permit.so
|
|
|
|
# Don't break startx
|
|
xserver auth required pam_permit.so
|
|
|
|
# XDM is difficult; it fails or moans unless there are modules for each
|
|
# of the four management groups; auth, account, session and password.
|
|
xdm auth required pam_unix.so
|
|
#xdm auth sufficient pam_kerberosIV.so try_first_pass
|
|
xdm account required pam_unix.so try_first_pass
|
|
xdm session required pam_deny.so
|
|
xdm password required pam_deny.so
|
|
|
|
# Mail services
|
|
imap auth required pam_unix.so try_first_pass
|
|
pop3 auth required pam_unix.so try_first_pass
|
|
|
|
# If we don't match anything else, default to using getpwnam().
|
|
other auth required pam_unix.so try_first_pass
|
|
other account required pam_unix.so try_first_pass
|