freebsd-nq/etc/pam.d/sshd

#
# $FreeBSD$
#
# PAM configuration for the "sshd" service
#

# auth
auth		required	pam_nologin.so	no_warn
auth		sufficient	pam_opie.so	no_warn no_fake_prompts
auth		required	pam_opieaccess.so	no_warn
#auth		sufficient	pam_krb5.so	no_warn try_first_pass
auth		required	pam_unix.so	no_warn try_first_pass

# account
account		required	pam_login_access.so
#account		required	pam_krb5.so
account		required	pam_unix.so

# session
session		required	pam_permit.so

# password
password	required	pam_permit.so
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 21:06:21 +00:00			`#`
			`# $FreeBSD$`
			`#`
			`# PAM configuration for the "sshd" service`
			`#`

			`# auth`
Awright, egg on my face. I should have taken more time with this. The conversion script generated the wrong format, so the configuration files didn't actually work. Good thing I hadn't thrown the switch yet... Sponsored by: DARPA, NAI Labs (but the f***ups are all mine) 2001-12-05 21:26:00 +00:00			`auth required pam_nologin.so no_warn`
Enable OPIE for sshd and telnetd. I thought I'd done this a long time ago... Sponsored by: DARPA, NAI Labs 2002-06-19 20:00:43 +00:00			`auth sufficient pam_opie.so no_warn no_fake_prompts`
			`auth required pam_opieaccess.so no_warn`
Don't enable pam_krb5 by default - most people don't have it since most people don't build with MAKE_KERBEROS5 defined. Provide commented-out usage examples instead, like we do everywhere else. Pointy hat to: des 2003-02-03 14:45:02 +00:00			`#auth sufficient pam_krb5.so no_warn try_first_pass`
Awright, egg on my face. I should have taken more time with this. The conversion script generated the wrong format, so the configuration files didn't actually work. Good thing I hadn't thrown the switch yet... Sponsored by: DARPA, NAI Labs (but the f***ups are all mine) 2001-12-05 21:26:00 +00:00			`auth required pam_unix.so no_warn try_first_pass`
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 21:06:21 +00:00
			`# account`
Switch over to using pam_login_access(8) module in sshd(8). (Fixes static compilation. Reduces diffs to OpenSSH.) Reviewed by: bde 2002-03-26 12:52:28 +00:00			`account required pam_login_access.so`
Don't enable pam_krb5 by default - most people don't have it since most people don't build with MAKE_KERBEROS5 defined. Provide commented-out usage examples instead, like we do everywhere else. Pointy hat to: des 2003-02-03 14:45:02 +00:00			`#account required pam_krb5.so`
Awright, egg on my face. I should have taken more time with this. The conversion script generated the wrong format, so the configuration files didn't actually work. Good thing I hadn't thrown the switch yet... Sponsored by: DARPA, NAI Labs (but the f***ups are all mine) 2001-12-05 21:26:00 +00:00			`account required pam_unix.so`
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 21:06:21 +00:00
			`# session`
Since OpenSSH drops privileges before calling pam_open_session(3), pam_lastlog(8) can't possibly work, so let OpenSSH handle lastlog. Approved by: re (rwatson) 2002-12-03 15:48:11 +00:00			`session required pam_permit.so`
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 21:06:21 +00:00
			`# password`
Awright, egg on my face. I should have taken more time with this. The conversion script generated the wrong format, so the configuration files didn't actually work. Good thing I hadn't thrown the switch yet... Sponsored by: DARPA, NAI Labs (but the f***ups are all mine) 2001-12-05 21:26:00 +00:00			`password required pam_permit.so`