Convert to mdoc(7).
This commit is contained in:
Chris Costello
parent
50ed42ac07
commit
8b136a6dde
@ -1,71 +1,71 @@
|
||||
.\"
|
||||
.\" $Id: pam_krb5.5,v 1.5 2000/01/05 00:59:56 fcusack Exp $
|
||||
.\" $FreeBSD$
|
||||
.TH pam_krb5 8 "15 Jan 1999"
|
||||
.SH NAME
|
||||
pam_krb5 \- Kerberos 5 PAM module
|
||||
.SH SYNOPSIS
|
||||
.LP
|
||||
.B /usr/lib/pam_krb5.so
|
||||
.LP
|
||||
.SH DESCRIPTION
|
||||
.IX "pam_krb5" "" "\fLpam_krb5\fP \(em Kerberos 5 PAM module"
|
||||
.PP
|
||||
.Dd January 15, 1999
|
||||
.Dt pam_krb5 8
|
||||
.Os FreeBSD
|
||||
.Sh NAME
|
||||
.Nm pam_krb5
|
||||
.Nd Kerberos 5 PAM module
|
||||
.Sh SYNOPSIS
|
||||
.Pa /usr/lib/pam_krb5.so
|
||||
.Sh DESCRIPTION
|
||||
The Kerberos 5 service module for PAM, typically
|
||||
.BR /usr/lib/pam_krb5.so ,
|
||||
.Pa /usr/lib/pam_krb5.so ,
|
||||
provides functionality for three PAM categories:
|
||||
authentication,
|
||||
account management,
|
||||
and password management.
|
||||
It also provides null functions for session management.
|
||||
The
|
||||
.B pam_krb5.so
|
||||
.Pa pam_krb5.so
|
||||
module is a shared object
|
||||
that can be dynamically loaded to provide
|
||||
the necessary functionality upon demand.
|
||||
Its path is specified in the
|
||||
.SM PAM
|
||||
configuration file.
|
||||
.SH Kerberos 5 Authentication Module
|
||||
PAM configuration file.
|
||||
.Ss Kerberos 5 Authentication Module
|
||||
The Kerberos 5 authentication component
|
||||
provides functions to verify the identity of a user.
|
||||
(\f3pam_sm_authenticate(\|)\f1)
|
||||
provides functions to verify the identity of a user
|
||||
.Pq Fn pam_sm_authenticate
|
||||
and to set user specific credentials
|
||||
(\f3pam_sm_setcred(\|)\f1).
|
||||
.B pam_sm_authenticate(\|)
|
||||
.Pq Fn pam_sm_setcred .
|
||||
.Fn pam_sm_authenticate
|
||||
converts the supplied username into a Kerberos principal,
|
||||
by appending the default local realm name.
|
||||
It also supports usernames with explicit realm names.
|
||||
If a realm name is supplied, then upon a sucessful return, it
|
||||
changes the username by mapping the principal name into a local username
|
||||
(calling \f3krb5_aname_to_localname()\f1). This typically just means
|
||||
(calling
|
||||
.Fn krb5_aname_to_localname Ns ).
|
||||
This typically just means
|
||||
the realm name is stripped.
|
||||
.LP
|
||||
.Pp
|
||||
It prompts the user for a password and obtains a new Kerberos TGT for
|
||||
the principal. The TGT is verified by obtaining a service
|
||||
ticket for the local host.
|
||||
.LP
|
||||
.Pp
|
||||
When prompting for the current password, the authentication
|
||||
module will use the prompt "Password for <principal>: ".
|
||||
.LP
|
||||
module will use the prompt
|
||||
.Dq Password for <principal>: .
|
||||
.Pp
|
||||
The
|
||||
.B pam_sm_setcred(\|)
|
||||
.Fn pam_sm_setcred
|
||||
function stores the newly acquired credentials in a credentials cache,
|
||||
and sets the environment variable
|
||||
.B KRB5CCNAME
|
||||
.Ev KRB5CCNAME
|
||||
appropriately.
|
||||
The credentials cache should be destroyed by the user at logout with
|
||||
.BR kdestroy (1) .
|
||||
.LP
|
||||
.Xr kdestroy 1 .
|
||||
.Pp
|
||||
The following options may be passed to the authentication module:
|
||||
.TP 15
|
||||
.B debug
|
||||
.BR syslog (3)
|
||||
.Bl -tag -width 15n
|
||||
.It Li debug
|
||||
.Xr syslog 3
|
||||
debugging information at
|
||||
.SB LOG_DEBUG
|
||||
.Dv LOG_DEBUG
|
||||
level.
|
||||
.TP
|
||||
.B use_first_pass
|
||||
.It Li use_first_pass
|
||||
If the authentication module is not the first in the stack,
|
||||
and a previous module obtained the user's password, that password is
|
||||
used to authenticate the user. If this fails, the authentication
|
||||
@ -73,45 +73,43 @@ module returns failure without prompting the user for a password.
|
||||
This option has no effect if the authentication module is
|
||||
the first in the stack, or if no previous modules obtained the
|
||||
user's password.
|
||||
.TP
|
||||
.B try_first_pass
|
||||
.It Li try_first_pass
|
||||
This option is similar to the
|
||||
.B use_first_pass
|
||||
.Li use_first_pass
|
||||
option, except that if the previously obtained password fails, the
|
||||
user is prompted for another password.
|
||||
.TP
|
||||
.B forwardable
|
||||
.It Li forwardable
|
||||
Obtain forwardable Kerberos credentials for the user.
|
||||
.TP
|
||||
.B no_ccache
|
||||
.It Li no_ccache
|
||||
Do not save the obtained credentials in a credentials cache. This is a
|
||||
useful option if the authentication module is used for services such
|
||||
as ftp or pop, where the user would not be able to destroy them. [This
|
||||
is not a recommendation to use the module for those services.]
|
||||
.TP
|
||||
.B ccache=<name>
|
||||
.It Li ccache=<name>
|
||||
Use <name> as the credentials cache. <name> must be in the form
|
||||
.IR type:residual .
|
||||
.Li type:residual .
|
||||
The special tokens
|
||||
.BR %u ,
|
||||
.Li %u ,
|
||||
to designate the decimal uid of the user;
|
||||
and
|
||||
.BR %p ,
|
||||
.Li %p ,
|
||||
to designate the current process id; can be used in <name>.
|
||||
.SH Kerberos 5 Account Management Module
|
||||
.El
|
||||
.Ss Kerberos 5 Account Management Module
|
||||
The Kerberos 5 account management component
|
||||
provides a function to perform account management,
|
||||
.BR pam_sm_acct_mgmt(\|) .
|
||||
.Fn pam_sm_acct_mgmt .
|
||||
The function verifies that the authenticated principal is allowed
|
||||
to login to the local user account by calling
|
||||
.B krb5_kuserok()
|
||||
.Fn krb5_kuserok
|
||||
(which checks the user's \&.k5login file).
|
||||
.SH Kerberos 5 Password Management Module
|
||||
.Ss Kerberos 5 Password Management Module
|
||||
The Kerberos 5 password management component
|
||||
provides a function to change passwords
|
||||
(\f3pam_sm_chauthtok(\|)\f1). The username supplied (the
|
||||
.Pq Fn pam_sm_chauthtok .
|
||||
The username supplied (the
|
||||
user running the
|
||||
.BR passwd (1)
|
||||
.Xr passwd 1
|
||||
command, or the username given as an argument) is mapped into
|
||||
a Kerberos principal name, using the same technique as in
|
||||
the authentication module. Note that if a realm name was
|
||||
@ -119,27 +117,26 @@ explicitly supplied during authentication, but not during
|
||||
a password change, the mapping
|
||||
done by the password management module may not result in the
|
||||
same principal as was used for authentication.
|
||||
.LP
|
||||
.Pp
|
||||
Unlike when
|
||||
changing a unix password, the password management module will
|
||||
allow any user to change any principal's password (if the user knows
|
||||
the principal's old password, of course). Also unlike unix, root
|
||||
is always prompted for the principal's old password.
|
||||
.LP
|
||||
.Pp
|
||||
The password management module uses the same heuristics as
|
||||
.BR kpasswd (1)
|
||||
.Xr kpasswd 1
|
||||
to determine how to contact the Kerberos password server.
|
||||
.LP
|
||||
.Pp
|
||||
The following options may be passed to the password management
|
||||
module:
|
||||
.TP 15
|
||||
.B debug
|
||||
.BR syslog (3)
|
||||
.Bl -tag -width 15n
|
||||
.It Li debug
|
||||
.Xr syslog 2
|
||||
debugging information at
|
||||
.SB LOG_DEBUG
|
||||
.Dv LOG_DEBUG
|
||||
level.
|
||||
.TP
|
||||
.B use_first_pass
|
||||
.It Li use_first_pass
|
||||
If the password management module is not the first in the stack,
|
||||
and a previous module obtained the user's old password, that password is
|
||||
used to authenticate the user. If this fails, the password
|
||||
@ -149,43 +146,44 @@ If successful, the new password entered to the previous module is also
|
||||
used as the new Kerberos password. If the new password fails,
|
||||
the password management module returns failure without
|
||||
prompting the user for a new password.
|
||||
.TP
|
||||
.B try_first_pass
|
||||
.It Li try_first_pass
|
||||
This option is similar to the
|
||||
.B use_first_pass
|
||||
.Li use_first_pass
|
||||
option, except that if the previously obtained old or new passwords fail,
|
||||
the user is prompted for them.
|
||||
.SH Kerberos 5 Session Management Module
|
||||
.El
|
||||
.Ss Kerberos 5 Session Management Module
|
||||
The Kerberos 5 session management component
|
||||
provides functions to initiate
|
||||
(\f3pam_sm_open_session(\|)\f1)
|
||||
.Pq Fn pam_sm_open_session
|
||||
and terminate
|
||||
(\f3pam_sm_close_session(\|)\f1)
|
||||
.Pq Fn pam_sm_close_session
|
||||
sessions. Since session management is not defined under Kerberos 5,
|
||||
both of these functions simply return success. They are provided
|
||||
only because of the naming conventions for PAM modules.
|
||||
.SH ENVIRONMENT
|
||||
.TP "\w'.SM KRB5CCNAME\ \ 'u"
|
||||
.SM KRB5CCNAME
|
||||
.Sh ENVIRONMENT
|
||||
.Bl -tag -width "KRB5CCNAME"
|
||||
.It Ev KRB5CCNAME
|
||||
Location of the credentials cache.
|
||||
.SH FILES
|
||||
.TP "\w'/tmp/krb5cc_[uid]\ \ 'u"
|
||||
/tmp/krb5cc_[uid]
|
||||
.El
|
||||
.Sh FILES
|
||||
.Bl -tag -width "/tmp/krb5cc_[uid]" -compact
|
||||
.It Pa /tmp/krb5cc_[uid]
|
||||
default credentials cache ([uid] is the decimal UID of the user).
|
||||
.TP
|
||||
~/\&.k5login
|
||||
.It Pa $HOME/.k5login
|
||||
file containing Kerberos principals that are allowed access.
|
||||
.SH SEE ALSO
|
||||
.BR kdestroy (1),
|
||||
.BR passwd (1),
|
||||
.BR pam (8),
|
||||
.BR syslog (3),
|
||||
.BR pam.conf (5).
|
||||
.SH NOTES
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
.Xr kdestroy 1 ,
|
||||
.Xr passwd 1 ,
|
||||
.Xr syslog 3 ,
|
||||
.Xr pam.conf 5 ,
|
||||
.Xr pam 8 .
|
||||
.Sh NOTES
|
||||
Applications should not call
|
||||
.B pam_authenticate()
|
||||
.Fn pam_authenticate
|
||||
more than once between calls to
|
||||
.B pam_start()
|
||||
.Fn pam_start
|
||||
and
|
||||
.B pam_end()
|
||||
.Fn pam_end
|
||||
when using the Kerberos 5 PAM module.
|
||||
|
||||
Loading…
Reference in New Issue
Block a user