pam_afs(5)

NAME
pam_afs, pam_afs.so - pluggable authentication modules for OpenAFS

SYNOPSIS
pam_afs.so.1, pam_afs.krb.so.1

DESCRIPTION
The OpenAFS pluggable authentication module provides module support for authentication, session management, and password management, which coorespond to the auth, session, and password directives in a PAM configuration file, respectively. The pam_afs.krb.so module additionally keeps users' Kerberos 4 TGT available for users to use in other applications. The pam_afs.so module does not do this. The pam_afs.krb.so module has nothing to do with Kerberos 5 authentication. Users with a Kerberos 5 integrated AFS environment should not use either of these modules, but instead use pam_krb5.so directly.

OPTIONS
The following arguments are supported. In parenthesis next to each option are the environments in which it works.

cell cell_name
    (auth) Specify a cell_name to authenticate to other than the local cell.

debug
    (all) Provide extra debugging information to syslog.

dont_fork
    (auth) Do not use a fork() when authenticating. Forking is a good idea, because sockets and memory used by the authentication function get cleaned up automatically. This option should only be used if a PAM application fails when a fork() is issued. This option cannot be used with use_klog.

ignore_root
    (auth, password) If user root is authenticating, simply return PAM_SUCCESS without any AFS authentication attempt. Presumably, authentication would fall through to a secondary mechanism.

ignore_uid uid
    (auth) Similar to ignore_root but it allows you to specify a uid such that any user authenticating with uid less than or equal to uid will not have AFS authentication performed.

no_unlog
    (session) Does not destroy a token during logout. This is useful if users have background jobs still running under their PAG that need access to AFS after they log out.

nowarn
    (auth, password) Prevents warning from being written to syslog.

refresh_token
    (auth) Obtains a token without first obtaining a PAG. This is useful for screensavers to update the lifetime of a user's token.

remain
    (session) Causes AFS tokens to remain for 5 minutes after logout.

remainlifetime lifetime
    (session) Specify, in seconds, how long tokens should remain after logout.

set_token
    (auth) If set_token is specified, the token obtained in the authentication phase is not destroyed. Ordinarily, tokens are obtained in the setcred() phase of authentication. For PAM applications which do not call setcred(), the set_token directive should be used.

setenv_password_expires
    (auth) Sets the PASSWORD_EXPIRES environment variable to the time when your AFS token will expire.

try_first_pass
    (auth, password) This will first try a password entered to a previous module and if it fails, prompt for the user's AFS password. If pam_afs.so is the first module called, it will generate a failed login attempt with a NULL password for every user logging in.

use_first_pass
    (auth, password) This option is similar to try_first_pass except that it will not prompt for the user's AFS password if the first password fails. If this option is specified and pam_afs.so is the first module listed in the PAM configuration, authentication will fail.

use_klog
    (auth) This directs pam_afs.so to exec klog for authentication instead of calling the authentication functions in the AFS libraries directly.

FILES
/etc/pam.conf
    This is the PAM configuration file on Solaris systems.
/etc/pam.d/*
    These are the PAM configuration files on Linux systems.
/etc/pam.d/system-auth
    This file controls all system authentication on many Linux distributions.

EXAMPLE
Standard auth settings for /etc/pam.d/system-auth on Linux using OpenAFS:
    auth required /lib/security/pam_env.so
    auth sufficient /lib/security/pam_afs.so.1 \
         setenv_password_expires ignore_root
    auth sufficient /lib/security/pam_unix.so likeauth \
         nullok try_first_pass
    auth required /lib/security/pam_deny.so
Suggested settings for auth in /etc/pam.d/xscreensaver
    auth sufficient /lib/security/pam_afs.so.1 \
         refresh_token ignore_root
    auth required /lib/security/pam_stack.so \
         service=system-auth

AUTHOR
Charles Clancy <tcc@xauth.net>

SEE ALSO
klog(1), klog.krb(1), pagsh(1)