PAM_KRB5(5) pam-krb5 PAM_KRB5(5) (NAME) pam_krb5 - PAM (SYNOPSIS) auth sufficient pam_krb5.so minimum_uid=1000 session required pam_krb5.so minimum_uid=1000 account required pam_krb5.so minimum_uid=1000 password sufficient pam_krb5.so minimum_uid=1000 (DESCRIPTION) PAM /lib/security/pam_krb5.so PAM : . pam_krb5.so PAM PAM . PAM . PAM PAM pam(7) . : auth pam_authenticate() pam_setcred() . PAM ( ) . . PAM_MAX_RESP_SIZE ( ) (DoS) . PAM (keytab) . KDC PAM keytab ( /etc/krb5.keytab) . keytab PAM keytab . keytab ( ) . "verify_ap_req_nofail" [libdefaults] /etc/krb5.conf true . PAM . krb5_kuserok() . .k5login . .k5login ( aname localname krb5.conf ). . PAM "@" pam_authenticate() PAM . . no_update_user . OpenSSH . OpenSSH PAM . PAM pam_securetty getpwnam() pam_krb5 . pam_setcred() KRB5CCNAME . /tmp/krb5cc_UID_RANDOM UID RANDOM . ccache ccache_dir . pam-krb5 default_cc_name "[libdefaults]" krb5.conf . . pam_setcred() PAM . (login sshd ) PAM . session pam_open_session() ( pam_setcred() PAM_ESTABLISH_CRED ) pam_close_session() ( pam_setcred() ) . account pam_acct_mgmt() . pam_authenticate() . password pam_chauthtok() . ( ) PAM "kadmin/changepw" . ( ) . PAM_MAX_RESP_SIZE ( ) . . root root . ( kadmin(8) .) PAM PAM PAM_IGNORE ( "ignore" Linux PAM). . (timeout) . root . ignore_root minimum_uid pam_unix "sufficient" PAM . PAM Sourceforge Red Hat . . (CONFIGURATION) PAM PAM . PAM "pam_krb5.so" . krb5.conf . PAM . (=) . PAM . PAM krb5.conf "[appdefaults]" . (=) "= true" . PAM "[appdefaults]" "pam" . krb5.conf forwardable true minimum_uid 1000 ignore_k5login EXAMPLE.COM . [appdefaults] forwardable = true pam = { minimum_uid = 1000 EXAMPLE.COM = { ignore_k5login = true } } krb5.conf krb5.conf(5) . krb5.conf(5) realm . . PAM "pam" "pam" PAM . krb5.conf PAM PAM . PAM krb5.conf . pam-krb5 . (Authorization) alt_auth_map= [3.12] search_k5login . %s . "@" %s . ( ) . . . sudo . : alt_auth_map=%s/root root ( force_alt_auth only_alt_auth ). . : alt_auth_map=%s@EXAMPLE.COM EXAMPLE.COM . realm : . "[appdefaults]" krb5.conf PAM . auth account . auth account . force_alt_auth [3.12] alt_auth_map KDC . PAM KDC . . alt_auth_map . "[appdefaults]" krb5.conf auth . ignore_k5login [2.0] .k5login . . aname localname krb5.conf . "[appdefaults]" krb5.conf auth account . ignore_root [1.1] "root" . ( "optional" "sufficient" ) ( pam_setcred) PAM_IGNORE PAM PAM . minimum_uid . "[appdefaults]" krb5.conf . minimum_uid= [2.0] UID . ( "optional" "sufficient" ) ( pam_setcred) PAM_IGNORE PAM PAM . root ( ) . . "[appdefaults]" krb5.conf . only_alt_auth [3.12] alt_auth_map . search_k5login force_alt_auth . alt_auth_map . "[appdefaults]" krb5.conf auth . search_k5login [2.0] pam_authenticate . .k5login .k5login . . ( sshd GSS-API) . .k5login . .k5login . "[appdefaults]" krb5.conf auth . (Kerberos Behavior) anon_fast [4.6] (FAST) (WELLKNOWN/ANONYMOUS) FAST. PKINIT PKINIT FAST PKINIT . FAST . FAST . . PKINIT FAST . FAST fast_ccache . fast_ccache anon_fast fast_ccache PAM PKINIT . "[appdefaults]" krb5.conf auth password . fast_ccache . fast_ccache anon_fast fast_ccache . fast_ccache= [4.3] anon_fast PKINIT . FAST PKINIT . . FAST . k5start keytab . root root ( ) . FAST . KDC FAST . PKINIT FAST anon_fast . anon_fast PKINIT . fast_ccache anon_fast fast_ccache PAM PKINIT . "[appdefaults]" krb5.conf auth password . forwardable [1.0] (forwardable). ( true false krb5.conf false ) [libdefaults] krb5.conf . "[appdefaults]" krb5.conf auth . keytab= [3.0] keytab . keytab ( /etc/krb5.keytab) root . root PAM keytab . keytab . "[appdefaults]" krb5.conf auth . realm= [2.2] . . . . user_realm . renew_lifetime= [2.0] . "2d4h10m" . [libdefaults] krb5.conf . "[appdefaults]" krb5.conf auth . ticket_lifetime= [3.0] . "2d4h10m" . [libdefaults] krb5.conf . "[appdefaults]" krb5.conf auth . user_realm [4.6] . ( account ). . .k5login aname_to_localname . PAM (PAM Behavior) clear_on_fail [3.9] PAM . . ( ) PAM required requisite . PAM . . ( KDC) PAM . use_authtok . PAM minimum_uid . PAM . . ( pam_cracklib pam_krb5 ). "[appdefaults]" krb5.conf password . debug [1.0] syslog LOG_DEBUG PAM ( pam_close_session). "[appdefaults]" krb5.conf . defer_pwchange [3.11] pam-krb5 auth . pam_authenticate() . PAM . pam_authenticate() pam_acct_mgmt() PAM_NEW_AUTHTOK_REQD pam_chauthtok() . pam_acct_mgmt() . . pam-krb5 pam_authenticate() PAM . . ( Solaris ) pam_acct_mgmt() . pam-krb5 MIT Kerberos . Heimdal . (Heimdal API 1.6). "[appdefaults]" krb5.conf auth . fail_pwchange [4.2] pam-krb5 auth . . defer_pwchange force_pwchange . "[appdefaults]" krb5.conf auth . force_pwchange [3.11] authenticate . . ( ) . ( Solaris) . "[appdefaults]" krb5.conf auth . no_update_user [4.7] pam-krb5 krb5_aname_to_localname() PAM_USER PAM . PAM_USER . "[appdefaults]" krb5.conf auth . silent [1.0] . PAM_SILENT PAM . auth password . trace= [4.6] . . . PKINIT pkinit_anchors= [3.0] PKINIT (trust anchors) . (CA) . try_pkinit use_pkinit . "[appdefaults]" krb5.conf auth password . pkinit_prompt [3.0] PKINIT . gnome-screensaver PAM . . try_pkinit Enter . try_pkinit use_pkinit . "[appdefaults]" krb5.conf auth password . pkinit_user= [3.0] PKINIT (ID) . PKINIT : PKCS11:/usr/lib/pkcs11/lib/soft-pkcs11.so . . . try_pkinit use_pkinit . "[appdefaults]" krb5.conf auth password . preauth_opt=