| 1 |
5b237745
|
Scott Ullrich
|
# Configuration file for Pluggable Authentication Modules (PAM).
|
| 2 |
|
|
#
|
| 3 |
|
|
# This file controls the authentication methods that login and other
|
| 4 |
|
|
# utilities use. See pam(8) for a description of its format.
|
| 5 |
|
|
#
|
| 6 |
|
|
# $FreeBSD: src/etc/pam.conf,v 1.6.2.18 2003/02/15 17:20:27 des Exp $
|
| 7 |
|
|
#
|
| 8 |
|
|
# service-name module-type control-flag module-path arguments
|
| 9 |
|
|
#
|
| 10 |
|
|
# module-type:
|
| 11 |
|
|
# auth: prompt for a password to authenticate that the user is
|
| 12 |
|
|
# who they say they are, and set any credentials.
|
| 13 |
|
|
# account: non-authentication based authorization, based on time,
|
| 14 |
|
|
# resources, etc.
|
| 15 |
|
|
# session: housekeeping before and/or after login.
|
| 16 |
|
|
# password: update authentication tokens.
|
| 17 |
|
|
#
|
| 18 |
|
|
# control-flag: How libpam handles success or failure of the module.
|
| 19 |
|
|
# required: success is required, and on failure all remaining
|
| 20 |
|
|
# modules are run.
|
| 21 |
|
|
# requisite: success is required, and on failure no remaining
|
| 22 |
|
|
# modules are run.
|
| 23 |
|
|
# sufficient: success is sufficient, and if no previous required
|
| 24 |
|
|
# module failed, no remaining modules are run.
|
| 25 |
|
|
# optional: ignored unless the other modules return PAM_IGNORE.
|
| 26 |
|
|
#
|
| 27 |
|
|
# arguments:
|
| 28 |
|
|
# Passed to the module; module-specific plus some generic ones:
|
| 29 |
|
|
# debug: syslog debug info.
|
| 30 |
|
|
# no_warn: return no warning messages to the application.
|
| 31 |
|
|
# use_first_pass: try authentication using password from the
|
| 32 |
|
|
# preceding auth module.
|
| 33 |
|
|
# try_first_pass: first try authentication using password from
|
| 34 |
|
|
# the preceding auth module, and if that fails
|
| 35 |
|
|
# prompt for a new password.
|
| 36 |
|
|
# use_mapped_pass: convert cleartext password to a crypto key.
|
| 37 |
|
|
# expose_account: allow printing more info about the user when
|
| 38 |
|
|
# prompting.
|
| 39 |
|
|
#
|
| 40 |
|
|
# Each final entry must say "required" -- otherwise, things don't
|
| 41 |
|
|
# work quite right. If you delete a final entry, be sure to change
|
| 42 |
|
|
# "sufficient" to "required" in the entry before it.
|
| 43 |
|
|
#
|
| 44 |
|
|
## OpenSSH with PAM support requires similar modules. The session one is
|
| 45 |
|
|
## a bit strange, though...
|
| 46 |
|
|
sshd auth sufficient pam_skey.so
|
| 47 |
|
|
sshd auth sufficient pam_opie.so no_fake_prompts
|
| 48 |
|
|
#sshd auth requisite pam_opieaccess.so
|
| 49 |
|
|
#sshd auth sufficient pam_kerberosIV.so try_first_pass
|
| 50 |
|
|
#sshd auth sufficient pam_krb5.so try_first_pass
|
| 51 |
|
|
sshd auth required pam_unix.so try_first_pass
|
| 52 |
|
|
sshd account required pam_unix.so
|
| 53 |
|
|
sshd password required pam_permit.so
|
| 54 |
|
|
sshd session required pam_permit.so
|