2008-04-30 17:10:46 +04:00
|
|
|
.\" $NetBSD: pam.8,v 1.4 2008/04/30 13:10:57 martin Exp $
|
2005-03-02 05:56:24 +03:00
|
|
|
.\"
|
|
|
|
|
.\" Copyright (c) 2005 The NetBSD Foundation, Inc.
|
|
|
|
|
.\" All rights reserved.
|
|
|
|
|
.\"
|
|
|
|
|
.\" This code is derived from software contributed to The NetBSD Foundation
|
|
|
|
|
.\" by Jason R. Thorpe.
|
|
|
|
|
.\"
|
|
|
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
|
|
|
.\" modification, are permitted provided that the following conditions
|
|
|
|
|
.\" are met:
|
|
|
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
|
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
|
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
|
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
|
|
|
.\"
|
|
|
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
|
|
|
|
|
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
|
|
|
|
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
|
|
|
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
|
|
|
|
|
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
|
|
|
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
|
|
|
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
|
|
|
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
|
|
|
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
|
|
|
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
|
|
|
.\" POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
|
.\"
|
|
|
|
|
.Dd February 28, 2005
|
|
|
|
|
.Dt PAM 8
|
|
|
|
|
.Os
|
|
|
|
|
.Sh NAME
|
|
|
|
|
.Nm pam
|
|
|
|
|
.Nd Pluggable Authentication Modules framework
|
|
|
|
|
.Sh DESCRIPTION
|
|
|
|
|
The Pluggable Authentication Modules
|
|
|
|
|
.Pq PAM
|
|
|
|
|
framework is a system of libraries that perform authentication tasks for
|
|
|
|
|
services and applications.
|
|
|
|
|
Applications that use the PAM API may have their authentication behavior
|
|
|
|
|
configured by the system administrator though the use of the service's
|
|
|
|
|
PAM configuration file.
|
|
|
|
|
.Pp
|
|
|
|
|
PAM modules provide four classes of functionality:
|
|
|
|
|
.Bl -tag -width password
|
|
|
|
|
.It account
|
|
|
|
|
Account verification services such as password expiration and access control.
|
|
|
|
|
.It auth
|
|
|
|
|
Authentication services.
|
|
|
|
|
This usually takes the form of a challenge-response conversation.
|
|
|
|
|
However, PAM can also support, with appropriate hardware support, biometric
|
|
|
|
|
devices, smart-cards, and so forth.
|
|
|
|
|
.It password
|
|
|
|
|
Password
|
|
|
|
|
.Pq or, more generally, authentication token
|
|
|
|
|
change and update services.
|
|
|
|
|
.It session
|
|
|
|
|
Session management services.
|
|
|
|
|
These are tasks that are performed before access to a service is granted
|
|
|
|
|
and after access to a service is withdrawn.
|
|
|
|
|
These may include updating activity logs or setting up and tearing down
|
|
|
|
|
credential forwarding agents.
|
|
|
|
|
.El
|
|
|
|
|
.Pp
|
|
|
|
|
A primary feature of PAM is the notion of
|
|
|
|
|
.Dq stacking
|
|
|
|
|
different modules together to form a processing chain for the task.
|
|
|
|
|
This allows fairly precise control over how a particular authentication
|
|
|
|
|
task is performed, and under what conditions.
|
2005-03-02 06:33:46 +03:00
|
|
|
PAM module configurations may also inherit stacks from other module
|
2005-03-02 05:56:24 +03:00
|
|
|
configurations, providing some degree of centralized administration.
|
|
|
|
|
.Sh SEE ALSO
|
|
|
|
|
.Xr login 1 ,
|
|
|
|
|
.Xr passwd 1 ,
|
|
|
|
|
.Xr su 1 ,
|
|
|
|
|
.Xr pam 3 ,
|
|
|
|
|
.Xr pam.conf 5 ,
|
|
|
|
|
.Xr pam_chroot 8 ,
|
|
|
|
|
.Xr pam_deny 8 ,
|
|
|
|
|
.Xr pam_echo 8 ,
|
|
|
|
|
.Xr pam_exec 8 ,
|
|
|
|
|
.Xr pam_ftpusers 8 ,
|
|
|
|
|
.Xr pam_group 8 ,
|
|
|
|
|
.Xr pam_guest 8 ,
|
|
|
|
|
.Xr pam_krb5 8 ,
|
|
|
|
|
.Xr pam_ksu 8 ,
|
|
|
|
|
.Xr pam_lastlog 8 ,
|
|
|
|
|
.Xr pam_login_access 8 ,
|
|
|
|
|
.Xr pam_nologin 8 ,
|
|
|
|
|
.Xr pam_permit 8 ,
|
|
|
|
|
.Xr pam_radius 8 ,
|
|
|
|
|
.Xr pam_rhosts 8 ,
|
|
|
|
|
.Xr pam_rootok 8 ,
|
|
|
|
|
.Xr pam_securetty 8 ,
|
|
|
|
|
.Xr pam_self 8 ,
|
|
|
|
|
.Xr pam_skey 8 ,
|
|
|
|
|
.Xr pam_ssh 8 ,
|
|
|
|
|
.Xr pam_unix 8
|
|
|
|
|
.Sh HISTORY
|
|
|
|
|
The Pluggable Authentication Module framework was originally developed
|
|
|
|
|
by SunSoft, described in DCE/OSF-RFC 86.0, and first deployed in Solaris 2.6.
|
|
|
|
|
It was later incorporated into the X/Open Single Sign-On Service
|
|
|
|
|
.Pq XSSO
|
|
|
|
|
Pluggable Authentication Modules specifiation.
|
|
|
|
|
.Pp
|
|
|
|
|
The Pluggable Authentication Module framework first appeared in
|
|
|
|
|
.Nx 3.0 .
|
