Hallo, dies ist ein Test.

PWD: /www/data-lst1/unixsoft/unixsoft/kaempfer/.public_html

Running in File Mode
Relative path: ./../../../../../../usr/man/man7/pam_krb5_migrate.7
Real path: /usr/share/man/man7/pam_krb5_migrate.7
Zurück

'\" te .\" Copyright (c) 2004, 2023, Oracle and/or its affiliates. .TH pam_krb5_migrate 7 "15 Mar 2023" "Oracle Solaris 11.4" "Standards, Environments, Macros, Character Sets, and miscellany" .SH NAME pam_krb5_migrate \- authentication PAM module for the KerberosV5 auto-migration of users feature .SH SYNOPSIS .LP .nf \fBpam_krb5_migrate.so.1\fR [\fBdebug\fR] [\fBclient_service=\fR\fIservice-name\fR] [\fBquiet\fR] [\fBexpire_pw\fR] .fi .SH DESCRIPTION .sp .LP The KerberosV5 auto-migrate service module for PAM provides functionality for the PAM authentication component. The service module helps in the automatic migration of \fBPAM_USER\fR to the client's local Kerberos realm, using \fBPAM_AUTHTOK\fR (the PAM authentication token associated with \fBPAM_USER\fR) as the new Kerberos principal's password. .SS "KerberosV5 Auto-migrate Authentication Module" .sp .LP The KerberosV5 auto-migrate authentication component provides the \fBpam_sm_authenticate\fR(3PAM) function to migrate a user who does not have a corresponding \fBkrb5\fR principal account to the default Kerberos realm of the client. .sp .LP \fBpam_sm_authenticate\fR(3PAM) uses a host-based client service principal, present in the local \fBkeytab\fR (\fB/etc/krb5/krb5.keytab\fR) to authenticate to \fBkadmind\fR(8) (defaults to the \fBhost/nodename.fqdn\fR service principal), for the principal creation operation. Also, for successful creation of the \fBkrb5\fR user principal account, the host-based client service principal being used needs to be assigned the appropriate privilege on the master KDC's \fBkadm5.acl\fR file. \fBkadmind\fR(8) checks for the appropriate privilege and validates the user password using PAM by calling \fBpam_authenticate\fR(3PAM) and \fBpam_acct_mgmt\fR(3PAM) for the \fBk5migrate\fR service. .sp .LP If migration of the user to the KerberosV5 infrastructure is successful, the module will inform users about it by means of a \fBPAM_TEXT_INFO\fR message, unless instructed otherwise by the presence of the \fBquiet\fR option. .sp .LP The authentication component always returns \fBPAM_IGNORE\fR and is meant to be stacked in the PAM configuration (see \fBpam.conf\fR(5)) with a requirement that it be listed below \fBpam_authtok_get\fR(7) in the authentication stack. Also, if \fBpam_krb5_migrate\fR is used in the authentication stack of a particular service, it is mandatory that \fBpam_krb5\fR(7) be listed in the PAM account stack of that service for proper operation (see the examples below). .SH OPTIONS .sp .LP The following options can be passed to the KerberosV5 auto-migrate authentication module: .sp .ne 2 .mk .na \fB\fBdebug\fR\fR .ad .br .sp .6 .RS 4n Provides \fBsyslog\fR(3C) debugging information at \fBLOG_DEBUG\fR level. .RE .sp .ne 2 .mk .na \fB\fBclient_service=\fR\fIservice-name\fR\fR .ad .br .sp .6 .RS 4n Name of the service used to authenticate to \fBkadmind\fR(8) defaults to \fBhost\fR. This means that the module uses \fBhost/\fR\fInodename.fqdn\fR as its client service principal name, KerberosV5 user principal creation operation or \fIservice-name\fR/\fInodename.fqdn\fR if this option is provided. .RE .sp .ne 2 .mk .na \fB\fBquiet\fR\fR .ad .br .sp .6 .RS 4n Do not explain KerberosV5 migration to the user. .sp This has the same effect as passing the \fBPAM_SILENT\fR flag to \fBpam_sm_authenticate\fR(3PAM) and is useful where applications cannot handle \fBPAM_TEXT_INFO\fR messages. .sp If not set, the authentication component will issue a \fBPAM_TEXT_INFO\fR message after creation of the Kerberos V5 principal, indicating that it has done so. .RE .sp .ne 2 .mk .na \fB\fBexpire_pw\fR\fR .ad .br .sp .6 .RS 4n Causes the creation of KerberosV5 user principals with password expiration set to \fBnow\fR (current time). .RE .SH EXAMPLES .LP \fBExample 1\fR Sample PAM entries for the \fBpam_krb5_migrate.so.1\fR module .sp .LP The following \fBpam.conf\fR(5) entries demonstrate the use of the \fBpam_krb5_migrate.so.1\fR module: .sp .in +2 .nf login auth requisite pam_authtok_get.so.1 login auth required pam_unix_cred.so.1 login auth sufficient pam_krb5.so.1 login auth requisite pam_unix_auth.so.1 login auth optional pam_krb5_migrate.so.1 expire_pw other account requisite pam_roles.so.1 other account required pam_krb5.so.1 other account required pam_unix_account.so.1 .fi .in -2 .sp .sp .LP The equivalent PAM configuration in \fB/etc/pam.d/\fR would be the following entries in \fB/etc/pam.d/login\fR: .sp .in +2 .nf auth requisite pam_authtok_get.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_krb5.so.1 auth requisite pam_unix_auth.so.1 auth optional pam_krb5_migrate.so.1 expire_pw .fi .in -2 .sp .sp .LP and the following entries in \fB/etc/pam.d/other\fR: .sp .in +2 .nf account requisite pam_roles.so.1 account required pam_krb5.so.1 account required pam_unix_account.so.1 .fi .in -2 .sp .sp .LP The \fBpam_krb5_migrate\fR module can generally be present on the authentication stack of any service where the application calls \fBpam_sm_authenticate\fR(3PAM) and an authentication token (in the preceding example, the authentication token would be the user's UNIX password) is available for use as a Kerberos V5 password. .LP \fBExample 2\fR Sample Entries from \fBkadm5.acl\fR .sp .LP The following entries from \fBkadm5.acl\fR permit or deny privileges to the host client service principal: .sp .in +2 .nf host/*@EXAMPLE.COM U root host/*@EXAMPLE.COM ui * .fi .in -2 .sp .sp .LP The preceding entries permit the \fBpam_krb5_migrate\fR \fBadd\fR privilege to the host client service principal of any machine in the \fBEXAMPLE.COM\fR KerberosV5 realm, but denies the \fBadd\fR privilege to all host service principals for addition of the root user account. .LP \fBExample 3\fR Sample PAM entries for the Master KDC .sp .LP The \fB/etc/pam.conf\fR entries below enable \fBkadmind\fR(8) on the master KDC to use the \fBk5migrate\fR PAM service in order to validate UNIX user passwords for accounts that require migration to the Kerberos realm. .sp .in +2 .nf k5migrate auth required pam_unix_auth.so.1 k5migrate account required pam_unix_account.so.1 .fi .in -2 .sp .sp .LP The equivalent PAM configuration in \fB/etc/pam.d/\fR would be the following entries in \fB/etc/pam.d/k5migrate\fR: .sp .in +2 .nf auth required pam_unix_auth.so.1 account required pam_unix_account.so.1 .fi .in -2 .sp .SH ATTRIBUTES .sp .LP See \fBattributes\fR(7) for descriptions of the following attributes: .sp .TS tab( ) box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) . ATTRIBUTE TYPE ATTRIBUTE VALUE _ Availability service/security/kerberos-5 _ Interface Stability Committed .TE .sp .SH SEE ALSO .sp .LP \fBsyslog\fR(3C), \fBpam_acct_mgmt\fR(3PAM), \fBpam_authenticate\fR(3PAM), \fBpam_sm_authenticate\fR(3PAM), \fBpam.conf\fR(5), \fBattributes\fR(7), \fBkerberos\fR(7), \fBpam_authtok_get\fR(7), \fBpam_krb5\fR(7), \fBkadmind\fR(8) .SH HISTORY .sp .LP The \fBpam_krb5_migrate\fR module was introduced in the Solaris 10 3/05 release, and backported to patches for Solaris 9.