1.\" $NetBSD: pam_ksu.8,v 1.4 2005/02/26 15:04:52 thorpej Exp $ 2.\" Copyright (c) 2001 Mark R V Murray 3.\" All rights reserved. 4.\" Copyright (c) 2001 Networks Associates Technology, Inc. 5.\" All rights reserved. 6.\" 7.\" This software was developed for the FreeBSD Project by ThinkSec AS and 8.\" NAI Labs, the Security Research Division of Network Associates, Inc. 9.\" under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 10.\" DARPA CHATS research program. 11.\" 12.\" Redistribution and use in source and binary forms, with or without 13.\" modification, are permitted provided that the following conditions 14.\" are met: 15.\" 1. Redistributions of source code must retain the above copyright 16.\" notice, this list of conditions and the following disclaimer. 17.\" 2. Redistributions in binary form must reproduce the above copyright 18.\" notice, this list of conditions and the following disclaimer in the 19.\" documentation and/or other materials provided with the distribution. 20.\" 3. The name of the author may not be used to endorse or promote 21.\" products derived from this software without specific prior written 22.\" permission. 23.\" 24.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 25.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 28.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34.\" SUCH DAMAGE. 35.\" 36.\" $FreeBSD: src/lib/libpam/modules/pam_ksu/pam_ksu.8,v 1.3 2002/12/12 08:19:47 ru Exp $ 37.\" 38.Dd May 15, 2002 39.Dt PAM_KSU 8 40.Os 41.Sh NAME 42.Nm pam_ksu 43.Nd Kerberos 5 SU PAM module 44.Sh SYNOPSIS 45.Op Ar service-name 46.Ar module-type 47.Ar control-flag 48.Pa pam_ksu 49.Op Ar options 50.Sh DESCRIPTION 51The Kerberos 5 SU authentication service module for PAM 52provides functionality for only one PAM category: authentication. 53In terms of the 54.Ar module-type 55parameter, this is the 56.Dq Li auth 57feature. 58The module is specifically designed to be used with the 59.Xr su 1 60utility. 61.\" It also provides a null function for session management. 62.Ss Kerberos 5 SU Authentication Module 63The Kerberos 5 SU authentication component provides functions to verify 64the identity of a user 65.Pq Fn pam_sm_authenticate , 66and determine whether or not the user is authorized to obtain the 67privileges of the target account. 68If the target account is 69.Dq root , 70then the Kerberos 5 principal used 71for authentication and authorization will be the 72.Dq root 73instance of 74the current user, e.g.\& 75.Dq Li user/root@REAL.M . 76Otherwise, the principal will simply be the current user's default 77principal, e.g.\& 78.Dq Li user@REAL.M . 79.Pp 80The user is prompted for a password if necessary. 81Authorization is performed 82by comparing the Kerberos 5 principal with those listed in the 83.Pa .k5login 84file in the target account's home directory 85(e.g.\& 86.Pa /root/.k5login 87for root). 88.Pp 89The following options may be passed to the authentication module: 90.Bl -tag -width ".Cm use_first_pass" 91.It Cm debug 92.Xr syslog 3 93debugging information at 94.Dv LOG_DEBUG 95level. 96.It Cm use_first_pass 97If the authentication module 98is not the first in the stack, 99and a previous module 100obtained the user's password, 101that password is used 102to authenticate the user. 103If this fails, 104the authentication module returns failure 105without prompting the user for a password. 106This option has no effect 107if the authentication module 108is the first in the stack, 109or if no previous modules 110obtained the user's password. 111.It Cm try_first_pass 112This option is similar to the 113.Cm use_first_pass 114option, 115except that if the previously obtained password fails, 116the user is prompted for another password. 117.El 118.Sh SEE ALSO 119.Xr su 1 , 120.Xr syslog 3 , 121.Xr pam.conf 5 , 122.Xr pam 8 123