1.\" Copyright (c) 1999 2.\" Andrzej Bialecki <abial@FreeBSD.org>. All rights reserved. 3.\" 4.\" Copyright (c) 1992, 1993, 1994 5.\" The Regents of the University of California. All rights reserved. 6.\" All rights reserved. 7.\" 8.\" This code is derived from software donated to Berkeley by 9.\" Jan-Simon Pendry. 10.\" 11.\" Redistribution and use in source and binary forms, with or without 12.\" modification, are permitted provided that the following conditions 13.\" are met: 14.\" 1. Redistributions of source code must retain the above copyright 15.\" notice, this list of conditions and the following disclaimer. 16.\" 2. Redistributions in binary form must reproduce the above copyright 17.\" notice, this list of conditions and the following disclaimer in the 18.\" documentation and/or other materials provided with the distribution. 19.\" 3. Neither the name of the University nor the names of its contributors 20.\" may be used to endorse or promote products derived from this software 21.\" without specific prior written permission. 22.\" 23.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33.\" SUCH DAMAGE. 34.\" 35.Dd May 17, 2023 36.Dt PAM_TACPLUS 8 37.Os 38.Sh NAME 39.Nm pam_tacplus 40.Nd TACACS+ authentication PAM module 41.Sh SYNOPSIS 42.Op Ar service-name 43.Ar module-type 44.Ar control-flag 45.Pa pam_tacplus 46.Op Ar options 47.Sh DESCRIPTION 48The 49.Nm 50module provides authentication services based 51upon the TACACS+ protocol 52for the PAM (Pluggable Authentication Module) framework. 53.Pp 54The 55.Nm 56module accepts these optional parameters: 57.Bl -tag -width ".Cm use_first_pass" 58.It Cm use_first_pass 59causes 60.Nm 61to use a previously entered password instead of prompting for a new one. 62If no password has been entered then authentication fails. 63.It Cm try_first_pass 64causes 65.Nm 66to use a previously entered password, if one is available. 67If no 68password has been entered, 69.Nm 70prompts for one as usual. 71.It Cm echo_pass 72causes echoing to be left on if 73.Nm 74prompts for a password. 75.It Cm conf Ns = Ns Ar pathname 76specifies a non-standard location for the TACACS+ client configuration file 77(normally located in 78.Pa /etc/tacplus.conf ) . 79.It Cm template_user Ns = Ns Ar username 80specifies a user whose 81.Xr passwd 5 82entry will be used as a template to create the session environment 83if the supplied username does not exist in local password database. 84The user 85will be authenticated with the supplied username and password, but his 86credentials to the system will be presented as the ones for 87.Ar username , 88i.e., his login class, home directory, resource limits, etc.\& will be set to ones 89defined for 90.Ar username . 91.Pp 92If this option is omitted, and there is no username 93in the system databases equal to the supplied one (as determined by call to 94.Xr getpwnam 3 ) , 95the authentication will fail. 96.El 97.Sh FILES 98.Bl -tag -width /etc/tacplus.conf -compact 99.It Pa /etc/tacplus.conf 100The standard TACACS+ client configuration file for 101.Nm 102.El 103.Sh SEE ALSO 104.Xr pam 3 , 105.Xr passwd 5 , 106.Xr tacplus.conf 5 , 107.Xr nss_tacplus 8 108.Sh HISTORY 109The 110.Nm 111module first appeared in 112.Fx 3.1 . 113.Sh AUTHORS 114.An -nosplit 115The 116.Nm 117manual page was written by 118.An Andrzej Bialecki Aq Mt abial@FreeBSD.org 119and adapted to TACACS+ from RADIUS by 120.An Mark R V Murray Aq Mt markm@FreeBSD.org . 121.Pp 122The 123.Nm 124module was written by 125.An John D. Polstra Aq Mt jdp@FreeBSD.org . 126