te
Copyright (C) 2003, Sun Microsystems, Inc. All Rights Reserved
The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
pam_dhkeys - authentication Diffie-Hellman keys management module

pam_dhkeys.so.1

The pam_dhkeys.so.1 service module provides functionality to two PAM services: Secure RPC authentication and Secure RPC authentication token management.

Secure RPC authentication differs from regular unix authentication because some ONC RPCs use Secure RPC as the underlying security mechanism.

The following options may be passed to the module: debug

nowarn If the user has Diffie-Hellman keys, pam_sm_authenticate() establishes secret keys for the user specified by the PAM_USER (equivalent to running keylogin(1)), using the authentication token found in the PAM_AUTHTOK item. If pam_sm_setcred() is called with PAM_ESTABLISH_CRED and the user's secure RPC credentials need to be established, these credentials are set. This is equivalent to running keylogin(1).

If the credentials could not be set and PAM_SILENT is not specified, a diagnostic message is displayed. If pam_setcred() is called with PAM_DELETE_CRED, the user's secure RPC credentials are unset. This is equivalent to running keylogout(1).

PAM_REINITIALIZE_CRED and PAM_REFRESH_CRED are not supported and return PAM_IGNORE.

The pam_sm_chauthtok() implementation checks whether the old login password decrypts the users secret keys. If it doesn't this module prompts the user for an old Secure RPC password and stores it in a pam data item called SUNW_OLDRPCPASS. This data item can be used by the store module to effectively update the users secret keys. The authentication service returns the following error codes: PAM_SUCCESS PAM_IGNORE PAM_USER_UNKNOWN PAM_AUTH_ERR PAM_BUF_ERR PAM_SYSTEM_ERR

The authentication token management returns the following error codes: PAM_SUCCESS

PAM_USER_UNKNOWN PAM_AUTHTOK_ERR PAM_BUF_ERR See attributes(7) for descriptions of the following attributes:

ATTRIBUTE TYPE ATTRIBUTE VALUE

Interface Stability Evolving

MT Level MT-Safe with exceptions

keylogin (1), keylogout (1), syslog (3C), libpam (3LIB), pam (3PAM), pam_authenticate (3PAM), pam_chauthtok (3PAM), pam_setcred (3PAM), pam_sm_authenticate (3PAM), pam_sm_chauthtok (3PAM), pam_sm_setcred (3PAM), pam.conf (5), attributes (7), pam_authtok_check (7), pam_authtok_get (7), pam_authtok_store (7), pam_passwd_auth (7), pam_unix_account (7), pam_unix_auth (7), pam_unix_session (7) The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle.

The pam_unix(7) module is no longer supported. Similar functionality is provided by pam_authtok_check(7), pam_authtok_get(7), pam_authtok_store(7), pam_dhkeys(7), pam_passwd_auth(7), pam_unix_account(7), pam_unix_auth(7), and pam_unix_session(7).