pam_authsrv(5)

NAME
pam_authsrv - PAM module for TIS authsrv authentication

SYNOPSIS
/usr/local/lib/security/pam_authsrv.so.1

DESCRIPTION
pam_authsrv is a shared library which gets dynamically loaded into the PAM framework. It provides TIS authsrv authentication for PAM-aware applications. The pam_authsrv module supports a local text file called /etc/pam_tis.map which maps local login names to the user name in the authsrv database. The file consists of lines of the format:

    local_login : authsrv_user

If the authsrv_user name is not present, the ":" is ignored and the local_login name will be used to identify the user to the authsrv daemon. Text beginning with a '#' is ignored through the next newline. Blank lines and incomplete lines are also ignored.

OPTIONS
The pam_authsrv module accepts the optional argument unknown_user=disposition. This option tells the module what to do when it cannot read the /etc/pam_tis.map file or when the local_login name is not found in the file. There are three possible values for disposition:

fail
    The authentication will fail if the user is not found in the /etc/pam_tis.map file.

succeed
    The authentication will succeed if the user is not found in the /etc/pam_tis.map file.

ignore
    The authentication attempt will be ignored if the user is not found in the /etc/pam_tis.map file.

If this option is not specified, the default behavior is to query the authsrv using the specified local user name.

EXAMPLE
A common practice for systems with multiple administrators is to have an "su" account for each admin which can be accessed via authsrv authentication. To set this up, here's what you'd put in /etc/pam.conf:

    su auth required /usr/local/lib/security/pam_authsrv.so.1

Then, put the su accounts in the /etc/pam_tis.map file:

    susmith : smith # John Smith
    sujrh : jrh # J. Random Hacker

BUGS
The pam_authsrv module only implements the functions for the "auth" module type (pam_sm_authenticate(3) and pam_sm_setcred(3)). The module does not implement functions for the "account", "session", and "password" module types.

Due to architectual and implementation issues of PAM, it is strongly advised to turn off DNS resolution in networking PAM client applications, otherwise pam_authsrv won't be able to determine remote host IP address.

FILES
/etc/pam_tis.map
/usr/local/etc/netperm-table
/etc/pam.conf

SEE ALSO
pam(3), pam.conf(4), authsrv(8)

AUTHOR
Mark D. Roth <roth@uiuc.edu>