1 # Configuration file for Pluggable Authentication Modules (PAM).
3 # This file controls the authentication methods that login and other
4 # utilities use. See pam(8) for a description of its format.
6 # $FreeBSD: src/etc/pam.conf,v 1.6.2.18 2003/02/15 17:20:27 des Exp $
7 # $DragonFly: src/etc/Attic/pam.conf,v 1.2 2003/06/17 04:24:45 dillon Exp $
9 # service-name module-type control-flag module-path arguments
12 # auth: prompt for a password to authenticate that the user is
13 # who they say they are, and set any credentials.
14 # account: non-authentication based authorization, based on time,
16 # session: housekeeping before and/or after login.
17 # password: update authentication tokens.
19 # control-flag: How libpam handles success or failure of the module.
20 # required: success is required, and on failure all remaining
22 # requisite: success is required, and on failure no remaining
24 # sufficient: success is sufficient, and if no previous required
25 # module failed, no remaining modules are run.
26 # optional: ignored unless the other modules return PAM_IGNORE.
29 # Passed to the module; module-specific plus some generic ones:
30 # debug: syslog debug info.
31 # no_warn: return no warning messages to the application.
32 # use_first_pass: try authentication using password from the
33 # preceding auth module.
34 # try_first_pass: first try authentication using password from
35 # the preceding auth module, and if that fails
36 # prompt for a new password.
37 # use_mapped_pass: convert cleartext password to a crypto key.
38 # expose_account: allow printing more info about the user when
41 # Each final entry must say "required" -- otherwise, things don't
42 # work quite right. If you delete a final entry, be sure to change
43 # "sufficient" to "required" in the entry before it.
45 # If the user can authenticate with S/Key, that's sufficient; allow clear
46 # password. Try kerberos, then try plain unix password.
47 login auth sufficient pam_skey.so
48 login auth sufficient pam_opie.so no_fake_prompts
49 #login auth requisite pam_opieaccess.so
50 login auth requisite pam_cleartext_pass_ok.so
51 #login auth sufficient pam_kerberosIV.so try_first_pass
52 #login auth sufficient pam_krb5.so try_first_pass
53 login auth required pam_unix.so try_first_pass
54 login account required pam_unix.so
55 login password required pam_permit.so
56 login session required pam_permit.so
58 # Same requirement for ftpd as login
59 ftpd auth sufficient pam_skey.so
60 ftpd auth sufficient pam_opie.so no_fake_prompts
61 #ftpd auth requisite pam_opieaccess.so
62 ftpd auth requisite pam_cleartext_pass_ok.so
63 #ftpd auth sufficient pam_kerberosIV.so try_first_pass
64 #ftpd auth sufficient pam_krb5.so try_first_pass
65 ftpd auth required pam_unix.so try_first_pass
67 # OpenSSH with PAM support requires similar modules. The session one is
68 # a bit strange, though...
69 sshd auth sufficient pam_skey.so
70 sshd auth sufficient pam_opie.so no_fake_prompts
71 #sshd auth requisite pam_opieaccess.so
72 #sshd auth sufficient pam_kerberosIV.so try_first_pass
73 #sshd auth sufficient pam_krb5.so try_first_pass
74 sshd auth required pam_unix.so try_first_pass
75 sshd account required pam_unix.so
76 sshd password required pam_permit.so
77 sshd session required pam_permit.so
79 # "telnetd" is for SRA authenticated telnet only. Non-SRA uses 'login'
80 telnetd auth required pam_unix.so try_first_pass
83 xserver auth required pam_permit.so
85 # XDM is difficult; it fails or moans unless there are modules for each
86 # of the four management groups; auth, account, session and password.
87 xdm auth required pam_unix.so
88 #xdm auth sufficient pam_kerberosIV.so try_first_pass
89 #xdm auth sufficient pam_krb5.so try_first_pass
90 xdm account required pam_unix.so try_first_pass
91 xdm session required pam_deny.so
92 xdm password required pam_deny.so
94 # GDM (GNOME Display Manager)
95 gdm auth required pam_unix.so
96 #gdm auth sufficient pam_kerberosIV.so try_first_pass
97 #gdm auth sufficient pam_krb5.so try_first_pass
98 gdm account required pam_unix.so try_first_pass
99 gdm session required pam_permit.so
100 gdm password required pam_deny.so
103 imap auth required pam_unix.so try_first_pass
104 pop3 auth required pam_unix.so try_first_pass
106 # If we don't match anything else, default to using getpwnam().
107 other auth sufficient pam_skey.so
108 other auth required pam_unix.so try_first_pass
109 other account required pam_unix.so try_first_pass