1 .\" Copyright (c) 2001 Mark R V Murray
2 .\" All rights reserved.
3 .\" Copyright (c) 2001-2003 Networks Associates Technology, Inc.
4 .\" All rights reserved.
6 .\" This software was developed for the FreeBSD Project by ThinkSec AS and
7 .\" NAI Labs, the Security Research Division of Network Associates, Inc.
8 .\" under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
9 .\" DARPA CHATS research program.
11 .\" Redistribution and use in source and binary forms, with or without
12 .\" modification, are permitted provided that the following conditions
14 .\" 1. Redistributions of source code must retain the above copyright
15 .\" notice, this list of conditions and the following disclaimer.
16 .\" 2. Redistributions in binary form must reproduce the above copyright
17 .\" notice, this list of conditions and the following disclaimer in the
18 .\" documentation and/or other materials provided with the distribution.
19 .\" 3. The name of the author may not be used to endorse or promote
20 .\" products derived from this software without specific prior written
23 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 .\" $FreeBSD: src/lib/libpam/modules/pam_ssh/pam_ssh.8,v 1.14 2005/09/22 05:35:24 des Exp $
36 .\" $DragonFly: src/lib/pam_module/pam_ssh/pam_ssh.8,v 1.1 2005/07/12 23:26:49 joerg Exp $
43 .Nd authentication and session management with SSH private keys
53 authentication service module for PAM,
55 provides functionality for two PAM categories:
57 and session management.
60 parameter, they are the
65 .Ss SSH Authentication Module
68 authentication component
69 provides a function to verify the identity of a user
70 .Pq Fn pam_sm_authenticate ,
71 by prompting the user for a passphrase and verifying that it can
72 decrypt the target user's SSH key using that passphrase.
74 The following options may be passed to the authentication module:
75 .Bl -tag -width ".Cm use_first_pass"
77 If the authentication module
78 is not the first in the stack,
80 obtained the user's password,
82 to authenticate the user.
84 the authentication module returns failure
85 without prompting the user for a password.
86 This option has no effect
87 if the authentication module
88 is the first in the stack,
89 or if no previous modules
90 obtained the user's password.
92 This option is similar to the
95 except that if the previously obtained password fails,
96 the user is prompted for another password.
98 Normally, keys with no passphrase are ignored for authentication
100 If this option is set, keys with no passphrase will be taken into
101 consideration, allowing the user to log in with a blank password.
103 .Ss SSH Session Management Module
106 session management component
107 provides functions to initiate
108 .Pq Fn pam_sm_open_session
110 .Pq Fn pam_sm_close_session
113 .Fn pam_sm_open_session
114 function starts an SSH agent,
115 passing it any private keys it decrypted
116 during the authentication phase,
117 and sets the environment variables
120 .Fn pam_sm_close_session
121 function kills the previously started SSH agent
125 The following options may be passed to the session management module:
126 .Bl -tag -width ".Cm want_agent"
128 Start an agent even if no keys were decrypted during the
129 authentication phase.
132 .Bl -tag -width ".Pa $HOME/.ssh/identity" -compact
133 .It Pa $HOME/.ssh/identity
135 .It Pa $HOME/.ssh/id_rsa
137 .It Pa $HOME/.ssh/id_dsa
147 module was originally written by
149 .An "Andrew J. Korty" Aq ajk@iu.edu .
150 The current implementation was developed for the
153 ThinkSec AS and NAI Labs, the Security Research Division of Network
154 Associates, Inc.\& under DARPA/SPAWAR contract N66001-01-C-8035
156 as part of the DARPA CHATS research program.
157 This manual page was written by
158 .An "Mark R V Murray" Aq markm@FreeBSD.org .