pam_ldap(8)
pam_ldap - Lightweight Directory Access Protocol PAM Service Module
As shipped in IRIX 6.5.30. Added in IRIX 6.5.22.
NAME pam_ldap - Lightweight Directory Access Protocol PAM Service Module SYNOPSIS /usr/lib32/security/pam_ldap.so DESCRIPTION The LDAP service module for PAM, /usr/lib32/security/pam_ldap.so, provides functionality for three PAM categories: authentication, account management, and password management. It also provides null functions for session management. The pam_ldap.so module is a shared object that can be dynamically loaded to provide the necessary functionality upon demand. Its path is specified in the PAM configuration file. Authentication Component The LDAP authentication component provides functions to verify the identity of a user. (pam_sm_authenticate()) and to set user specific credentials (pam_sm_setcred()). Account Management Component The LDAP account management component provides a function to perform account management, pam_sm_acct_mgmt(). The function verifies that the authenticated user is allowed to login to the local user account. Password Management Component The LDAP password management component provides a function to change user passwords (pam_sm_chauthtok()). In addition to the options accepted by all the LDAP service module components (see below), the password management component also accepts: use_authtok Session Management Component The LDAP session management component provides functions to initiate (pam_sm_open_session()) and terminate (pam_sm_close_session()) sessions. Since session management is not defined under LDAP, both of these functions simply return success. Additionally, the former will close any outstanding network connections. LDAP Service Module Configuration The LDAP PAM service module is configured in two parts. Its behavior inside the PAM stack is configured by passing parameters through the standard PAM configuration mechanisms (/etc/pam.conf or /etc/pam.d/, see PAM(8) ). Its behavior in contacting and querying an LDAP server is configured in a separate file (/etc/security/pam_ldap.conf). The following PAM options may be passed to the all of the LDAP service module components: config=filename Use filename as the pam_ldap configuration file instead of /etc/security/pam_ldap.conf. filename must specify the absolute path to the configuration file. debug This option makes pam_ldap print debugging information. This is not recommended for production systems. ignore_unknown_user If this option is set and the user's details are not found in the LDAP directory, the component returns ignore to the PAM framework, rather than user_unknown (see PAM(8) for details). no_warn Instructs the component not to give warning messages to the user via the calling application. use_first_pass If the authentication component is not the first in the stack, and a previous module obtained the user's password, that password is used to authenticate the user. If this fails, the authentication component returns failure without prompting the user for a password. This option has no effect if the authentication module is the first in the stack, or if no previous modules obtained the user's password. try_first_pass This option is similar to the use_first_pass option, except that if the previously obtained password fails, the user is prompted for another password. The pam_ldap configuration file has the same syntax as the LDAP client configuration file, /etc/openldap/ldap.conf (see ldap.conf(5) ). This, in conjunction with the config=filename PAM option, lets you share LDAP settings between pam_ldap and other LDAP clients. pam_ldap silently ignores any unrecognized options in its configuration file. The following options are recognized: base dn dn is the distinguished name used as the base for LDAP searches. binddn dn dn is the distinguished name used to bind with the LDAP server. bindpw secret Specifies secret as the credential to bind with when not binding as root. bind_timelimit secs This option specifies secs as the maximum number to seconds to spend waiting for the LDAP server to accept(2) a TCP connection. host list This option specifies the name of the LDAP server(s) to use. list must be a space- separated list of hostnames or addresses. ldap_version version Specifies the version of the LDAP protocol to use. version must be either 2 or 3. Version 3 is the default. nss_base_passwd dn[?scope[?filter]] The options specifies the base distinguished name for password entry searches. If the distinguished name, dn is not fully qualified (eg. "ou=People,"), the distinguighed name from the base option is appended. dn may be followed by a scope specifier and a filter, each separated by question marks. scope can take the same values as the scope option. filter has the same semantics as the pam_filter option. pam_check_host_attr yes|no If this option is "yes", pam_ldap will test for the existence of the "host" attribute in the directory entry for the authenticating user. Access will be allowed only if the "host" attribute is present and specifies that the authenticating host should be allowed. The "host" attribute should contain "*" to indicate that users can authenticate from any host, otherwise it should contain the hostnames the user is allowed to authenticate from (one name per "host" attribute). pam_filter filter This option specifies the initial condition of the search filter used to retrieve user account information from the LDAP server. For example, if the query needed to retrieve account information for the user "phillis" was "(&(objectClass=posixAccount)(uid=phillis))", then filter must be set to "objectClass=posixAccount". pam_groupdn dn If this option is set, pam_ldap does not allow access unless the user is a member of a given group. dn is the distinguished name of the group object in the directory and the pam_member_attribute option specifies the attribute that contains the names of the group members. pam_login_attribute attr This option specifies the name of the attribute matched when searching for user account information. The default value for attr is "uid". pam_lookup_policy yes|no If this option is "yes", pam_ldap will search the directory for a passwordPolicy object that specifies the maximum number of password entry failures and minimum password length. pam_max_uid n If the user ID of the authenticating user is greater than n, pam_ldap will deny access. pam_member_attribute attr If the pam_groupdn option is set, pam_ldap denies access unless the distinguished name of the authenticating user is present in the attribute attr belonging to the group object specified by the pam_groupdn option. The default value for attr is "uniquemember". pam_min_uid n If the user ID of the authenticating user is less than n, pam_ldap will deny access. pam_password clear|crypt|nds|ad|exop This options tells pam_ldap how passwords how to handle passwords when sending them to the directory server. If is it set to "crypt", the password is hashed locally with the crypt(3) function. "nds" forces removal of the old password before setting the new one. "ad" enables resetting passwords in an Active Directory server. "exop" uses LDAPv3 MODIFY_PASSWD extended operation to update the user's password. "clear" sends the password in the clear. pam_password_prohibit_message message This option prohibits password changes by LDAP users and displays an explanatory message. pam_template_login user Reset the PAM_USER item to user after authenticating with the provided user name. pam_template_login_attribute attr Take the value of pam_template_login from the PAM item attr. port n This option specifies the port to contact the LDAP server on. The default is 389, or 636 if SSL is in use. If the uri option is set, this option is ignored. restart yes|no This option makes pam_ldap automatically restart an interrupted communication with the LDAP server. It is on by default. rootbinddn dn If this option is specified, and effective user ID of the calling process is 0, pam_ldap will attempt to bind to the LDAP directory with the distinguished name dn instead of the one given by the binddn option. The password to bind with is read from /etc/security/pam_ldap.secret. This file should be owned by root and have 0600 permissions. ssl start_tls|on Setting this option to "start_tls" makes pam_ldap use the Start TLS LDAPv3 extended operation to establish a TLS session with the LDAP server. Setting this option to "ssl" makes pam_ldap unconditionally connect to the LDAP server using SSL. scope base|one|sub This option specifies the scope that is used when searching the LDAP directory. timelimit secs This option specifies secs as the maximum number of seconds to spend on a search. tls_cacertdir path Specifies a directory where pam_ldap can find CA certificates to use for server verification in separate files. tls_cacertfile filename Specifies a single file where pam_ldap can find CA certificates to use for server verification. tls_cert filename Specifies the file that contains the client certificate. tls_ciphers cipher This option specifies which encryption ciphers can be used to connect to the LDAP server. cipher is a colon-separated list of encryption cipher names. See ciphers(1) for full details of the format of the cipher string. tls_checkpeer yes|no If this option is "yes", pam_ldap will require that the LDAP server produce a valid TLS certificate. If it is false, server certificates will be neither requested nor checked. tls_key filename Specifies the file that contains the private key that matches the certificate in the file named by the tls_cert option. tls_randfile filename Specifies the file to obtain random bits from when /dev/[u]random is not available. uri server This option specifies the LDAP server as an RFC 2255 LDAP URL. If this option is specified, server is used as the LDAP server instead of the host and port specified by the host and port options. FILES /etc/security/pam_ldap.conf /etc/security/pam_ldap.secret SEE ALSO crypt(3), cipher(1), ldap.conf(5), pam(8), syslog(3). NOTES There is no way to specify a root password file different from /etc/security/pam_ldap.secret.