Date: Tue, 30 Jan 2001 19:49:01 -0500 From: "Brian F. Feldman" <green@FreeBSD.org> To: Robert Watson <rwatson@FreeBSD.org> Cc: green@FreeBSD.org, security@FreeBSD.org Subject: Re: PAM/SSH and KerberosIV? Message-ID: <200101310049.f0V0n1f15852@green.dyndns.org> In-Reply-To: Message from Robert Watson <rwatson@FreeBSD.org> of "Tue, 30 Jan 2001 19:30:57 EST." <Pine.NEB.3.96L.1010130192901.29561F-100000@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Robert Watson <rwatson@FreeBSD.org> wrote: > > I notice that as part of the PAM/OpenSSH support, the following lines were > added to the pam.conf on -STABLE: > > # OpenSSH with PAM support requires similar modules. The session one is > # a bit strange, though... > sshd auth sufficient pam_skey.so > sshd auth required pam_unix.so try_first_pass > sshd session required pam_permit.so > > For most sets of entries, there's also a kerberos line (witness login): > > # If the user can authenticate with S/Key, that's sufficient; allow clear > # password. Try kerberos, then try plain unix password. > login auth sufficient pam_skey.so > login auth requisite pam_cleartext_pass_ok.so > #login auth sufficient pam_kerberosIV.so try_first_pass > login auth required pam_unix.so try_first_pass > > Which gets un-commented for Kerberos sites. Could you comment on whether > or not a similar looking line is required for use with KerberosIV and > OpenSSH? I don't know. I do not have the capacity to test Kerberos without going through the trouble of setting it up for only myself only on my own computer, which would be an exercise in utterly profound useless effort. So, anyone who does it, let me know if it works for you and how. BTW, you ever test the make-ssh-use-/dev/tty-to-ask-for-OTP patch? -- Brian Fundakowski Feldman \ FreeBSD: The Power to Serve! / green@FreeBSD.org `------------------------------' To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200101310049.f0V0n1f15852>