$FreeBSD$ This is the README for pam_krb5, a PAM module which support Kerberos 5 authentication. This software is Copyright (c) 1999-2000 Frank Cusack. All Rights Reserved. See the COPYRIGHT file, included with this distribution, for copyright and redistribution information. Author: Frank Cusack I. Kerberos notes This PAM module requires the MIT 1.1+ release of Kerberos, or the Cygnus CNS distribution. It has not been tested against heimdal or any other Kerberos distributions. Unlike other PAM Kerberos 5 modules out there, this one does not use any private Kerberos interfaces. Thus, you need only the header files and libraries that are part of the Kerberos distribution. II. OS notes This software has been tested against Solaris 2.6. It should compile against Linux (distributions?) with minimal (if any) changes. Reports of OS [in]compatibilities are welcomed. dtlogin on Solaris doesn't support xrealm logins (probably a good thing). III. PAM notes/open issues auth module: When is pam_sm_setcred() ever called with flags other than PAM_ESTABLISH_CRED? It would be fairly easy to support PAM_DELETE_CRED. acct module: I believe this to be complete. session module: This is complete (both functions just return success). passwd module: When is pam_sm_chauthtok() ever called with flags other than PAM_UPDATE_AUTHTOK? IV. Usage Simply change /etc/pam.conf to include this module. Make sure to include the acct category whenever you use the auth category, or .k5login will not get checked. You probably want to make this module "sufficient", before your unix (or other) module(s). V. Acknowledgements Thanks to Naomaru Itoi , Curtis King , and Derrick Brashear , all of whom have written and made available Kerberos 4/5 modules. Although no code in this module is directly from these author's modules, (except the get_user_info() routine in support.c; derived from whichever of these authors originally wrote the first module the other 2 copied from), it was extremely helpful to look over their code which aided in my design.