NCSA: Kerberos PAM Configuration

Kerberos PAM Configuration

This document is for configuring PAM to accept kerberos password authentication. Please read through these instructions once before installing so you are familiar with some of the setup options. The commands shown below will need to be executed as "root". If there are any questions or problems with this document, or an installation, then please contact kerberos@ncsa.uiuc.edu.

Kerberos PAM setup
This option will allow you to log in remotely or into the console with your Kerberos/AFS password. It will also get you a kerberos ticket when logging in.

First make sure that you have a pam_krb5 rpm installed. Run "rpm -qa | grep pam" and see if the pam_krb5 shows up. It should look something like pam_krb5-1.46-1. If it's not installed then you can install a version from the linux.ncsa.uiuc.edu ftp server (contact your system administrator if you have problems doing this).

Note:
Newer version of PAM use the system-auth as the master configuration file. If you are using an older version you will need to add the following lines to the appropriate PAM file (login, sshd, etc.).

Add the following line to the /etc/pam.d/system-auth file in the auth section. It should go directly after the pam_unix.so line (or after the afs line as in the sample file).

auth        sufficient    /lib/security/pam_krb5.so use_first_pass forwardable

Add the following line to the /etc/pam.d/system-auth file in the password section directly under the pam_unix.so line.

password    sufficient    /lib/security/pam_krb5.so use_authtok

Add the following line to the /etc/pam.d/system-auth file in the session section directly under the pam_unix.so line.

session     optional      /lib/security/pam_krb5.so

Once these are done your configuration file should look something like this sample system-auth file.

Note:
The order of the libraries in each section (auth, password, session) is important.

Back to NCSA Kerberos Information

Question or comments about this page may be sent to Kerberos@ncsa.uiuc.edu