| 1 | '\" t
|
|---|
| 2 | .\" Title: pam_winbind
|
|---|
| 3 | .\" Author: [see the "AUTHOR" section]
|
|---|
| 4 | .\" Generator: DocBook XSL Stylesheets v1.75.2 <http://docbook.sf.net/>
|
|---|
| 5 | .\" Date: 08/08/2011
|
|---|
| 6 | .\" Manual: 8
|
|---|
| 7 | .\" Source: Samba 3.6
|
|---|
| 8 | .\" Language: English
|
|---|
| 9 | .\"
|
|---|
| 10 | .TH "PAM_WINBIND" "8" "08/08/2011" "Samba 3\&.6" "8"
|
|---|
| 11 | .\" -----------------------------------------------------------------
|
|---|
| 12 | .\" * set default formatting
|
|---|
| 13 | .\" -----------------------------------------------------------------
|
|---|
| 14 | .\" disable hyphenation
|
|---|
| 15 | .nh
|
|---|
| 16 | .\" disable justification (adjust text to left margin only)
|
|---|
| 17 | .ad l
|
|---|
| 18 | .\" -----------------------------------------------------------------
|
|---|
| 19 | .\" * MAIN CONTENT STARTS HERE *
|
|---|
| 20 | .\" -----------------------------------------------------------------
|
|---|
| 21 | .SH "NAME"
|
|---|
| 22 | pam_winbind \- PAM module for Winbind
|
|---|
| 23 | .SH "DESCRIPTION"
|
|---|
| 24 | .PP
|
|---|
| 25 | This tool is part of the
|
|---|
| 26 | \fBsamba\fR(7)
|
|---|
| 27 | suite\&.
|
|---|
| 28 | .PP
|
|---|
| 29 | pam_winbind is a PAM module that can authenticate users against the local domain by talking to the Winbind daemon\&.
|
|---|
| 30 | .SH "SYNOPSIS"
|
|---|
| 31 | .PP
|
|---|
| 32 | Edit the PAM system config /etc/pam\&.d/service and modify it as the following example shows:
|
|---|
| 33 | .sp
|
|---|
| 34 | .if n \{\
|
|---|
| 35 | .RS 4
|
|---|
| 36 | .\}
|
|---|
| 37 | .nf
|
|---|
| 38 | \&.\&.\&.
|
|---|
| 39 | auth required pam_env\&.so
|
|---|
| 40 | auth sufficient pam_unix2\&.so
|
|---|
| 41 | +++ auth required pam_winbind\&.so use_first_pass
|
|---|
| 42 | account requisite pam_unix2\&.so
|
|---|
| 43 | +++ account required pam_winbind\&.so use_first_pass
|
|---|
| 44 | +++ password sufficient pam_winbind\&.so
|
|---|
| 45 | password requisite pam_pwcheck\&.so cracklib
|
|---|
| 46 | password required pam_unix2\&.so use_authtok
|
|---|
| 47 | session required pam_unix2\&.so
|
|---|
| 48 | +++ session required pam_winbind\&.so
|
|---|
| 49 | \&.\&.\&.
|
|---|
| 50 |
|
|---|
| 51 | .fi
|
|---|
| 52 | .if n \{\
|
|---|
| 53 | .RE
|
|---|
| 54 | .\}
|
|---|
| 55 | .sp
|
|---|
| 56 | Make sure that pam_winbind is one of the first modules in the session part\&. It may retrieve kerberos tickets which are needed by other modules\&.
|
|---|
| 57 | .SH "OPTIONS"
|
|---|
| 58 | .PP
|
|---|
| 59 | pam_winbind supports several options which can either be set in the PAM configuration files or in the pam_winbind configuration file situated at
|
|---|
| 60 | /etc/security/pam_winbind\&.conf\&. Options from the PAM configuration file take precedence to those from the configuration file\&. See
|
|---|
| 61 | \fBpam_winbind.conf\fR(5)
|
|---|
| 62 | for further details\&.
|
|---|
| 63 | .PP
|
|---|
| 64 | debug
|
|---|
| 65 | .RS 4
|
|---|
| 66 | Gives debugging output to syslog\&.
|
|---|
| 67 | .RE
|
|---|
| 68 | .PP
|
|---|
| 69 | debug_state
|
|---|
| 70 | .RS 4
|
|---|
| 71 | Gives detailed PAM state debugging output to syslog\&.
|
|---|
| 72 | .RE
|
|---|
| 73 | .PP
|
|---|
| 74 | require_membership_of=[SID or NAME]
|
|---|
| 75 | .RS 4
|
|---|
| 76 | If this option is set, pam_winbind will only succeed if the user is a member of the given SID or NAME\&. A SID can be either a group\-SID, an alias\-SID or even an user\-SID\&. It is also possible to give a NAME instead of the SID\&. That name must have the form:
|
|---|
| 77 | \fIMYDOMAIN\e\emygroup\fR
|
|---|
| 78 | or
|
|---|
| 79 | \fIMYDOMAIN\e\emyuser\fR\&. pam_winbind will, in that case, lookup the SID internally\&. Note that NAME may not contain any spaces\&. It is thus recommended to only use SIDs\&. You can verify the list of SIDs a user is a member of with
|
|---|
| 80 | wbinfo \-\-user\-sids=SID\&.
|
|---|
| 81 | .RE
|
|---|
| 82 | .PP
|
|---|
| 83 | use_first_pass
|
|---|
| 84 | .RS 4
|
|---|
| 85 | By default, pam_winbind tries to get the authentication token from a previous module\&. If no token is available it asks the user for the old password\&. With this option, pam_winbind aborts with an error if no authentication token from a previous module is available\&.
|
|---|
| 86 | .RE
|
|---|
|
|---|
