PAM Kerberos v 1.24 Release Notes

Known Problems and Limitations
Following are the known problems and limitations in PAM Kerberos v 1.24:
• If a kernel threaded DCE application linking to libdcekt uses PAM Kerberos
for authentication, it results in core dump. This occurs because of a symbol clash
between PAM Kerberos and DCE kernel threads. HP has fixed PAM Kerberos v
1.24 and Kerberos Client C.1.3.5.05 to avoid this core dump. However, you must
also install linker patch PHSS_28871 or its superseding patches to resolve this
defect.
If you are using PAM Kerberos on HP-UX 11i v3, you do not have to install the
PHSS_28871 linker patch. The core Kerberos Client on HP-UX 11i v3 is also fixed
to resolve this defect.
NOTE: This workaround is available in HP-UX 11i v1 and HP-UX 11i v3 operating
systems only.
• The Kerberos system ftp service may list the /etc/issue file before the expected
output. For more information on Secure Internet Services (SIS), see the sis( 5)
manpage.
• If the password expires on a Microsoft Windows 2000 KDC, PAM Kerberos displays
a message stating that the account has expired. However, PAM Kerberos does not
prompt for a new password.
• Stacking PAM Kerberos v 1.24 module (libpam_krb5.1 on HP-UX 11i v1 and
libpam_krb5.so.1 on HP-UX 11i v2) and DCE plug-in module (libpam_dce.1
on HP-UX 11i v1 and libpam_dce.so.1 on HP-UX 11i v2) in the pam.conf file
can produce unpredictable results.
The PAM Kerberos v 1.24 module and the DCE module use a different principal
style and a different credential file path. For the principal style, the DCE Kerberos
module uses the cell name, whereas PAM Kerberos v 1.24 uses the realm name.
For the credential cache file, DCE Kerberos stores its credentials in the
/var/opt/dce/creds directory, while PAM Kerberos v 1.24 stores them in the
/tmp/pam_krb5/creds directory.
• HP-UX 64-bit PAM delivers 64-bit versions of the PAM libraries to support 64-bit
PAM applications on some configurations of the HP-UX 11i v1 operating system.
Consider the following limitations before using the 64-bit PAM libraries on an
HP-UX 11i v1 operating system:
— The 64-bit PAM libraries can be installed only on HP-UX 11iv1 systems that
support 64-bit applications.
— The 64-bit PAM libraries do not support 64-bit PAM applications in
configurations containing NIS, NIS+, or LDAP.
Per user configuration is not applicable on a 64-bit platform, because the 64-bit
PAM product does not support the libpam_updbe.1 library. For the 64-bit PAM
Known Problems and Limitations 15