HP-UX Reference (11i v1 00/12) - 5 Miscellaneous Topics, 7 Device (Special) Files, 9 General Information, Index (vol 9)
__________________________________________________________________________________________________________________________________________________________________________________________________
__________________________________________________________________________________________________________________________________________________________________________________________________
STANDARD Printed by: Nora Chuang [nchuang] STANDARD
/build/1111/BRICK/man5/!!!intro.5
________________________________________________________________
___ ___
p
pam_unix(5) pam_unix(5)
NAME
pam_unix - authentication, account, session, and password management PAM modules for UNIX
SYNOPSIS
/usr/lib/security/libpam_unix.1
DESCRIPTION
The UNIX service module for PAM, /usr/lib/security/libpam_unix.1, provides functionality
for all four PAM modules: authentication, account management, session management and password
management.
The libpam_unix.1 module is a shared object that can be dynamically loaded to provide the necessary
functionality upon demand. Its path is specified in the PAM configuration file.
Unix Authentication Module
The UNIX authentication component provides functions to verify the identity of a user,
(pam_sm_authenticate()) and to set user specific credentials (pam_sm_setcred()).
pam_sm_authenticate()
compares the user entered password (or password retrieved from the user’s
smart card) with the password from UNIX password database, including the protected password database
for trusted systems. If the passwords match, the user is authenticated. If the user also has secure RPC
credentials and the secure RPC password is the same as the UNIX password, then the secure RPC creden-
tials are also obtained.
The following options may be passed to the UNIX service module:
debug syslog(3C) debugging information at LOG_DEBUG level.
nowarn Turn off warning messages.
use_first_pass
It compares the password in the password database with the user’s initial password
(entered when the user authenticated to the first authentication module in the stack). If
the passwords do not match, or if no password has been entered, quit and do not prompt
the user for a password. This option should only be used if the authentication service is
designated as optional in the pam.conf configuration file.
try_first_pass
It compares the password in the password database with the user’s initial password
(entered when the user authenticated to the first authentication module in the stack). If
the passwords do not match, or if no password has been entered, prompt the user for a
password.
use_psd psd stands for personal security device, for the current implementation there is only one
security device: the smart card. It compares the password in the password database
with the password stored on the user’s smart card. With this option the PAM Frame-
work prompt "Enter PIN:" is used instead of the password prompt. This option is only
supported with the authentication or password module types (auth, password) services
in the
pam.conf or in the pam_user.conf configuration files.
When prompting for the current password, the UNIX authentication module will use the prompt, "Pass-
word:" unless one of the following scenarios occur:
1. The option try_first_pass
is specified and the password entered for the first module in the
stack fails for the UNIX module.
2. The option
try_first_pass is not specified, and the earlier authentication modules listed in
the pam.conf file have prompted the user for the password.
3. The option use_psd is specified. In this case, the UNIX authentication module will use the
prompt "Enter PIN:".
In cases 1 and 2, the UNIX authentication module will use the prompt "System Password:".
The pam_sm_setcred() function sets user specific credentials. If the user had secure RPC credentials,
but the secure RPC password was not the same as the UNIX password, then a warning message is printed.
If the user wants to get secure RPC credentials, then keylogin(1) needs to be run.
HP-UX Release 11i: December 2000 − 1 − Section 5−−99
___
___