1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
|
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
"http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd">
<!--
pam_ldap.8.xml - docbook manual page for pam_ldap PAM module
Copyright (C) 2009-2014 Arthur de Jong
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA
-->
<refentry id="pamldap8">
<refentryinfo>
<author>
<firstname>Arthur</firstname>
<surname>de Jong</surname>
</author>
</refentryinfo>
<refmeta>
<refentrytitle>pam_ldap</refentrytitle>
<manvolnum>8</manvolnum>
<refmiscinfo class="version">Version 0.9.4</refmiscinfo>
<refmiscinfo class="manual">System Manager's Manual</refmiscinfo>
<refmiscinfo class="date">Jun 2014</refmiscinfo>
</refmeta>
<refnamediv id="name">
<refname>pam_ldap</refname>
<refpurpose>PAM module for LDAP-based authentication</refpurpose>
</refnamediv>
<refsynopsisdiv id="synopsis">
<cmdsynopsis>
<command>pam_ldap.so</command>
<arg choice="opt"><replaceable>...</replaceable></arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1 id="description">
<title>Description</title>
<para>
This is a <acronym>PAM</acronym> module that uses an
<acronym>LDAP</acronym> server to verify user access rights and
credentials.
</para>
</refsect1>
<refsect1 id="options">
<title>Options</title>
<variablelist remap="TP">
<varlistentry id="use_first_pass">
<term>
<option>use_first_pass</option>
</term>
<listitem>
<para>
Specifies that the <acronym>PAM</acronym> module should use the first
password provided in the authentication stack and not prompt the user
for a password.
</para>
</listitem>
</varlistentry>
<varlistentry id="try_first_pass">
<term>
<option>try_first_pass</option>
</term>
<listitem>
<para>
Specifies that the <acronym>PAM</acronym> module should use the first
password provided in the authentication stack and if that fails prompt
the user for a password.
</para>
</listitem>
</varlistentry>
<varlistentry id="nullok">
<term>
<option>nullok</option>
</term>
<listitem>
<para>
Specifying this option allows users to log in with a blank password.
Normally logins without a password are denied.
</para>
</listitem>
</varlistentry>
<varlistentry id="ignore_unknown_user">
<term>
<option>ignore_unknown_user</option>
</term>
<listitem>
<para>
Specifies that the <acronym>PAM</acronym> module should return
PAM_IGNORE for users that are not present in the <acronym>LDAP</acronym>
directory.
This causes the <acronym>PAM</acronym> framework to ignore this module.
</para>
</listitem>
</varlistentry>
<varlistentry id="ignore_authinfo_unavail">
<term>
<option>ignore_authinfo_unavail</option>
</term>
<listitem>
<para>
Specifies that the <acronym>PAM</acronym> module should return
PAM_IGNORE if it cannot contact the <acronym>LDAP</acronym> server.
This causes the <acronym>PAM</acronym> framework to ignore this module.
</para>
</listitem>
</varlistentry>
<varlistentry id="no_warn">
<term>
<option>no_warn</option>
</term>
<listitem>
<para>
Specifies that warning messages should not be propagated to the
<acronym>PAM</acronym> application.
</para>
</listitem>
</varlistentry>
<varlistentry id="use_authtok">
<term>
<option>use_authtok</option>
</term>
<listitem>
<para>
This causes the <acronym>PAM</acronym> module to use the earlier
provided password when changing the password. The module will not
prompt the user for a new password (it is analogous to
<option>use_first_pass</option>).
</para>
</listitem>
</varlistentry>
<varlistentry id="debug">
<term>
<option>debug</option>
</term>
<listitem>
<para>
This option causes the <acronym>PAM</acronym> module to log debugging
information to
<citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
</para>
</listitem>
</varlistentry>
<varlistentry id="minimum_uid">
<term>
<option>minimum_uid=<replaceable>UID</replaceable></option>
</term>
<listitem>
<para>
This option causes the <acronym>PAM</acronym> module to ignore the user
if the user id is lower than the specified value. This can be used to
bypass <acronym>LDAP</acronym> checks for system users
(e.g. by setting it to <literal>1000</literal>).
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1 id="moduleservices">
<title>Module Services Provided</title>
<para>
All services are provided by this module but currently sessions changes
are not implemented in the nslcd daemon.
</para>
</refsect1>
<refsect1 id="files">
<title>Files</title>
<variablelist remap="TP">
<varlistentry>
<term><filename>/etc/pam.conf</filename></term>
<listitem><para>the main PAM configuration file</para></listitem>
</varlistentry>
<varlistentry>
<term><filename>/etc/nslcd.conf</filename></term>
<listitem><para>
The configuration file for the <command>nslcd</command> daemon
(see <citerefentry><refentrytitle>nslcd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
</para></listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1 id="see_also">
<title>See Also</title>
<para>
<citerefentry><refentrytitle>pam.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>nslcd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry><refentrytitle>nslcd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
</para>
</refsect1>
<refsect1 id="author">
<title>Author</title>
<para>
This manual was written by Arthur de Jong <arthur@arthurdejong.org>.
</para>
</refsect1>
</refentry>
|
