1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <refentry id="pam_winbind.conf.5">
6 <refentrytitle>pam_winbind.conf</refentrytitle>
7 <manvolnum>5</manvolnum>
8 <refmiscinfo class="source">Samba</refmiscinfo>
9 <refmiscinfo class="manual">5</refmiscinfo>
10 <refmiscinfo class="version">4.0</refmiscinfo>
15 <refname>pam_winbind.conf</refname>
16 <refpurpose>Configuration file of PAM module for Winbind</refpurpose>
20 <title>DESCRIPTION</title>
22 <para>This configuration file is part of the <citerefentry><refentrytitle>samba</refentrytitle>
23 <manvolnum>7</manvolnum></citerefentry> suite.</para>
26 pam_winbind.conf is the configuration file for the pam_winbind PAM
28 <citerefentry><refentrytitle>pam_winbind</refentrytitle><manvolnum>8</manvolnum></citerefentry>
34 <title>SYNOPSIS</title>
37 The pam_winbind.conf configuration file is a classic ini-style
38 configuration file. There is only one section (global) where
39 various options are defined.
44 <title>OPTIONS</title>
47 pam_winbind supports several options which can either be set in
48 the PAM configuration files or in the pam_winbind configuration
50 <filename>/etc/security/pam_winbind.conf</filename>. Options
51 from the PAM configuration file take precedence to those from
52 the pam_winbind.conf configuration file.
57 <term>debug = yes|no</term>
58 <listitem><para>Gives debugging output to syslog. Defaults to "no".</para></listitem>
62 <term>debug_state = yes|no</term>
63 <listitem><para>Gives detailed PAM state debugging output to syslog. Defaults to "no".</para></listitem>
67 <term>require_membership_of = [SID or NAME]</term>
69 If this option is set, pam_winbind will only succeed if the user is a member of the given SID or NAME. A SID
70 can be either a group-SID, an alias-SID or even an user-SID. It is also possible to give a NAME instead of the
71 SID. That name must have the form: <parameter>MYDOMAIN\\mygroup</parameter> or
72 <parameter>MYDOMAIN\\myuser</parameter>. pam_winbind will, in that case, lookup the SID internally. Note that
73 NAME may not contain any spaces. It is thus recommended to only use SIDs. You can verify the list of SIDs a
74 user is a member of with <command>wbinfo --user-sids=SID</command>. This setting is empty by default.
79 <term>try_first_pass = yes|no</term>
81 By default, pam_winbind tries to get the authentication token from a previous module. If no token is available
82 it asks the user for the old password. With this option, pam_winbind aborts with an error if no authentication
83 token from a previous module is available. If a primary password is not valid, PAM will prompt for a password.
89 <term>krb5_auth = yes|no</term>
92 pam_winbind can authenticate using Kerberos when winbindd is
93 talking to an Active Directory domain controller. Kerberos
94 authentication must be enabled with this parameter. When
95 Kerberos authentication can not succeed (e.g. due to clock
96 skew), winbindd will fallback to samlogon authentication over
97 MSRPC. When this parameter is used in conjunction with
98 <parameter>winbind refresh tickets</parameter>, winbind will
99 keep your Ticket Granting Ticket (TGT) uptodate by refreshing
100 it whenever necessary. Defaults to "no".
106 <term>krb5_ccache_type = [type]</term>
109 When pam_winbind is configured to try kerberos authentication by
110 enabling the <parameter>krb5_auth</parameter> option, it can
111 store the retrieved Ticket Granting Ticket (TGT) in a credential
112 cache. The type of credential cache can be controlled with this
113 option. The supported values are: <parameter>FILE</parameter>
114 and <parameter>DIR</parameter> (when the DIR type is supported
115 by the system's Kerberos library). In case of FILE a credential
116 cache in the form of /tmp/krb5cc_UID will be created - in case
117 of DIR it will be located under the /run/user/UID/krb5cc
118 directory. UID is replaced with the numeric user id.</para>
120 <para>It is also possible to define custom filepaths and use the "%u"
121 pattern in order to substitue the numeric user id.
126 <term>krb5_ccache_type = DIR:/run/user/%u/krb5cc</term>
127 <listitem><para>This will create a credential cache file in the specified directory.</para></listitem>
130 <term>krb5_ccache_type = FILE:/tmp/krb5cc_%u</term>
131 <listitem><para>This will create a credential cache file.</para></listitem>
135 <para> Leave empty to just do kerberos authentication without
136 having a ticket cache after the logon has succeeded.
137 This setting is empty by default.
143 <term>cached_login = yes|no</term>
145 Winbind allows to logon using cached credentials when <parameter>winbind offline logon</parameter> is enabled. To use this feature from the PAM module this option must be set. Defaults to "no".
150 <term>silent = yes|no</term>
152 Do not emit any messages. Defaults to "no".
157 <term>mkhomedir = yes|no</term>
159 Create homedirectory for a user on-the-fly, option is valid in
160 PAM session block. Defaults to "no".
165 <term>warn_pwd_expire = days</term>
167 Defines number of days before pam_winbind starts to warn about passwords that are
168 going to expire. Defaults to 14 days.
179 <title>SEE ALSO</title>
181 <refentrytitle>pam_winbind</refentrytitle>
182 <manvolnum>8</manvolnum></citerefentry>, <citerefentry>
183 <refentrytitle>wbinfo</refentrytitle>
184 <manvolnum>1</manvolnum></citerefentry>, <citerefentry>
185 <refentrytitle>winbindd</refentrytitle>
186 <manvolnum>8</manvolnum></citerefentry>, <citerefentry>
187 <refentrytitle>smb.conf</refentrytitle>
188 <manvolnum>5</manvolnum></citerefentry></para>
192 <title>VERSION</title>
194 <para>This man page is correct for version 3 of Samba.</para>
198 <title>AUTHOR</title>
201 The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by
202 the Samba Team as an Open Source project similar to the way the Linux kernel is developed.
205 <para>This manpage was written by Jelmer Vernooij and Guenther Deschner.</para>