From 82d6a4354d3b4a6cc9e70ccfb21d7b604bed179b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Sep 2013 09:43:32 +0200 Subject: [PATCH] doc: Update documentation of pam_winbind krb5 support. MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Signed-off-by: Andreas Schneider Reviewed-by: Guenther Deschner Autobuild-User(master): Günther Deschner Autobuild-Date(master): Tue Sep 10 15:35:20 CEST 2013 on sn-devel-104 The last 3 patches address bug #10132 - pam_winbindd should support the KEYRING ccache type. Autobuild-User(v4-1-test): Karolin Seeger Autobuild-Date(v4-1-test): Mon Oct 7 12:21:29 CEST 2013 on sn-devel-104 --- docs-xml/manpages/pam_winbind.conf.5.xml | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/docs-xml/manpages/pam_winbind.conf.5.xml b/docs-xml/manpages/pam_winbind.conf.5.xml index be7f684f538..725e809e59b 100644 --- a/docs-xml/manpages/pam_winbind.conf.5.xml +++ b/docs-xml/manpages/pam_winbind.conf.5.xml @@ -106,16 +106,24 @@ krb5_ccache_type = [type] - When pam_winbind is configured to try kerberos authentication by - enabling the krb5_auth option, it can - store the retrieved Ticket Granting Ticket (TGT) in a credential - cache. The type of credential cache can be controlled with this - option. The supported values are: FILE - and DIR (when the DIR type is supported - by the system's Kerberos library). In case of FILE a credential + When pam_winbind is configured to try kerberos authentication + by enabling the krb5_auth option, it can + store the retrieved Ticket Granting Ticket (TGT) in a + credential cache. The type of credential cache can be + controlled with this option. The supported values are: + KEYRING (when supported by the system's + Kerberos library and Kernel), FILE and + DIR (when the DIR type is supported by + the system's Kerberos library). In case of FILE a credential cache in the form of /tmp/krb5cc_UID will be created - in case - of DIR it will be located under the /run/user/UID/krb5cc - directory. UID is replaced with the numeric user id. + of DIR you NEED to specify a directory. UID is replaced with + the numeric user id. + + When using the KEYRING type, the supported mechanism is + KEYRING:persistent:UID, which uses the Linux + kernel keyring to store credentials on a per-UID basis. This is + the recommended choice on latest Linux distributions, as it is + the most secure and predictable method. It is also possible to define custom filepaths and use the "%u" pattern in order to substitue the numeric user id. -- 2.11.4.GIT