1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3<refentry id="pam_winbind.conf.5"> 4 5<refmeta> 6 <refentrytitle>pam_winbind.conf</refentrytitle> 7 <manvolnum>5</manvolnum> 8 <refmiscinfo class="source">Samba</refmiscinfo> 9 <refmiscinfo class="manual">5</refmiscinfo> 10 <refmiscinfo class="version">3.6</refmiscinfo> 11</refmeta> 12 13 14<refnamediv> 15 <refname>pam_winbind.conf</refname> 16 <refpurpose>Configuration file of PAM module for Winbind</refpurpose> 17</refnamediv> 18 19<refsect1> 20 <title>DESCRIPTION</title> 21 22 <para>This configuration file is part of the <citerefentry><refentrytitle>samba</refentrytitle> 23 <manvolnum>7</manvolnum></citerefentry> suite.</para> 24 25 <para> 26 pam_winbind.conf is the configuration file for the pam_winbind PAM 27 module. See 28 <citerefentry><refentrytitle>pam_winbind</refentrytitle><manvolnum>8</manvolnum></citerefentry> 29 for further details. 30 </para> 31</refsect1> 32 33<refsect1> 34 <title>SYNOPSIS</title> 35 36 <para> 37 The pam_winbind.conf configuration file is a classic ini-style 38 configuration file. There is only one section (global) where 39 various options are defined. 40 </para> 41</refsect1> 42 43<refsect1> 44 <title>OPTIONS</title> 45 <para> 46 47 pam_winbind supports several options which can either be set in 48 the PAM configuration files or in the pam_winbind configuration 49 file situated at 50 <filename>/etc/security/pam_winbind.conf</filename>. Options 51 from the PAM configuration file take precedence to those from 52 the pam_winbind.conf configuration file. 53 54 <variablelist> 55 56 <varlistentry> 57 <term>debug = yes|no</term> 58 <listitem><para>Gives debugging output to syslog. Defaults to "no".</para></listitem> 59 </varlistentry> 60 61 <varlistentry> 62 <term>debug_state = yes|no</term> 63 <listitem><para>Gives detailed PAM state debugging output to syslog. Defaults to "no".</para></listitem> 64 </varlistentry> 65 66 <varlistentry> 67 <term>require_membership_of = [SID or NAME]</term> 68 <listitem><para> 69 If this option is set, pam_winbind will only succeed if the user is a member of the given SID or NAME. A SID 70 can be either a group-SID, an alias-SID or even an user-SID. It is also possible to give a NAME instead of the 71 SID. That name must have the form: <parameter>MYDOMAIN\\mygroup</parameter> or 72 <parameter>MYDOMAIN\\myuser</parameter>. pam_winbind will, in that case, lookup the SID internally. Note that 73 NAME may not contain any spaces. It is thus recommended to only use SIDs. You can verify the list of SIDs a 74 user is a member of with <command>wbinfo --user-sids=SID</command>. This setting is empty by default. 75 </para></listitem> 76 </varlistentry> 77 78 <varlistentry> 79 <term>try_first_pass = yes|no</term> 80 <listitem><para> 81 By default, pam_winbind tries to get the authentication token from a previous module. If no token is available 82 it asks the user for the old password. With this option, pam_winbind aborts with an error if no authentication 83 token from a previous module is available. If a primary password is not valid, PAM will prompt for a password. 84 Default to "no". 85 </para></listitem> 86 </varlistentry> 87 88 <varlistentry> 89 <term>krb5_auth = yes|no</term> 90 <listitem><para> 91 92 pam_winbind can authenticate using Kerberos when winbindd is 93 talking to an Active Directory domain controller. Kerberos 94 authentication must be enabled with this parameter. When 95 Kerberos authentication can not succeed (e.g. due to clock 96 skew), winbindd will fallback to samlogon authentication over 97 MSRPC. When this parameter is used in conjunction with 98 <parameter>winbind refresh tickets</parameter>, winbind will 99 keep your Ticket Granting Ticket (TGT) uptodate by refreshing 100 it whenever necessary. Defaults to "no". 101 102 </para></listitem> 103 </varlistentry> 104 105 <varlistentry> 106 <term>krb5_ccache_type = [type]</term> 107 <listitem><para> 108 109 When pam_winbind is configured to try kerberos authentication 110 by enabling the <parameter>krb5_auth</parameter> option, it can 111 store the retrieved Ticket Granting Ticket (TGT) in a 112 credential cache. The type of credential cache can be set with 113 this option. Currently the only supported value is: 114 <parameter>FILE</parameter>. In that case a credential cache in 115 the form of /tmp/krb5cc_UID will be created, where UID is 116 replaced with the numeric user id. Leave empty to just do 117 kerberos authentication without having a ticket cache after the 118 logon has succeeded. This setting is empty by default. 119 120 </para></listitem> 121 </varlistentry> 122 123 <varlistentry> 124 <term>cached_login = yes|no</term> 125 <listitem><para> 126 Winbind allows to logon using cached credentials when <parameter>winbind offline logon</parameter> is enabled. To use this feature from the PAM module this option must be set. Defaults to "no". 127 </para></listitem> 128 </varlistentry> 129 130 <varlistentry> 131 <term>silent = yes|no</term> 132 <listitem><para> 133 Do not emit any messages. Defaults to "no". 134 </para></listitem> 135 </varlistentry> 136 137 <varlistentry> 138 <term>mkhomedir = yes|no</term> 139 <listitem><para> 140 Create homedirectory for a user on-the-fly, option is valid in 141 PAM session block. Defaults to "no". 142 </para></listitem> 143 </varlistentry> 144 145 <varlistentry> 146 <term>warn_pwd_expire = days</term> 147 <listitem><para> 148 Defines number of days before pam_winbind starts to warn about passwords that are 149 going to expire. Defaults to 14 days. 150 </para></listitem> 151 </varlistentry> 152 153 </variablelist> 154 155 </para> 156 157</refsect1> 158 159<refsect1> 160 <title>SEE ALSO</title> 161 <para><citerefentry> 162 <refentrytitle>pam_winbind</refentrytitle> 163 <manvolnum>8</manvolnum></citerefentry>, <citerefentry> 164 <refentrytitle>wbinfo</refentrytitle> 165 <manvolnum>1</manvolnum></citerefentry>, <citerefentry> 166 <refentrytitle>winbindd</refentrytitle> 167 <manvolnum>8</manvolnum></citerefentry>, <citerefentry> 168 <refentrytitle>smb.conf</refentrytitle> 169 <manvolnum>5</manvolnum></citerefentry></para> 170</refsect1> 171 172<refsect1> 173 <title>VERSION</title> 174 175 <para>This man page is correct for version 3 of Samba.</para> 176</refsect1> 177 178<refsect1> 179 <title>AUTHOR</title> 180 181 <para> 182 The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by 183 the Samba Team as an Open Source project similar to the way the Linux kernel is developed. 184 </para> 185 186 <para>This manpage was written by Jelmer Vernooij and Guenther Deschner.</para> 187 188</refsect1> 189 190</refentry> 191