pam_opie(8) [freebsd man page]

PAM_OPIE(8)						    BSD System Manager's Manual 					       PAM_OPIE(8)

NAME

     pam_opie -- OPIE PAM module

SYNOPSIS

     [service-name] module-type control-flag pam_opie [options]

DESCRIPTION

     The OPIE authentication service module for PAM, pam_opie provides functionality for only one PAM category: that of authentication.  In terms
     of the module-type parameter, this is the ``auth'' feature.  It also provides a null function for session management.

     Note that this module does not enforce opieaccess(5) checks.  There is a separate module, pam_opieaccess(8), for this purpose.

   OPIE Authentication Module
     The OPIE authentication component provides functions to verify the identity of a user (pam_sm_authenticate()), which obtains the relevant
     opie(4) credentials.  It provides the user with an OPIE challenge, and verifies that this is correct with opiechallenge(3).

     The following options may be passed to the authentication module:

     debug	   syslog(3) debugging information at LOG_DEBUG level.

     auth_as_self  This option will require the user to authenticate himself as the user given by getlogin(2), not as the account they are
		   attempting to access.  This is primarily for services like su(1), where the user's ability to retype their own password might
		   be deemed sufficient.

     no_fake_prompts
		   Do not generate fake challenges for users who do not have an OPIE key.  Note that this can leak information to a hypothetical
		   attacker about who uses OPIE and who does not, but it can be useful on systems where some users want to use OPIE but most do
		   not.

     Note that pam_opie ignores the standard options try_first_pass and use_first_pass, since a challenge must be generated before the user can
     submit a valid response.

FILES

     /etc/opiekeys  default OPIE password database.

SEE ALSO

     passwd(1), getlogin(2), opiechallenge(3), syslog(3), opie(4), pam.conf(5), pam(8)

BSD
								   July 7, 2001 							       BSD

PAM_OPIEACCESS(8)					    BSD System Manager's Manual 					 PAM_OPIEACCESS(8)

NAME

     pam_opieaccess -- OPIEAccess PAM module

SYNOPSIS

     [service-name] module-type control-flag pam_opieaccess [options]

DESCRIPTION

     The pam_opieaccess module is used in conjunction with the pam_opie(8) PAM module to ascertain that authentication can proceed by other means
     (such as the pam_unix(8) module) even if OPIE authentication failed.  To properly use this module, pam_opie(8) should be marked
     ``sufficient'', and pam_opieaccess should be listed right below it and marked ``requisite''.

     The pam_opieaccess module provides functionality for only one PAM category: authentication.  In terms of the module-type parameter, this is
     the ``auth'' feature.  It also provides null functions for the remaining module types.

   OPIEAccess Authentication Module
     The authentication component (pam_sm_authenticate()), returns PAM_SUCCESS in two cases:

     1.   The user does not have OPIE enabled.

     2.   The user has OPIE enabled, and the remote host is listed as a trusted host in /etc/opieaccess, and the user does not have a file named
	  .opiealways in his home directory.

     Otherwise, it returns PAM_AUTH_ERR.

     The following options may be passed to the authentication module:

     allow_local  Normally, local logins are subjected to the same restrictions as remote logins from ``localhost''.  This option causes
		  pam_opieaccess to always allow local logins.

     debug	  syslog(3) debugging information at LOG_DEBUG level.

     no_warn	  suppress warning messages to the user.  These messages include reasons why the user's authentication attempt was declined.

FILES

     /etc/opieaccess	List of trusted hosts or networks.  See opieaccess(5) for a description of its syntax.

     $HOME/.opiealways	The presence of this file makes OPIE mandatory for the user.

SEE ALSO

     opie(4), opieaccess(5), pam.conf(5), pam(8), pam_opie(8)

AUTHORS

     The pam_opieaccess module and this manual page were developed for the FreeBSD Project by ThinkSec AS and NAI Labs, the Security Research
     Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (``CBOSS''), as part of the DARPA CHATS research program.

BSD
								 October 26, 2007							       BSD