This is a major rewrite of pam_krb5afs. Call it 2.0, for lack of a better term. o Compared to the earlier releases, this tree builds a single module which "knows" how to do everything which is knowable at compile-time. o Configuration options which can now be set as library defaults in the system-wide krb5.conf are now largely ignored by the module. Standard options: o debug Log debugging messages at LOG_DEBUG priority. o no_warn When authenticating, don't warn the user about an expired password. o use_authtok When changing passwords, never prompt for password data. Instead, use data stored by a previously-called module. o use_first_pass When authenticating, never prompt for password data. Instead, use a password which was stored by a previously-called module. o try_first_pass When authenticating, first try to authenticate using the password which was stored by a previously-called module. If it fails, then prompt for the correct password and try again. Recognized options (krb5.conf's appdefaults/pam section, and command-line): o banner=Kerberos When changing passwords, tell users that they are changing their Kerberos passwords (unset to avoid using any term other than "password"). o ccache_dir=/tmp Directory in which to store ccache and ticket files. o external external = service1 service2 Attempt to reuse credentials stored in a ccache pointed to by the KRB5CCNAME variable in the PAM environment. This is mainly useful for situations where the calling application authenticated the user using GSSAPI, the user delegated credentials to the calling application, and you're using pam_krb5 to obtain a v4 Kerberos ticket via krb524, or AFS tokens. The calling application MUST ensure that KRB5CCNAME points to a ccache which should be used for the authenticating user. o keytab=/etc/krb5.keytab Default keytab to use when validating initial credentials. o krb4_convert Obtain Kerberos IV ticket files, even if not required for the sake of AFS. o no_krb4_convert_524 If attempting to obtain Kerberos IV ticket files, don't attempt to use the krb524 conversion service. o no_krb4_use_as_req If attempting to obtain Kerberos IV ticket files, don't attempt to use the KDC directly. o minimum_uid=NUMBER Default keytab to use when validating initial credentials. o no_user_check Go ahead and authenticate users for whom getpwnam() returns no information. Credential cache and ticket files will be created and owned by the current user and group ID instead of the user's. o null_afs Attempt to get credentials for AFS by guessing a service name of the form afs@REALM first, and then one of the form afs/cell@REALM, rather than proceeding in the opposite order. o realm=REALM Override the default realm. o renew_lifetime Override the default renewable lifetime (set in libdefaults, else 0). o ticket_lifetime Override the default ticket lifetime (24 hours with krb5 1.3, else 10 hours). o tokens Obtain AFS tokens during the authentication phase. o validate Validate initial credentials. By default, credentials are validated if the specified keytab file can be read. Configuration file only: o afs_cells = cell1 cell2 cell3 This module is hosted on git.fedorahosted.org. For more information, point a web browser at "http://git.fedorahosted.org/git/pam_krb5.git/" and poke at the "pam_krb5-2_1-branch" branch.