1574958cf5
Recommends libpam-pkcs11 package. Add configuration for Safenet module (pam_pkcs11.conf) Add UID mapper generator (pkcs11_generate_uids) Configure certificates for pam_pkcs11 from postinst.
61 lines
1.7 KiB
Plaintext
61 lines
1.7 KiB
Plaintext
# Configuration for pam_pkcs11 using the Safenet dongle.
|
|
#
|
|
# see /usr/share/doc/libpam-pkcs11/README.gz for description of
|
|
# top-level configuration properties and common module properties.
|
|
#
|
|
# see /usr/share/doc/libpam-pkcs11/README.mapper.gz for presentation
|
|
# of what is a cert mapper, the two different login process using a
|
|
# mapper (important), and a description of provided mappers.
|
|
#
|
|
# see /usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example
|
|
# for a full configuration file with all modules and mappers.
|
|
#
|
|
pam_pkcs11 {
|
|
|
|
nullok = true;
|
|
debug = true;
|
|
use_first_pass = false;
|
|
try_first_pass = false;
|
|
use_authtok = false;
|
|
card_only = true;
|
|
use_pkcs11_module = safenet;
|
|
use_mappers = uid,null;
|
|
|
|
# Aladdin SAFENET
|
|
pkcs11_module safenet {
|
|
module = /usr/lib/libeToken.so
|
|
description = "Aladdin safenet";
|
|
slot_num = 0;
|
|
#slot_description = "none";
|
|
support_threads = false;
|
|
ca_dir = /etc/pam_pkcs11/cacerts;
|
|
crl_dir = /etc/pam_pkcs11/crls;
|
|
nss_dir = /etc/pki/nssdb;
|
|
cert_policy = ca,signature;
|
|
token_type = "Smart card";
|
|
}
|
|
|
|
|
|
# uid - Maps Subject Unique Identifier field (if exist) to login
|
|
mapper uid {
|
|
debug = true;
|
|
module = internal;
|
|
# module = /lib/x86_64-linux-gnu/pam_pkcs11/uid_mapper.so;
|
|
ignorecase = false;
|
|
mapfile = file:///etc/pam_pkcs11/uid_mapping;
|
|
#mapfile = "none";
|
|
}
|
|
|
|
# Null ( no map ) mapper. when user as finder matchs to NULL or "nobody"
|
|
mapper null {
|
|
debug = true;
|
|
# module = /lib/x86_64-linux-gnu/pam_pkcs11/null_mapper.so;
|
|
module = internal ;
|
|
# select behavior: always match, or always fail
|
|
default_match = false;
|
|
# on match, select returned user
|
|
default_user = nobody ;
|
|
}
|
|
|
|
}
|