mirror of
https://github.com/freebsd/freebsd-src
synced 2024-07-21 10:19:04 +00:00
246aec9a3c
MFC after: 1 week Sponsored by: Klara, Inc. Reviewed by: thj Differential Revision: https://reviews.freebsd.org/D40376
90 lines
1.8 KiB
Groff
90 lines
1.8 KiB
Groff
.\"-
|
|
.\" Copyright (c) 2023 Klara, Inc.
|
|
.\"
|
|
.\" SPDX-License-Identifier: BSD-2-Clause
|
|
.\"
|
|
.Dd June 13, 2023
|
|
.Dt NSS_TACPLUS 8
|
|
.Os
|
|
.Sh NAME
|
|
.Nm nss_tacplus
|
|
.Nd TACACS+ nsswitch module
|
|
.Sh SYNOPSIS
|
|
.Ic passwd : files tacplus
|
|
.Sh DESCRIPTION
|
|
The
|
|
.Nm
|
|
module is a loadable NSS module which provides a minimal identity
|
|
service using a TACACS+ backend.
|
|
.Pp
|
|
Due to the limitations of the TACACS+ protocol, the functionality
|
|
provided by the
|
|
.Nm
|
|
module is very limited: it can look up a user by name, but not by uid,
|
|
and it cannot enumerate users.
|
|
.Pp
|
|
To look up a user, the
|
|
.Nm
|
|
module submits an authorization request with authentication method
|
|
.Dv TAC_PLUS_AUTHEN_METH_NOT_SET ,
|
|
authentication type
|
|
.Dv TAC_PLUS_AUTHEN_TYPE_NOT_SET ,
|
|
and authentication service
|
|
.Dv TAC_PLUS_AUTHEN_SVC_LOGIN ,
|
|
for the
|
|
.Dq shell
|
|
service.
|
|
If the response status is either
|
|
.Dv TAC_PLUS_AUTHOR_STATUS_PASS_ADD
|
|
or
|
|
.Dv TAC_PLUS_AUTHOR_STATUS_PASS_REPL ,
|
|
the user is considered to exist and the
|
|
.Nm
|
|
module fills out a
|
|
.Vt struct passwd
|
|
for it.
|
|
.Pp
|
|
The following attributes, if included in the response from the TACACS+
|
|
server, are used to construct the response:
|
|
.Bl -tag -width GECOS
|
|
.It Va UID
|
|
Numeric user ID.
|
|
Must be between 0 and
|
|
.Dv UID_MAX .
|
|
Defaults to 65534.
|
|
.It Va GID
|
|
Numeric primary group ID.
|
|
Must be between 0 and
|
|
.Dv GID_MAX .
|
|
Defaults to 65534.
|
|
.It Va CLASS
|
|
Login class.
|
|
Left blank if not provided.
|
|
.It Va GECOS
|
|
Display name.
|
|
If not provided, the user name is used instead.
|
|
.It Va HOME
|
|
Home directory.
|
|
Defaults to
|
|
.Pa / .
|
|
.It Va SHELL
|
|
Shell.
|
|
Defaults to
|
|
.Pa /bin/sh .
|
|
.El
|
|
.Pp
|
|
Case is ignored when matching attribute names.
|
|
If an attribute is included multiple times, the last value takes
|
|
effect.
|
|
.Sh SEE ALSO
|
|
.Xr libtacplus 3 ,
|
|
.Xr tacplus.conf 5 ,
|
|
.Xr pam_tacplus 8
|
|
.Sh HISTORY
|
|
.An -nosplit
|
|
The
|
|
.Nm
|
|
module and this manual page were written by
|
|
.An Dag-Erling Smørgrav Aq Mt des@FreeBSD.org
|
|
for Klara Systems.
|