How to cache authentication in Linux using PAM/Kerberos authentication (for CVS)?

Question

We have several Linux servers that authenticate Linux user passwords on our Windows Active Directory Server using PAM and Kerberos 5. The Linux distro we use is CentOS 6.

On one system, we have several Version Control Systems like CVS and Subversion, both of which authenticate users throug PAM, such that users can use their normal Unix resp. Windows AD accounts.

Since we started using Kerberos for password authentication, we experienced that CVS on a client machine is often much slower in establishing a connection. CVS authenticates the user on every request (eg. cvs diff, log, update...).

Is is possible to cache the credentials that kerberos uses, sucht that is does not need to ask the Windows AD server every time a user executes a cvs action?

Our PAM config /etc/pam.d/system-auth looks like the following:

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_krb5.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_krb5.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_krb5.so

@MateuszKwiatkowski, no it won't. nscd stands for 'Name Service Caching Daemon', it does not cache Kerberos passwords. — wzzrd, Sep 17 '12 at 14:30

wzzrd · Accepted Answer · 2012-09-17T14:44:06.760

2

A program called 'sssd' can cache (Kerberos) credentials for offline (and cached) logins. I am not sure whether sssd will use cached Kerberos credentials when it's operating normally (i.e. when it's not offline), you would have to try that out.

More information about sssd here.

edited Sep 17 '12 at 14:44

answered Sep 17 '12 at 14:36

wzzrd

10,269
2
32
47

yes, for that in redhat 6 sssd is the default – c4f4t0r Jul 21 '14 at 19:29

score 0 · Answer 2 · answered Nov 04 '13 at 19:24

Any authentication via PAM will always have this problem. The only way to avoid it is to kerberize the service itself, rather use a pam stack to implement authentication.

One way to do this would be to use ssh to access the cvs repository and use kerberos to authenticate to ssh. ( google ssh GSSAPI ).

There are kerberized versions of the CVS server if you don't want to allow ssh acccess to the servers hosting the cvs repository. For an example, see

http://compbio.soe.ucsc.edu/cvsdoc/cvs-manual/cvs_28.html

How to cache authentication in Linux using PAM/Kerberos authentication (for CVS)?

2 Answers2