\documentclass{report}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{textcomp}
\usepackage{geometry}
\geometry{top=15mm, bottom=15mm, left=1cm, right=1cm}
\usepackage[french]{babel}
\usepackage{pslatex}
\usepackage[colorlinks=true,urlcolor=black]{hyperref}
\usepackage{graphicx}
\usepackage{fancyhdr}
\pagestyle{fancy}
\renewcommand{\footrulewidth}{0.4pt}
\fancyfoot[L]{Uubu.fr}
\fancyfoot[R]{dim. févr. 12 14:22:01 CET 2012}
\lfoot{\Large \textit{Uubu.fr}}
\hypersetup{pdfinfo={
Title={pam\_pkcs11.conf},
Author={Sylvain Girod},
Creator={Bash script from uubu.fr's format version 1},
Producer={Bash script and PDFLaTeX},
Subject={fichier de configuration pour pam\_pkcs11},
CreationDate={D:20120212142201},
ModDate={D:20120212142201},
Keywords={PKI;sécurité;certificats;authentification;pam}
}}
\begin{document}
 
\begin{center}
{\Huge pam\_pkcs11.conf }
\end{center}
\vspace{1cm}
 
\begin{flushleft}
 
{\large fichier de configuration pour pam\_pkcs11}
 
\vspace{10mm}
 
\hspace{1mm}  Le fichier de configuration utilise la librairie scconf. Les paramètres et données sont groupées dans des blocks. ils peuvent être imbriqués.
\vspace{5mm} \\
 
 
\hspace{1mm} Un fichier de configuration pam\_pkcs11 ressemble à:
 
{\ttfamily
pam-pkcs11\\ \hspace{2mm}global options\\ \hspace{2mm}\texttt{[}...\texttt{]}\\ \hspace{2mm}use\_pkcs11\_module = pkcs11 module to be used\\ \hspace{2mm}pkcs11\_module module1 \{\\ \hspace{2mm}\hspace{2mm}module1 specific options\\ \hspace{2mm}\}\\ \hspace{2mm}pkcs11\_module module2 \{\\ \hspace{2mm}\hspace{2mm}module2 specific options\\ \hspace{2mm}\}\\ \hspace{2mm}\texttt{[}...\texttt{]}\\ \hspace{2mm}use\_mappers = mapper1, mapper2,... ;\\ \hspace{2mm}mapper mapper1 \{\\ \hspace{2mm}\hspace{2mm}mapper1 specific options\\ \hspace{2mm}\}\\ \hspace{2mm}mapper mapper2 \{\\ \hspace{2mm}\hspace{2mm}mapper2 specific options\\ \hspace{2mm}\}\\ \hspace{2mm}\texttt{[}...\texttt{]}\\ \hspace{2mm}mapper mapperN \{\\ \hspace{2mm}\hspace{2mm}mapperN specific options\\ \hspace{2mm}\}\\ \}\\
}
\vspace{8mm}
 
\hspace{1mm} Exemple de fichier pam\_pkcs11.conf
 
{\ttfamily
pam\_pkcs11 \{\\ \hspace{2mm}nullok = true ; \# Allow empty passwords\\ debug = true ; \# Enable debugging support.\\ \hspace{2mm}use\_first\_pass = false ; \# Do not prompt for the passwords but take them from the PAM\_ items instead\\ \hspace{2mm}try\_first\_pass = false ; \# Do not prompt for the passwords unless PAM\_(OLD)AUTHTOK is unset.\\ \hspace{2mm}use\_authtok = false ; \# Like try\_first\_pass, but fail if the new PAM\_AUTHTOK has not been previously set (intended for stacking password modules only).\\ \hspace{2mm}use\_pkcs11\_module = opensc ; \# Filename of the PKCS \#11 module. The default value is "default"\\ \hspace{2mm}\\ pkcs11\_module opensc \{\\ \hspace{2mm}module = /usr/lib/opensc-pkcs11.so ;\\ \hspace{2mm}description = "OpenSC PKCS\#11 module" ;\\ \hspace{2mm}slot\_description = "none" ; \# spécifier le slot à utiliser. préférer cette option à slot\_num.\\ \hspace{2mm}\# slot\_num = 0 ; \# spécifier soit slot\_description, soit slot\_num.\\ \hspace{2mm}ca\_dir = /etc/pam\_pkcs11/cacerts ; \# répertoire contenant les certificats de l’autorité au format pem ou asn1 oui des liens hash.\\ \hspace{2mm}crl\_dir = /etc/pam\_pkcs11/crls ; \# répertoire contenant la CRL offline\\ \hspace{2mm}support\_threads = false ; \# certaines librairies supportent le multi-thread\\ \hspace{2mm}cert\_policy = ca,signature ; \# définis la vérification de certificat\\ \hspace{2mm}\# none aucune vérification\\ \hspace{2mm}\# ca vérfication de la CA\\ \hspace{2mm}\# crl\_online télécharge la CRL\\ \hspace{2mm}\# crl\_offline utilise la crl offline\\ \hspace{2mm}\# crl\_auto tente d’abord la online, puis la offline\\ \hspace{2mm}\# signature vérifie la signature\\ \hspace{2mm}token\_type = "Smart card" ; \# spécifie le type de token. sera utilisé dans le message de prompt.\\ \hspace{2mm}pkcs11\_module etoken \{ \# Aladdin eTokenPRO 32\\ \hspace{2mm}\hspace{2mm}module = /usr/local/lib/libetpkcs11.so\\ \hspace{2mm}\hspace{2mm}description = "Aladdin eTokenPRO-32" ;\\ \hspace{2mm}\\ \hspace{2mm}\hspace{2mm}slot\_num = 0 ;\\ \hspace{2mm}\hspace{2mm}support\_threads = true ;\\ \hspace{2mm}\hspace{2mm}ca\_dir = /etc/pam\_pkcs11/cacerts ;\\ \hspace{2mm}\hspace{2mm}crl\_dir = /etc/pam\_pkcs11/crls ;\\ \hspace{2mm}\hspace{2mm}cert\_policy = ca,signature ;\\ \hspace{2mm}\}\\ \hspace{2mm}pkcs11\_module nss \{ \# NSS (Network Security Service) config\\ \hspace{2mm}\hspace{2mm}nss\_dir = /etc/ssl/nssdb ;\\ \hspace{2mm}\hspace{2mm}crl\_policy = none ;\\ \hspace{2mm}\}\\ \hspace{2mm}pkcs11\_module default \{ \# Default pkcs11 module\\ \hspace{2mm}\hspace{2mm}module = @libdir@/pam\_pkcs11/pkcs11\_module.so ;\\ \hspace{2mm}\hspace{2mm}description = "Default pkcs\#11 module" ;\\ \hspace{2mm}\hspace{2mm}slot\_num = 0 ;\\ \hspace{2mm}\hspace{2mm}support\_threads = false ;\\ \hspace{2mm}\hspace{2mm}ca\_dir = /etc/pam\_pkcs11/cacerts ;\\ \hspace{2mm}\hspace{2mm}crl\_dir = /etc/pam\_pkcs11/crls ;\\ \hspace{2mm}\hspace{2mm}cert\_policy = none ;\\ \hspace{2mm}\}\\ \hspace{2mm}use\_mappers = digest, cn, pwent, uid, mail, subject, null ;\hspace{2mm}\# spécifie les mappers à utiliser:\\ \hspace{2mm}\hspace{2mm}\# subject\hspace{2mm}Sujet du certificat\\ \hspace{2mm}\hspace{2mm}\# pwent \hspace{2mm}CN ou gecos\\ \hspace{2mm}\hspace{2mm}\# ldap\hspace{2mm}\hspace{2mm}mapper LDAP\\ \hspace{2mm}\hspace{2mm}\# opensc\hspace{2mm}Cherche le certificat dans \$\{HOME\}/.eid/authorized\_certificates\\ \hspace{2mm}\hspace{2mm}\# openssh\hspace{2mm}Cherche la clé public du certificat dans \$\{HOME\}/.ssh/authorized\_keys\\ \hspace{2mm}\hspace{2mm}\# mail\hspace{2mm}\hspace{2mm}compare le champs email du certificat\\ \hspace{2mm}\hspace{2mm}\# ms\hspace{2mm}\hspace{2mm}Utilise l’UPN\\ \hspace{2mm}\hspace{2mm}\# krb\hspace{2mm}\hspace{2mm}Compare avec le Kerberos Principal Name\\ \hspace{2mm}\hspace{2mm}\# cn\hspace{2mm}\hspace{2mm}Compare le CN\\ \hspace{2mm}\hspace{2mm}\# uid\hspace{2mm}\hspace{2mm}Compare l’UID\\ \hspace{2mm}\hspace{2mm}\# digest\hspace{2mm}Certificat Digest\\ \hspace{2mm}\hspace{2mm}\# generic\hspace{2mm}Contenu définis par l’utilisateur\\ \hspace{2mm}\hspace{2mm}\# null\hspace{2mm}\hspace{2mm}blind access/deny mapper\\ \hspace{2mm}mapper\_search\_path = @libdir@/pam\_pkcs11 ;\hspace{2mm}\# chemin des module mapper.\\ \hspace{2mm}mapper subject \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Mapper le sujet du certificat pour le login, fournis dans un fichier sous la forme "Subject -> login"\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}\#module = @libdir@/pam\_pkcs11/subject\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}ignorecase = false ;\\ \hspace{2mm}\hspace{2mm}mapfile = file :///etc/pam\_pkcs11/subject\_mapping ;\\ \hspace{2mm}\}\\ \hspace{2mm}mapper pwent \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# map le CN à getpwent()\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}ignorecase = false ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}\#module = @libdir@/pam\_pkcs11/pwent\_mapper.so ;\\ \hspace{2mm}\}\\ \hspace{2mm}mapper ldap \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# mapper d’annuaire\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}module = @libdir@/pam\_pkcs11/ldap\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}ldaphost = "" ; \hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# fqdn du serveur ldap (utilise l’URI ldap pour en spécifier plusieurs)\\ \hspace{2mm}\hspace{2mm}ldapport = ; \hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# port du serveur ldap s’il n’est pas donné dans l’URI\\ \hspace{2mm}\hspace{2mm}URI = "" ;\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# list d’URI utilisés dans l’ordre\\ \hspace{2mm}\hspace{2mm}scope = 2 ; \hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# scope de recherche : 0 (base), 1 (one), 2 (sub)\\ \hspace{2mm}\hspace{2mm}binddn = "cn=pam,o=example,c=com" ; \hspace{2mm}\# DN du bind. doit avoir un accès en lecture\\ \hspace{2mm}\hspace{2mm}passwd = "" ; \hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# password du binddn\\ \hspace{2mm}\hspace{2mm}base = "ou=People,o=example,c=com" ;\hspace{2mm}\# base de recherche\\ \hspace{2mm}\hspace{2mm}attribute = "userCertificate" ;\hspace{2mm}\hspace{2mm}\# attribut qui contient le certificat\\ \hspace{2mm}\hspace{2mm}filter = "(\&(objectClass=posixAccount)(uid=\%s))" \# Filtre de recherche pour les entrées utilisateurs ( doit seulement laisser passer l’entrée pour le login utilisateur )\\ \hspace{2mm}\hspace{2mm}ssl = tls\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# off (désactiver), tls (activer tls), on|ssl (activer ssl)\\ \hspace{2mm}\hspace{2mm}tls\_randfile = \hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# chemin de la source entropie\\ \hspace{2mm}\hspace{2mm}tls\_cacertfile = /etc/ssl/cacert.pem\hspace{2mm}\# Chemin vers le certification pour l’authentification du pair\\ \hspace{2mm}\hspace{2mm}tls\_cacertdir =\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Répertoire contenant les certificats X509 pour l’authentification du pair\\ \hspace{2mm}\hspace{2mm}tls\_checkpeer = 0\hspace{2mm}\hspace{2mm}\hspace{2mm}\# 0 ou 1. spécifie de vérifier le certificat.\\ \hspace{2mm}\hspace{2mm}tls\_ciphers = \hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Chiffrement à utiliser\\ \hspace{2mm}\hspace{2mm}tls\_cert = ...\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Chemin du fichier contenant le certificat local pour l’authentification TLS client\\ \hspace{2mm}\hspace{2mm}tls\_key = ...\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Chemin du fichier contenant la clé privée pour l’authentification TLS client\\ \hspace{2mm}\}\\ \hspace{2mm}mapper opensc \{ \hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# recherche les certificats depuis \$HOME/.eid/autorized\_certificates qui match l’utilisateur\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}module = @libdir@/pam\_pkcs11/opensc\_mapper.so ;\\ \hspace{2mm}\}\\ \hspace{2mm}mapper openssh \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Cherche les clés publique dans \$HOME/.ssh/authorized\_keys qui match l’utilisateur\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}module = @libdir@/pam\_pkcs11/openssh\_mapper.so ;\\ \hspace{2mm}\}\\ \hspace{2mm}mapper mail \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Compare le champ email du certificat\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}\# module = @libdir@/pam\_pkcs11/mail\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}mapfile = file :///etc/pam\_pkcs11/mail\_mapping ;\hspace{2mm}\# Déclarer un fichier de map, ’empty’ ou vide pour ne pas utiliser de fichier de map\\ \hspace{2mm}\hspace{2mm}ignorecase = true ;\hspace{2mm}\hspace{2mm}\hspace{2mm}\# ignorer la casse\\ \hspace{2mm}\hspace{2mm}ignoredomain = false ;\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Vérifie le domaine mx. en utilisant un fichier de map, cette option est ignorée.\\ \hspace{2mm}\}\\ \hspace{2mm}mapper ms \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# utilise l’UPN (login@AD\_domain)\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}\# module = @libdir@/pam\_pkcs11/ms\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}ignorecase = false ;\\ \hspace{2mm}\hspace{2mm}ignoredomain = false ;\\ \hspace{2mm}\hspace{2mm}domain = "domain.com" ;\\ \hspace{2mm}\}\\ \hspace{2mm}mapper krb \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Compare avec le principal kerberos\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}\# module = @libdir@/pam\_pkcs11/krb\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}ignorecase = false ;\\ \hspace{2mm}\hspace{2mm}mapfile = "none" ;\\ \hspace{2mm}\}\\ \hspace{2mm}mapper cn \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# le CN est le login\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}\# module = @libdir@/pam\_pkcs11/cn\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}ignorecase = true ;\\ \hspace{2mm}\hspace{2mm}\# mapfile = file :///etc/pam\_pkcs11/cn\_map ;\\ \hspace{2mm}\hspace{2mm}mapfile = "none" ;\\ \hspace{2mm}\}\\ \hspace{2mm}mapper uid \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# l’uid (s’il existe) est le login\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}\# module = @libdir@/pam\_pkcs11/uid\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}ignorecase = false ;\\ \hspace{2mm}\hspace{2mm}mapfile = "none" ;\\ \hspace{2mm}\}\\ \hspace{2mm}mapper digest \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Evalue le digest du certificat et le map dans un fichier\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}\# module = @libdir@/pam\_pkcs11/digest\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}algorithm = "sha1" ; \hspace{2mm}\hspace{2mm}\hspace{2mm}\# Algorithme utilisé pour évaluer le digest ("null","md2","md4","md5","sha","sha1","dss","dss1","ripemd160")\\ \hspace{2mm}\hspace{2mm}mapfile = file :///etc/pam\_pkcs11/digest\_mapping ;\\ \hspace{2mm}\hspace{2mm}\# mapfile = "none" ;\\ \hspace{2mm}\}\\ \hspace{2mm}mapper generic \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# mapper de contenu générique\\ \hspace{2mm}\hspace{2mm}debug = true ;\\ \hspace{2mm}\hspace{2mm}\#module = @libdir@/pam\_pkcs11/generic\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}ignorecase = false ;\hspace{2mm}\hspace{2mm}\hspace{2mm}\# ignirer la casse\\ \hspace{2mm}\hspace{2mm}cert\_item = cn ; \hspace{2mm}\hspace{2mm}\hspace{2mm}\# ( "cn" , "subject" , "kpn" , "email" , "upn" ou "uid" )\\ \hspace{2mm}\hspace{2mm}mapfile = file :///etc/pam\_pkcs11/generic\_mapping ;\\ \hspace{2mm}\hspace{2mm}use\_getpwent = false ;\hspace{2mm}\hspace{2mm}\hspace{2mm}\# utiliser petpwent() pour mapper le login\\ \hspace{2mm}\}\\ \hspace{2mm}mapper null \{\hspace{2mm}\hspace{2mm}\hspace{2mm}\hspace{2mm}\# Pas de mappage. Quand un utilisateur match à NULL ou nobody\\ \hspace{2mm}\hspace{2mm}debug = false ;\\ \hspace{2mm}\hspace{2mm}\# module = @libdir@/pam\_pkcs11/null\_mapper.so ;\\ \hspace{2mm}\hspace{2mm}module = internal ;\\ \hspace{2mm}\hspace{2mm}default\_match = false ;\hspace{2mm}\hspace{2mm}\hspace{2mm}\# match toujours (true) ou échoue toujours (false)\\ \hspace{2mm}\hspace{2mm}default\_user = nobody ;\hspace{2mm}\hspace{2mm}\hspace{2mm}\# en cas de match, retourner cet utilisateur\\ \hspace{2mm}\}\\ \}\\
}
\vspace{8mm}
\end{flushleft}
\end{document}
