This is poldi.info, produced by makeinfo version 6.3 from poldi.texi.

INFO-DIR-SECTION GNU Utilities
START-INFO-DIR-ENTRY
* poldi: (poldi).	PAM authentication via OpenPGP smartcards.
END-INFO-DIR-ENTRY

This file documents 'Poldi'.

   This is Edition 0.4.2.git, last updated 15 November 2016, of 'The
Poldi Manual', for Version 0.4.2.git.

   Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 g10 Code GmbH.

   Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU General Public License as published by the
Free Software Foundation; either version 2 of the License, or (at your
option) any later version.  The text of the license can be found in the
section entitled "Copying".


File: poldi.info,  Node: Top,  Next: Overview,  Up: (dir)

Main Menu
*********

This is Edition 0.4.2.git, last updated 15 November 2016, of 'The Poldi
Manual', for Version 0.4.2.git of Poldi.

   Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 g10 Code GmbH.

   Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU General Public License as published by the
Free Software Foundation; either version 2 of the License, or (at your
option) any later version.  The text of the license can be found in the
section entitled "Copying".

* Menu:

* Overview::
* Authentication methods::
* Installation from Source::
* Configuration::
* Configuration Example::
* Testing::
* Notes on Applications::
* Copying::                     The GNU General Public License



File: poldi.info,  Node: Overview,  Next: Authentication methods,  Prev: Top,  Up: Top

1 Overview
**********

Poldi is a PAM module implementing challenge/response based
authentication through the OpenPGP smartcard(1).  It makes use of
several GnuPG components(2) and currently supports two authentication
methods:

"local-database" authentication method

     This method establishes the mapping between user accounts and
     smartcards through a locally administered database.

"X509" authentication

     This method uses the PKI infrastructure provided by Dirmngr for
     validating certificates.  OpenPGP smartcards are associated with
     X509 certificates through the smartcard's "url" field; the user
     account name to use for authentication is extracted from the
     certificate.

   This manual is primarily intended for system administrators
interested in setting up authentication through PAM Poldi.

   ---------- Footnotes ----------

   (1) http://www.g10code.de/p-card.html

   (2) Libgcrypt, Assuan, Scdaemon, Dirmngr


File: poldi.info,  Node: Authentication methods,  Next: Installation from Source,  Prev: Overview,  Up: Top

2 Authentication methods
************************

This chapter explains the supported authentication methods in detail.

* Menu:

* Local-database authentication::
* X509 authentication::


File: poldi.info,  Node: Local-database authentication,  Next: X509 authentication,  Up: Authentication methods

2.1 Local-database authentication
=================================

The login process through local database authentication consists
essentially of three parts: looking up the smartcards key on the local
computer, figuring out the desired identity for the login and finally
doing challenge/response authentication against the local key.

   Poldi maintains a database, which associates local user accounts with
smartcards (through their serial number).  One smartcard can be
associated with many users and one user can be associated with many
smartcards.

   The public keys are stored in files in a subdirectory named "keys".
The files are named after the card serial numbers and must contain the
public key as a single S-Expression as it is printed out by
gpg-connect-agent (See below).

   The mapping between keys and Unix accounts is to be established by
adding appropriate entries to the user database file named "users".
Such an entry is of the following form:

     <card serial number> <white space(s)> <account>.


File: poldi.info,  Node: X509 authentication,  Prev: Local-database authentication,  Up: Authentication methods

2.2 X509 authentication
=======================

With X509 authentication smartcards need to be associated with X509
certificates.  This mapping is to be established through the "url" field
on the OpenPGP smartcard.  The url field is expected to hold either a
valid LDAP url ("ldap://...")  or a file url ("file:///...").  After a
certificate has been successfully looked up, it is validated through
Dirmngr and a challenge-response authentication is triggered against the
smartcard.  The mapping between smartcards and local accounts is
established through the list of email addresses contained in the
certificate.  Through the configuration file, Poldi is informed about
the "X509 domain" to use.  This domain is used when looking through the
list of email addresses for the local username on the system.  Note:
semantics might change.

   To illustrate this with an example: lets assume a user is trying to
authenticate himself through Poldi's X509 method.  Poldi looks up the
url field of the user's smartcard and retrieves his X509 certificate.
The certificate contains two e-mail addresses: "<dude@example.com>" and
"<fry@gnupg.org>".  Since the administrator set the "X509 domain" to
"gnupg.org" in Poldi's configuration file, Poldi will pick out the
address "fry@gnupg.org" and (after successful challenge-response
authentication) will let the user login as "fry".


File: poldi.info,  Node: Installation from Source,  Next: Configuration,  Prev: Authentication methods,  Up: Top

3 Installation from Source
**************************

Building and installing Poldi from source should be pretty
straightforward, since it uses the GNU autotools.  Build- and runtime
dependencies may vary with the enabled authentication methods.

   Independent from enabled authentication methods, Poldi depends on
Libgpg-error, Libgcrypt, Libassuan, Scdaemon and of course Libpam.

   The "X509" authentication method additionally has a build-time
dependency on libksba and requires Dirmngr to be properly setup at
runtime.  The "local database" authentication method has no additional
requirements.

   Details on the building procedure can be found in the file "INSTALL".

   At least one configure switch should be set:
'--with-pam-module-directory', which specifies the installation
directory for PAM modules.  Alternatively one can copy the built PAM
module (named "pam_poldi.so") to the correct place manually.

   For building the Poldi package, "make" needs to be invoked.

   Installing Poldi works by invoking the "install" make target.  As
noted before, special care must be taken so that the PAM module ends up
in the correct place.

   Poldi requires some directories beneath 'SYSCONFDIR/poldi', which is
usually equal to 'PREFIX/etc/poldi'.  These directories can be created
manually or through the 'install-conf-skeleton' make target.


File: poldi.info,  Node: Configuration,  Next: Configuration Example,  Prev: Installation from Source,  Up: Top

4 Configuration
***************

Poldi can be configured through configuration files and through PAM
arguments.  All configuration files of Poldi are stored beneath
"'sysconfdir'/poldi".

   Poldi's main configuration file is "'sysconfdir'/poldi/poldi.conf".
The syntax of Poldi's configuration file is identical to the one used by
several other GnuPG components; options and their values are written
next to each other, separated by a white space - one such configuration
item per line.

   Poldi supports the following authentication method independent
options, which can be specified in the main configuration file and in
the PAM configuration files as arguments to the Poldi PAM module (with
standard double-dash notation).

'log-file FILENAME'
     Specify the file to use for log messages.
'auth-method AUTH-METHOD'
     Specify the authentication method to use.  May be either "localdb"
     or "x509".
'debug'
     Enable debugging messages.
'scdaemon-program'
     Specify scdaemon executable to use.
'scdaemon-options'
     Specify scdaemon configuration file to use.
'modify-environment'
     This option causes Poldi to add certain Poldi related environment
     variables to the PAM environment.  Currently, the following
     variables are set:
     PAM_POLDI_AUTHENTICATED
          This variable is set to the empty value.
     PAM_POLDI_SERIALNO
          This variable is set to the serial number of the card used
          during authentication.
     PAM_POLDI_LANG
          This variable is set to the value of the LANG data field.
          Please note that the exact semantics of this might change in
          the future.
'quiet'
     This option causes Poldi to skip most of the PAM info messages
     during authentication.  Careful: the exact semantics of this option
     might change.  Primarily this is a workaround for programs like
     GDM, which collect these info messages and put them in a dialog box
     with an OK-button.  When using e.g.  GDM with the quiet option,
     authentication should work without any interaction.

   Further configuration depends on the authentication method to use.

* Menu:

* Configuration for ``local-database'' authentication::
* Configuration for ``X509'' authentication::


File: poldi.info,  Node: Configuration for ``local-database'' authentication,  Next: Configuration for ``X509'' authentication,  Up: Configuration

4.1 Configuration for "local-database" authentication
=====================================================

For the local-database authentication method additional configuration is
required.  All local-database specific configuration files are stored in
the subdirectory "localdb":

'File: users'
     This file contains the mapping between smartcard serial numbers and
     local usernames.  Syntax: this file consists of entries - one entry
     per line.  Entries are of the form:
     "<SERIALNO><WHITESPACES><USERNAME>\n" (without quotation marks and
     without angle brackets.  Allowed whitespaces are spaces and tabs.
     <SERIALNO> is the serial number of an OpenPGP smartcard.  It can be
     obtained by "gpg -card-status" command as "Application ID".
     <USERNAME> is a valid username on the system.  Comments are opened
     with "#" and terminated by a newline.

'Directory: keys'

     This directory contains the "key database" for Poldis "local
     database" authentication method.  When Poldi needs the key
     belonging to a given smartcard serial number, it looks up a file in
     this directory whose name is exactly the serial number.

     Usually only the system administrator is able to modify this
     directory and thus establish the mapping between smartcards and
     keys.  But it might make sense for the administrator to make a file
     in this directory writable for a ordinary user as well, since this
     would allow that user to update his smartcard's key and adjust the
     mapping himself without bothering the admin.


File: poldi.info,  Node: Configuration for ``X509'' authentication,  Prev: Configuration for ``local-database'' authentication,  Up: Configuration

4.2 Configuration for "X509" authentication
===========================================

In case X509 authentication is enabled, Poldi tries to parse another
configuration file, namely "poldi-x509.conf".  The following
configuration options are supported for this configuration file:

'dirmngr-socket FILENAME'
     Specify the socket to be used for communication with Dirmngr.

'x509-domain STRING'
     Specify the X509 domain, which is simply a suffix required for
     recognizing email addresses contained in user certificates as
     belonging to the system on which authentication happens.


File: poldi.info,  Node: Configuration Example,  Next: Testing,  Prev: Configuration,  Up: Top

5 Configuration Example
***********************

* Menu:

* Example for ``local-database'' authentication::
* Example for ``X509'' authentication::


File: poldi.info,  Node: Example for ``local-database'' authentication,  Next: Example for ``X509'' authentication,  Up: Configuration Example

5.1 Example for "local-database" authentication
===============================================

Lets assume a new installation of Poldi into the root filesystem, having
configuration files stored beneath /etc/poldi.  The user "moritz", who
got an OpenPGP card with the serial number
"D2760001240101010001000006550000, would like to authenticate himself
through Poldi.

   First, the system administrator has to associate the user moritz with
the card's serial number:

     $ echo "D2760001240101010001000006550000 moritz" >> /etc/poldi/localdb/users

   Second, the system administrator needs to write the card's key into a
card-specific key file.  Therefore he inserts Moritz' smartcard and
executes:

     $ gpg-connect-agent "/datafile /etc/poldi/localdb/keys/D2760001240101010001000006550000" "SCD READKEY --advanced OPENPGP.3" /bye

   The administrator wants to allow Moritz to update his card's key
himself; he/she types:

     $ chown moritz /etc/poldi/localdb/keys/D2760001240101010001000006550000

   That's it.


File: poldi.info,  Node: Example for ``X509'' authentication,  Prev: Example for ``local-database'' authentication,  Up: Configuration Example

5.2 Example for "X509" authentication
=====================================

Setting up X509 authentication is more complicated than setting up
localdb authentication, since more components are involved.  This
sections tries to explain the basic steps.

   When using localdb authentication, all we need is a list of keys on
the system, against which the challenge-response authentication is done.
For X509 authentication we need to:

... create X509 certificates
     one per smartcard, issued by a certificate authority trusted by
     Dirmngr
... setup the smartcards
     so that they "point" to "their" certificates
... run Dirmngr
     making it listen on a specific socket
... setup Poldi
     specifying Dirmngr's socket and the "X509 domain" in
     poldi-x509.conf.

   Lets assume we don't have a certificate authority yet.  For the CA
administration one needs a CA program, like OpenSSL. It can either be
used directly or through a GUI frontend like "Tiny CA".

   FIXME: explain situation/goal (x509_domain).

   Step 1: Create a CA. I created my test CA with the following
settings:

Common Name: Fnord Inc CA
Country Name: DE
Organization Name: Fnord Inc
Organizational Unit: Testing

   The other options required are rather self-explanatory.  After CA
creation, we need to generate a signing request.  For this, gpgsm
-gen-key can be used (after inserting the users smartcard).  Here is an
example session (* at the beginning means user's input):

     *    $ gpgsm --gen-key
          gpgsm (GnuPG) 2.1.10; Copyright (C) 2015 Free Software Foundation, Inc.
          This is free software: you are free to change and redistribute it.
          There is NO WARRANTY, to the extent permitted by law.

          Please select what kind of key you want:
             (1) RSA
             (2) Existing key
             (3) Existing key from card
     *    Your selection? 3
          Serial number of the card: D276000124010200F517000000010000
          Available keys:
             (1) 101DE7B639FE29F4636BDEECF442A9273AFA6565 OPENPGP.1
             (2) 65F67E742101C7FE6D5B33FCEFCF4F65EAF0688C OPENPGP.2
             (3) 5D6C89682D07CCFC034AF508420BF2276D8018ED OPENPGP.3
     *    Your selection? 3
          Possible actions for a RSA key:
             (1) sign, encrypt
             (2) sign
             (3) encrypt
     *    Your selection? 2
     *    Enter the X.509 subject name: CN=Niibe Yutaka
          Enter email addresses (end with an empty line):
     *    > gniibe@fsij.org
     *    >
          Enter DNS names (optional; end with an empty line):
     *    >
          Enter URIs (optional; end with an empty line):
     *    >
     *    Create self-signed certificate? (y/N) y
          These parameters are used:
              Key-Type: card:OPENPGP.3
              Key-Length: 1024
              Key-Usage: sign
              Serial: random
              Name-DN: CN=Niibe Yutaka
              Name-Email: gniibe@fsij.org

     *    Proceed with creation? (y/N) y
          Now creating self-signed certificate.  This may take a while ...
          gpgsm: about to sign the certificate for key: &5D6C89682D07CCFC034AF508420BF2276D8018ED
          gpgsm: certificate created
          Ready.
          -----BEGIN CERTIFICATE-----
          MIIDBDCCAeygAwIBAgIIElClyprjBd8wDQYJKoZIhvcNAQELBQAwFzEVMBMGA1UE
          AxMMTmlpYmUgWXV0YWthMCAXDTE1MTIxNzEwNDI0NloYDzIwNjMwNDA1MTcwMDAw
          WjAXMRUwEwYDVQQDEwxOaWliZSBZdXRha2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
          DwAwggEKAoIBAQC/XqCK831odBl7Po174AExdRlOcyNSCKfJR18Mrxi8LnKwyjDg
          GH7Z29Qm4XyZvnLkJvSLcYiSx46iDMWbIYH7w1Or57kp/sUzdlj6clmlV8zklVth
          ppYWpFd+x6Qif9CndRKcPr9S1+tbAIlU5k42RG90XnhEQF1/V3MR01mG0Ey9xBAI
          oHizZKX5XAjPheVGdDyZERB7Zry3e8kDrU+OjsVTjzq7oXtCE7EwI5c+pBQdF8qf
          XZC35nAizu0oqQEBne5MsF9ZIBaY/D+hhXVV51oyyCEwNGTr8Ol6KXKK7MWhf16g
          d0zjulwvO9xH88Q0n1eYur3plH+BZVjXOQPrAgMBAAGjUjBQMBoGA1UdEQQTMBGB
          D2duaWliZUBmc2lqLm9yZzARBgorBgEEAdpHAgIBBAMBAf8wDwYDVR0TAQH/BAUw
          AwEB/zAOBgNVHQ8BAf8EBAMCBsAwDQYJKoZIhvcNAQELBQADggEBAKNdnJ/q3eBt
          h42lsahgqyeRvgs7PS+PeqJyOA+36MuHf8/1rdJpqIH/zX6s7S0c/HNqTUKMiB+S
          XRQ9g5JAbldsvurYGCiSLM2bT4evC7odE8v0LOL2oBVuNZshy2jPOyI19598J2E2
          RjrJSqRguYGIG2m9B5Edog3Fe7Cd7aN8Xp69QEylb2gJqYfP1qfpyzAWQi6oE9MH
          NXh1TxDbiSOee8+5PZdgLaIsnuFG37+9c529oaJV6kTm4Qv4eSQF6XemytMgQVOM
          kM1VFCBFd62fdVPHWqI4K9hdUImdKC4KZKT+HNfXo7W1BE6mDQJbutQkcxsFpBTB
          w9T8Z/SIJJc=
          -----END CERTIFICATE-----
          $

   Import the new certificate signing request in your CA and sign it,
yielding a new client certificate.  A note on Tiny CA: the program
defaults FIXME mail address.

   Export both, the CA certificate and the client certificate, in DER
format.  Export a certificate revocation list (CRL) for your CA in DER
format.

   Step 2: Setup OpenPGP smartcard

   The OpenPGP smartcard is not a "real" PKCS#XYZ (FIXME?) smartcard -
it cannot store X509 certificates.  So instead of "uploading" the
certificate to the smartcard, we write an URL to the card, through which
the complete certificate can be retrieved.  Simply fill the smartcard's
"url" field with either a "ldap://" or a "file://" URL, pointing to the
certificate.  For LDAP urls to work, the certificate must be stored on a
LDAP server and Dirmngr must be configured to use that LDAP server.  For
testing, one can simply specify
"file:///some/where/cert-exported-from-ca.crt".  Editing the card's data
fields is to be done through GnuPG:

     $ gpg --card-edit # (or gpg2)

   Step 3: Setup Dirmngr.

   For debugging purposes it is usually a good idea to add:
     debug-all
     log-file /some/where/dirmngr.log

   to dirmngr.conf.

   Drop the exported CA certificate in Dirmngr's "trusted-certs"
directory.

   Now, run Dirmngr:

     $ eval $(dirmngr --socket /some/where/dirmngr.S --daemon)

   and inform it about the CRL:

     $ dirmngr-client --load-crl previously-saved-crl.der

   Check Dirmngr's log file for any errors.

   Step 4: Configure Poldi.

   Obviously, in the main configuration file poldi.conf, we need:

     auth-method x509

   Again, it's a very good idea to also add:

     debug
     log-file /some/where/poldi.log

   Add the following to "poldi-x509.conf":

     dirmngr-socket /some/where/dirmngr.S # the socket name previously specified
     x509-domain example.com

   Now, things should be ready for trying authentication.


File: poldi.info,  Node: Testing,  Next: Notes on Applications,  Prev: Configuration Example,  Up: Top

6 Testing
*********

Authentication through Poldi should be tested before activating the
module.  For this purpose, the Poldi package includes a simple program
named "pam-test", which is suitable for testing PAM authentication.

* Menu:

* The pam-test program::


File: poldi.info,  Node: The pam-test program,  Up: Testing

6.1 The pam-test program
========================

pam-test is a small program suitable for testing PAM authentication,
without any Poldi specific aspects.  Synopsis:

     pam-test [options] <service name>

   The program accepts the following options: FIXME.


File: poldi.info,  Node: Notes on Applications,  Next: Copying,  Prev: Testing,  Up: Top

7 Notes on Applications
***********************

Generally speaking, all applications containing a decent PAM integration
should work flawlessly in combination with Poldi.  Sadly, there are
applications out there, which do not use PAM correctly.  Therefore, they
might work not too well in case they are configured to use Poldi.

   This chapter attempts to list the most common problems or useful
hints in respect to popular applications.

   When applications still ask for e.g.  a username although Poldi is
activated for that application, it might be the case that other
authentication modules, which trigger this kind of user interaction, are
configured to run prior to Poldi.

* Menu:

* login::
* su::
* gdm::
* XScreensaver::
* xdm::
* kdm::


File: poldi.info,  Node: login,  Next: su,  Up: Notes on Applications

7.1 login
=========

The 'login'-program contained in the 'shadow'-package (>= v4.0.3) works
fine together with Poldi.

   Usually login is launched by 'getty', which might trigger user
interaction, which is not appropriate for use with Poldi (e.g., asking
for a username).  In this case, getty needs to be told to skip the task
of username querying.

   The getty-program from the 'util-linux'-package can be started with
the '-n' argument in order to not ask for a username.


File: poldi.info,  Node: su,  Next: gdm,  Prev: login,  Up: Notes on Applications

7.2 su
======

The 'su'-program contained in the 'shadow'-package (>= v4.0.3) works
fine together with Poldi.


File: poldi.info,  Node: gdm,  Next: XScreensaver,  Prev: su,  Up: Notes on Applications

7.3 gdm
=======

GDM contains two frontends, the 'graphical greeter' and the 'standard
greeter'.

   At least the standard greeter can be used with Poldi just fine; the
graphical greeter obviously asks for usernames prior to triggering PAM
authentication.


File: poldi.info,  Node: XScreensaver,  Next: xdm,  Prev: gdm,  Up: Notes on Applications

7.4 XScreensaver
================

XScreensaver (at least Version >= 5.07, possibly earlier versions too)
works quite well with Poldi authentication.  By combining SCDaemons
~/.gnupg/scd-event mechanism with the xscreensaver-command program, one
can easily setup an environment in which the card-removal event triggers
screen locking and the card-insertion event triggers screen unlocking.

   Note that this also applies to GNOME Screensaver; one only needs to
use the gnome-screensaver-command program instead of
xscreensaver-command.


File: poldi.info,  Node: xdm,  Next: kdm,  Prev: XScreensaver,  Up: Notes on Applications

7.5 xdm
=======

XDM does ask for usernames prior to triggering PAM authentication, as
such it is not too suitable for use with Poldi.


File: poldi.info,  Node: kdm,  Prev: xdm,  Up: Notes on Applications

7.6 kdm
=======

KDM asks for username and password in it's default configuration,
instead of implementing PAM correctly.


File: poldi.info,  Node: Copying,  Prev: Notes on Applications,  Up: Top

Appendix A GNU GENERAL PUBLIC LICENSE
*************************************

                         Version 2, June 1991

     Copyright (C) 1989, 1991 Free Software Foundation, Inc.
     59 Temple Place - Suite 330, Boston, MA 02111-1307, USA

     Everyone is permitted to copy and distribute verbatim copies
     of this license document, but changing it is not allowed.

                               Preamble

   The licenses for most software are designed to take away your freedom
to share and change it.  By contrast, the GNU General Public License is
intended to guarantee your freedom to share and change free software--to
make sure the software is free for all its users.  This General Public
License applies to most of the Free Software Foundation's software and
to any other program whose authors commit to using it.  (Some other Free
Software Foundation software is covered by the GNU Library General
Public License instead.)  You can apply it to your programs, too.

   When we speak of free software, we are referring to freedom, not
price.  Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it if
you want it, that you can change the software or use pieces of it in new
free programs; and that you know you can do these things.

   To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.

   For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have.  You must make sure that they, too, receive or can get the
source code.  And you must show them these terms so they know their
rights.

   We protect your rights with two steps: (1) copyright the software,
and (2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.

   Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software.  If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.

   Finally, any free program is threatened constantly by software
patents.  We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary.  To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.

   The precise terms and conditions for copying, distribution and
modification follow.

    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  1. This License applies to any program or other work which contains a
     notice placed by the copyright holder saying it may be distributed
     under the terms of this General Public License.  The "Program",
     below, refers to any such program or work, and a "work based on the
     Program" means either the Program or any derivative work under
     copyright law: that is to say, a work containing the Program or a
     portion of it, either verbatim or with modifications and/or
     translated into another language.  (Hereinafter, translation is
     included without limitation in the term "modification".)  Each
     licensee is addressed as "you".

     Activities other than copying, distribution and modification are
     not covered by this License; they are outside its scope.  The act
     of running the Program is not restricted, and the output from the
     Program is covered only if its contents constitute a work based on
     the Program (independent of having been made by running the
     Program).  Whether that is true depends on what the Program does.

  2. You may copy and distribute verbatim copies of the Program's source
     code as you receive it, in any medium, provided that you
     conspicuously and appropriately publish on each copy an appropriate
     copyright notice and disclaimer of warranty; keep intact all the
     notices that refer to this License and to the absence of any
     warranty; and give any other recipients of the Program a copy of
     this License along with the Program.

     You may charge a fee for the physical act of transferring a copy,
     and you may at your option offer warranty protection in exchange
     for a fee.

  3. You may modify your copy or copies of the Program or any portion of
     it, thus forming a work based on the Program, and copy and
     distribute such modifications or work under the terms of Section 1
     above, provided that you also meet all of these conditions:

       a. You must cause the modified files to carry prominent notices
          stating that you changed the files and the date of any change.

       b. You must cause any work that you distribute or publish, that
          in whole or in part contains or is derived from the Program or
          any part thereof, to be licensed as a whole at no charge to
          all third parties under the terms of this License.

       c. If the modified program normally reads commands interactively
          when run, you must cause it, when started running for such
          interactive use in the most ordinary way, to print or display
          an announcement including an appropriate copyright notice and
          a notice that there is no warranty (or else, saying that you
          provide a warranty) and that users may redistribute the
          program under these conditions, and telling the user how to
          view a copy of this License.  (Exception: if the Program
          itself is interactive but does not normally print such an
          announcement, your work based on the Program is not required
          to print an announcement.)

     These requirements apply to the modified work as a whole.  If
     identifiable sections of that work are not derived from the
     Program, and can be reasonably considered independent and separate
     works in themselves, then this License, and its terms, do not apply
     to those sections when you distribute them as separate works.  But
     when you distribute the same sections as part of a whole which is a
     work based on the Program, the distribution of the whole must be on
     the terms of this License, whose permissions for other licensees
     extend to the entire whole, and thus to each and every part
     regardless of who wrote it.

     Thus, it is not the intent of this section to claim rights or
     contest your rights to work written entirely by you; rather, the
     intent is to exercise the right to control the distribution of
     derivative or collective works based on the Program.

     In addition, mere aggregation of another work not based on the
     Program with the Program (or with a work based on the Program) on a
     volume of a storage or distribution medium does not bring the other
     work under the scope of this License.

  4. You may copy and distribute the Program (or a work based on it,
     under Section 2) in object code or executable form under the terms
     of Sections 1 and 2 above provided that you also do one of the
     following:

       a. Accompany it with the complete corresponding machine-readable
          source code, which must be distributed under the terms of
          Sections 1 and 2 above on a medium customarily used for
          software interchange; or,

       b. Accompany it with a written offer, valid for at least three
          years, to give any third party, for a charge no more than your
          cost of physically performing source distribution, a complete
          machine-readable copy of the corresponding source code, to be
          distributed under the terms of Sections 1 and 2 above on a
          medium customarily used for software interchange; or,

       c. Accompany it with the information you received as to the offer
          to distribute corresponding source code.  (This alternative is
          allowed only for noncommercial distribution and only if you
          received the program in object code or executable form with
          such an offer, in accord with Subsection b above.)

     The source code for a work means the preferred form of the work for
     making modifications to it.  For an executable work, complete
     source code means all the source code for all modules it contains,
     plus any associated interface definition files, plus the scripts
     used to control compilation and installation of the executable.
     However, as a special exception, the source code distributed need
     not include anything that is normally distributed (in either source
     or binary form) with the major components (compiler, kernel, and so
     on) of the operating system on which the executable runs, unless
     that component itself accompanies the executable.

     If distribution of executable or object code is made by offering
     access to copy from a designated place, then offering equivalent
     access to copy the source code from the same place counts as
     distribution of the source code, even though third parties are not
     compelled to copy the source along with the object code.

  5. You may not copy, modify, sublicense, or distribute the Program
     except as expressly provided under this License.  Any attempt
     otherwise to copy, modify, sublicense or distribute the Program is
     void, and will automatically terminate your rights under this
     License.  However, parties who have received copies, or rights,
     from you under this License will not have their licenses terminated
     so long as such parties remain in full compliance.

  6. You are not required to accept this License, since you have not
     signed it.  However, nothing else grants you permission to modify
     or distribute the Program or its derivative works.  These actions
     are prohibited by law if you do not accept this License.
     Therefore, by modifying or distributing the Program (or any work
     based on the Program), you indicate your acceptance of this License
     to do so, and all its terms and conditions for copying,
     distributing or modifying the Program or works based on it.

  7. Each time you redistribute the Program (or any work based on the
     Program), the recipient automatically receives a license from the
     original licensor to copy, distribute or modify the Program subject
     to these terms and conditions.  You may not impose any further
     restrictions on the recipients' exercise of the rights granted
     herein.  You are not responsible for enforcing compliance by third
     parties to this License.

  8. If, as a consequence of a court judgment or allegation of patent
     infringement or for any other reason (not limited to patent
     issues), conditions are imposed on you (whether by court order,
     agreement or otherwise) that contradict the conditions of this
     License, they do not excuse you from the conditions of this
     License.  If you cannot distribute so as to satisfy simultaneously
     your obligations under this License and any other pertinent
     obligations, then as a consequence you may not distribute the
     Program at all.  For example, if a patent license would not permit
     royalty-free redistribution of the Program by all those who receive
     copies directly or indirectly through you, then the only way you
     could satisfy both it and this License would be to refrain entirely
     from distribution of the Program.

     If any portion of this section is held invalid or unenforceable
     under any particular circumstance, the balance of the section is
     intended to apply and the section as a whole is intended to apply
     in other circumstances.

     It is not the purpose of this section to induce you to infringe any
     patents or other property right claims or to contest validity of
     any such claims; this section has the sole purpose of protecting
     the integrity of the free software distribution system, which is
     implemented by public license practices.  Many people have made
     generous contributions to the wide range of software distributed
     through that system in reliance on consistent application of that
     system; it is up to the author/donor to decide if he or she is
     willing to distribute software through any other system and a
     licensee cannot impose that choice.

     This section is intended to make thoroughly clear what is believed
     to be a consequence of the rest of this License.

  9. If the distribution and/or use of the Program is restricted in
     certain countries either by patents or by copyrighted interfaces,
     the original copyright holder who places the Program under this
     License may add an explicit geographical distribution limitation
     excluding those countries, so that distribution is permitted only
     in or among countries not thus excluded.  In such case, this
     License incorporates the limitation as if written in the body of
     this License.

  10. The Free Software Foundation may publish revised and/or new
     versions of the General Public License from time to time.  Such new
     versions will be similar in spirit to the present version, but may
     differ in detail to address new problems or concerns.

     Each version is given a distinguishing version number.  If the
     Program specifies a version number of this License which applies to
     it and "any later version", you have the option of following the
     terms and conditions either of that version or of any later version
     published by the Free Software Foundation.  If the Program does not
     specify a version number of this License, you may choose any
     version ever published by the Free Software Foundation.

  11. If you wish to incorporate parts of the Program into other free
     programs whose distribution conditions are different, write to the
     author to ask for permission.  For software which is copyrighted by
     the Free Software Foundation, write to the Free Software
     Foundation; we sometimes make exceptions for this.  Our decision
     will be guided by the two goals of preserving the free status of
     all derivatives of our free software and of promoting the sharing
     and reuse of software generally.

                              NO WARRANTY

  12. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO
     WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE
     LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS
     AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
     OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT
     LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
     FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND
     PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
     DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR
     OR CORRECTION.

  13. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
     WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY
     MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE
     LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL,
     INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR
     INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
     DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU
     OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY
     OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN
     ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

                      END OF TERMS AND CONDITIONS

How to Apply These Terms to Your New Programs
=============================================

If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these
terms.

   To do so, attach the following notices to the program.  It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least the
"copyright" line and a pointer to where the full notice is found.

     ONE LINE TO GIVE THE PROGRAM'S NAME AND AN IDEA OF WHAT IT DOES.
     Copyright (C) 19YY  NAME OF AUTHOR

     This program is free software; you can redistribute it and/or
     modify it under the terms of the GNU General Public License
     as published by the Free Software Foundation; either version 2
     of the License, or (at your option) any later version.

     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.

     You should have received a copy of the GNU General Public License along
     with this program; if not, write to the Free Software Foundation, Inc.,
     59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.

   Also add information on how to contact you by electronic and paper
mail.

   If the program is interactive, make it output a short notice like
this when it starts in an interactive mode:

     Gnomovision version 69, Copyright (C) 19YY NAME OF AUTHOR
     Gnomovision comes with ABSOLUTELY NO WARRANTY; for details
     type `show w'.  This is free software, and you are welcome
     to redistribute it under certain conditions; type `show c'
     for details.

   The hypothetical commands 'show w' and 'show c' should show the
appropriate parts of the General Public License.  Of course, the
commands you use may be called something other than 'show w' and 'show
c'; they could even be mouse-clicks or menu items--whatever suits your
program.

   You should also get your employer (if you work as a programmer) or
your school, if any, to sign a "copyright disclaimer" for the program,
if necessary.  Here is a sample; alter the names:

     Yoyodyne, Inc., hereby disclaims all copyright
     interest in the program `Gnomovision'
     (which makes passes at compilers) written
     by James Hacker.

     SIGNATURE OF TY COON, 1 April 1989
     Ty Coon, President of Vice

   This General Public License does not permit incorporating your
program into proprietary programs.  If your program is a subroutine
library, you may consider it more useful to permit linking proprietary
applications with the library.  If this is what you want to do, use the
GNU Library General Public License instead of this License.



Tag Table:
Node: Top725
Node: Overview1529
Ref: Overview-Footnote-12488
Ref: Overview-Footnote-22530
Node: Authentication methods2575
Node: Local-database authentication2876
Node: X509 authentication4016
Node: Installation from Source5505
Node: Configuration6975
Node: Configuration for ``local-database'' authentication9337
Node: Configuration for ``X509'' authentication11056
Node: Configuration Example11804
Node: Example for ``local-database'' authentication12051
Node: Example for ``X509'' authentication13222
Node: Testing19824
Node: The pam-test program20194
Node: Notes on Applications20519
Node: login21362
Node: su21913
Node: gdm22109
Node: XScreensaver22458
Node: xdm23089
Node: kdm23318
Node: Copying23513

End Tag Table
