svcadm(8)을 검색하려면 섹션에서 8 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
pam_zfs_key(7)
pa...y(7)Standards, Environments, Macros, Character Sets, and miscellanpya...y(7)
NAME
pam_zfs_key - PAM user credential module for ZFS
SYNOPSIS
pam_zfs_key.so.1 [create] [encryption] [force] [homes=path] [nowarn]
DESCRIPTION
The pam_zfs_key module implements pam_sm_setcred(3PAM) and pam_sm_chau‐
thtok(3PAM).
The pam_zfs_key module provides functions that allow loading and chang‐
ing of the ZFS encryption passphrase for encrypted file systems that
are mounted at the user's home directory location. Authentication ser‐
vice modules must implement both pam_sm_authenticate() and pam_sm_set‐
cred(). pam_sm_authenticate() in this module always returns PAM_IGNORE.
If the user's home directory is located on a different ZFS dataset than
rpool/export/home, the module option homes= can be used to specify
that. The specified value is the ZFS dataset name, not the mountpoint,
which would usually be /export/home/.
The last component of the ZFS dataset name must match the value of
PAM_USER, that is, the user's login name. If the user's home directory
is a local ZFS filesystem with encryption enabled and the ZFS keysource
property is set to passphrase,prompt, on pam_sm_setcred() this module
manages the keys as follows:
PAM_DELETE_CRED Attempts to umount the filesystem and unload
the key. This often fails because there are
still processes with the user's home directory
as the current working directory. A force mod‐
ule option is provided to attempt a forced un‐
mount first.
PAM_REINITIALIZE_CRED Attempts to use the value of PAM_AUTHTOK to
PAM_ESTABLISH_CRED load the key for the ZFS dataset and mount it.
If PAM_AUTHTOK is not the correct passphrase,
the user is prompted once for an alternate.
This value is never stored in PAM_AUTHTOK,
even if it is the correct passphrase for the
ZFS dataset that is the user's home directory.
This is equivalent to:
zfs key -l rpool/export/home/$USER
If no ZFS file system exists for the user and the create module option
is provided, a new one is created. The ZFS encryption property defaults
to on in this case unless the encryption= property is set for the mod‐
ule to override it.
If the create module option is not provided and no ZFS file system ex‐
ists for the user, the module returns PAM_IGNORE.
The newly created ZFS file system has the following ZFS delegations
specified for the user for which it is created: key,keychange,mount. In
these cases keysource is always set to passphrase,prompt.
When pam_sm_chauthtok(3PAM) is called, for example, on password change,
this module attempts to change the passphrase for the ZFS dataset to
match the value in PAM_AUTHTOK. This is equivalent to running:
zfs key -c rpool/export/home/$USER
This requires that the user have the keychange delegation, as password
change usually runs as the user.
The following mount options are supported:
create Create new ZFS datasets
encryption Set the ZFS encryption property for create
force Attempt a umount2(2) with a MS_FORCE of the dataset when
doing PAM_DELETE_CRED.
homes=path Alternate location of ZFS datasets for user home directo‐
ries. The default is rpool/export/home.
nowarn Do not provide any error messages or warnings.
EXAMPLES
Example 1 Using pam_zfs_key in Default Mode
The following example uses pam_zfs_key in default mode.
gdm-password auth requisite pam_authtok_get.so.1
gdm-password auth required pam_unix_cred.so.1
gdm-password auth required pam_unix_auth.so.1
gdm-password auth optional pam_zfs_key.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1
other password optional pam_zfs_key.so.1
Example 2 Specifying an Alternate ZFS Dataset
The following example specifies an alternate ZFS dataset location for
the home directory file systems. New entries should be created if they
are not present using aes-256-gcm as the ZFS encryption property set‐
ting.
gdm-password auth requisite pam_authtok_get.so.1
gdm-password auth required pam_unix_cred.so.1
gdm-password auth required pam_unix_auth.so.1
gdm-password auth optional pam_zfs_key.so.1 homes=tank/users \
create encryption=aes-256-gcm
Example 3 Making it Mandatory for the ZFS Dataset to Mount
The following example makes it mandatory for the ZFS dataset to mount
and ensures the passphrase always stays in sync with the login pass‐
word.
gdm-password auth requisite pam_authtok_get.so.1
gdm-password auth required pam_unix_cred.so.1
gdm-password auth required pam_unix_auth.so.1
gdm-password auth required pam_zfs_key.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password requisite pam_zfs_key.so.1
other password required pam_authtok_store.so.1
ATTRIBUTES
See attributes(7) for descriptions of the following attributes:
tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) ATTRIBUTE TYPEAT‐
TRIBUTE VALUE _ Availabilitysystem/file-system/zfs _ Interface Stabili‐
tyCommitted
SEE ALSO
umount2(2), libpam(3LIB), pam(3PAM), pam_sm_chauthtok(3PAM),
pam_sm_setcred(3PAM), pam.conf(5), attributes(7), zfs(8), zfs_en‐
crypt(8)
HISTORY
The pam_zfs_key module was introduced in Oracle Solaris 11.0.0.
Oracle Solaris 11.4 15 Mar 2023 pa...y(7)