Kerberos and PAM

Currently, kerberized services do not make use of Pluggable Authentication Modules (PAM) — kerberized servers bypass PAM completely. However, applications that use PAM can make use of Kerberos for authentication if the pam_krb5 module (provided in the pam_krb5 package) is installed. The pam_krb5 package contains sample configuration files that allow services like login and gdm to authenticate users and obtain initial credentials using their passwords. If access to network servers is always done using kerberized services or services that use GSS-API, like IMAP, the network can be considered reasonably safe.

Careful administrators will not add Kerberos password checking to all network services because most of the protocols used by these services do not encrypt the password before sending it over the network. The next section describes how to set up a basic Kerberos server.