pam-krb5 is a Kerberos v5 PAM module for either MIT Kerberos or
Heimdal. It supports ticket refreshing by screen savers, configurable
authorization handling, authentication of non-local accounts for
network services, password changing, and password expiration, as well
as all the standard expected PAM features. It works correctly with
OpenSSH, even with ChallengeResponseAuthentication and
PrivilegeSeparation enabled, and supports extensive configuration
either by PAM options or in krb5.conf or both. PKINIT is supported
with recent versions of both MIT Kerberos and Heimdal and FAST is
supported with recent MIT Kerberos.
This module is not the Kerberos v5 PAM module maintained on Sourceforge and
used on Red Hat systems. It is an independent implementation that, if
it ever shared any common code, diverged long ago. It supports some
features that the Sourceforge module does not (particularly around
authorization), and does not support some options (particularly ones not
directly related to Kerberos v5) that it does. This module will never
support Kerberos v4 or AFS.