Sunbelt Computer Software

Description:
PAM_VIP is a Pluggable Authentication Module for use in the AUTH layer of a PAM stack. This
module imposes a further restriction on authenticating users by requiring valid two-factor
verification with Verisign's VIP service.

Use:
In order to require two-factor authentication, add this module to the appropriate position
in the desired service's module stack in "/etc/pam.d/". If debugging output is desired, you must
specify "debug" in the same row, immediately after the module name. When debugging is enabled,
debug messages are written to "/tmp/sshd.log", unless this path has been changed in the config file.
Credentials should be entered in the form: <username>, <password::viptoken>. That is, your password and
VIP OTP (one-time-password) should be concatenated together and input as the user's password. After the
module has run, the user's password (without the OTP) has been set as the value of PAM_AUTHTOK for
use by other auth modules lower in the stack.

Configuration:
System-specific variables should be set in pam_vip.conf (see provided example), and are 
labeled accordingly. This file should be located at /etc/pam_vip.conf, or the path must
be adjusted in the source. Unless you are implementing a DB protocol besides LDAP, you
just need to specify the url of your ldap server, as well as the CN format for accounts
on the server (a little more on the ldap server later).

You must obtain a "production" certificate from verisign for the purpose of secure
interaction with VIP servers. The path to this certificate must be specified in pam_vip.conf.
Furthermore, you must also specify the passphrase for your machine's private ssl cert. The
other variables (vipurl,tokenlength) should remain static, barring a change in the vip service
standards. 

Requirements:
pam_vip requires the following be installed on your machine:
-openldap
-libxml2
-curl
-libconfuse
-linux-PAM, obviously 
-You must have a secure database which contains users' CredentialIDs for the vip service. Unless adjusted
	in the source, CredentialID's should be stored in the "Description" attribute under the user's
	"personal" tab. The format of DN's (Distinguished Names) for ldap accounts must be specified under
	the "DNformat" field in the configuration file.	At this	time LDAP is the only DB type supported,
	but functionality for other protocols may be easily added to the source and then specified in the
	config file.


Licensing Information:
Copyright (C) 2010 Joshua Quist

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.