Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have several Linux servers that authenticate Linux user passwords on our Windows Active Directory Server using PAM and Kerberos 5. The Linux distro we use is CentOS 6.

On one system, we have several Version Control Systems like CVS and Subversion, both of which authenticate users throug PAM, such that users can use their normal Unix resp. Windows AD accounts.

Since we started using Kerberos for password authentication, we experienced that CVS on a client machine is often much slower in establishing a connection. CVS authenticates the user on every request (eg. cvs diff, log, update...).

Is is possible to cache the credentials that kerberos uses, sucht that is does not need to ask the Windows AD server every time a user executes a cvs action?

Our PAM config /etc/pam.d/system-auth looks like the following:

auth        required
auth        sufficient nullok try_first_pass
auth        requisite uid >= 500 quiet
auth        sufficient use_first_pass
auth        required

account     required broken_shadow
account     sufficient uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore]
account     required

password    requisite try_first_pass retry=3
password    sufficient md5 shadow nullok try_first_pass use_authtok
password    sufficient use_authtok
password    required

session     optional revoke
session     required
session     [success=1 default=ignore] service in crond quiet use_uid
session     required
session     optional
share|improve this question
Nscd should solve your problem. – Mateusz Kwiatkowski Sep 17 '12 at 13:22
@MateuszKwiatkowski, no it won't. nscd stands for 'Name Service Caching Daemon', it does not cache Kerberos passwords. – wzzrd Sep 17 '12 at 14:30

2 Answers 2

up vote 2 down vote accepted

A program called 'sssd' can cache (Kerberos) credentials for offline (and cached) logins. I am not sure whether sssd will use cached Kerberos credentials when it's operating normally (i.e. when it's not offline), you would have to try that out.

More information about sssd here.

share|improve this answer
yes, for that in redhat 6 sssd is the default – c4f4t0r Jul 21 '14 at 19:29

Any authentication via PAM will always have this problem. The only way to avoid it is to kerberize the service itself, rather use a pam stack to implement authentication.

One way to do this would be to use ssh to access the cvs repository and use kerberos to authenticate to ssh. ( google ssh GSSAPI ).

There are kerberized versions of the CVS server if you don't want to allow ssh acccess to the servers hosting the cvs repository. For an example, see

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.