---
name: "gssproxy-mech"
section: "8"
platform: "linux"
package: "gssproxy"
version: "0.9.2-3"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/gssproxy-mech"
---

# gssproxy-mech(8)

GssProxy GSSAPI mechanism plugin

## NAME

gssproxy-mech - GssProxy GSSAPI mechanism plugin

## SYNOPSIS

**proxymech\_v1 2.16.840.1.113730.3.8.15.1 /usr/lib64/gssproxy/proxymech.so**  \[*options*\]

## DESCRIPTION

The gssproxy proxymech module is a interposer plugin that is loaded by GSSAPI. It is enabled by /etc/gss/mech configuration file.

The interposer plugin allows one to intercept the entire GSSAPI communication and detour to the **gssproxy** daemon. When the interposer plugin is installed two other conditions need to be met in order to activate it:

a) interposer configuration file

The plugin needs to be manually enabled in the /etc/gss/mech file.

b) gssproxy environment variable

With default build options the interposer plugin will not forward to the gssproxy daemon unless the environment variable named *GSS\_USE\_PROXY=yes*  is set.

This behavior default may be controlled at build time and can be set to always forward unless the environment variable is set to *GSS\_USE\_PROXY=no*

The current setting for always forwarding is: false

Furthermore, the interposer plugin can be configured to behave in different ways when called from the GSSAPI. This behavior is controlled via the *GSSPROXY\_BEHAVIOR* environment variable. It accepts four different values:

LOCAL\_ONLY

All commands received with this setting will cause to immediately reenter the GSSAPI w/o any interaction with the gssproxy daemon. When the request cannot be processed it will just fail.

LOCAL\_FIRST

All commands received with this setting will cause to immediately reenter the GSSAPI. When the local GSSAPI cannot process the request, it will resend the request to the gssproxy daemon.

REMOTE\_FIRST

All commands received with this setting will be forwarded to the gssproxy daemon first. If the request cannot be handled there, the request will reenter the local GSSAPI.

REMOTE\_ONLY

This setting is currently not fully implemented and therefore not supported.

The default setting for *GSSPROXY\_BEHAVIOR* is REMOTE\_FIRST.

Finally the interposer may need to use a special per-service socket in order to communicate with gssproxy. The path to this socket is set via the *GSSPROXY\_SOCKET* environment variable.

## SEE ALSO

[**gssproxy.conf**(5)](/gssproxy.conf/5.md) and [**gssproxy**(8)](/gssproxy/8.md).

## AUTHORS

**GSS-Proxy - http://fedorahosted.org/gss-proxy**