---
name: "pam_ksu"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/pam_ksu"
---

# pam\_ksu(8)

Kerberos 5 SU PAM module

## NAME

**pam\_ksu** – Kerberos 5 SU PAM module

## SYNOPSIS

\[*service-name*\] *module-type* *control-flag* *pam\_ksu* \[*options*\]

## DESCRIPTION

The Kerberos 5 SU authentication service module for PAM, **pam\_ksu** for only one PAM category: authentication. In terms of the *module-type* parameter, this is the “auth” feature. The module is specifically designed to be used with the [su(1)](/su/1.md) utility.

### Kerberos 5 SU Authentication Module

The Kerberos 5 SU authentication component provides functions to verify the identity of a user (**pam\_sm\_authenticate**()), and determine whether or not the user is authorized to obtain the privileges of the target account. If the target account is “root”, then the Kerberos 5 principal used for authentication and authorization will be the “root” instance of the current user, e.g. “user/root@REAL.M”. Otherwise, the principal will simply be the current user's default principal, e.g. “user@REAL.M”.

The user is prompted for a password if necessary. Authorization is performed by comparing the Kerberos 5 principal with those listed in the *.k5login* file in the target account's home directory (e.g. */root/.k5login* for root).

The following options may be passed to the authentication module:

- **debug**

  [syslog(3)](/syslog/3.md) debugging information at LOG\_DEBUG level.

- **use\_first\_pass**

  If the authentication module is not the first in the stack, and a previous module obtained the user's password, that password is used to authenticate the user. If this fails, the authentication module returns failure without prompting the user for a password. This option has no effect if the authentication module is the first in the stack, or if no previous modules obtained the user's password.

- **try\_first\_pass**

  This option is similar to the **use\_first\_pass** option, except that if the previously obtained password fails, the user is prompted for another password.

## SEE ALSO

[su(1)](/su/1.md), [pam(3)](/pam/3.md), [syslog(3)](/syslog/3.md), [pam.conf(5)](/pam.conf/5.md)