PAM_OCIFBSD(8) FreeBSD System Manager's Manual PAM_OCIFBSD(8)

pam_ocifbsd — ocifbsd PAM authentication module

[service-name]


pam_ocifbsd [args ...]

The pam_ocifbsd module authenticates users against the ocifbsd(8) user registry and enforces RBAC role bindings and rate limits. It is intended to be referenced from a service's PAM configuration file in /etc/pam.d/.

The module implements the auth and account PAM service primitives. The auth primitive verifies the supplied credentials against the ocifbsd user registry, optionally backed by LDAP or Kerberos when configured. The account primitive rejects locked or otherwise disabled accounts.

The module is typically stacked after pam_unix(8) or a similar local-files provider so that ocifbsd acts as a secondary check that can impose cluster-wide policy on top of the host's existing user database.

/etc/pam.d/*
Per-service PAM configuration.
/var/run/ocifbsd/users
User registry directory.
/var/run/ocifbsd/audit.log
Append-only audit log written for every authentication attempt.

ocifbsd(8), pam.conf(5), pam.d(5), pam_unix(8)

The pam_ocifbsd module first appeared in FreeBSD 16.0.

The pam_ocifbsd module was developed by Klara, Inc. under sponsorship from

FreeBSD 15.1-STABLE June 5, 2026 PAM_OCIFBSD(8)