diff --git a/pkgs/os-specific/linux/pam_ccreds/default.nix b/pkgs/os-specific/linux/pam_ccreds/default.nix
new file mode 100644
index 000000000000..4d48c86dd142
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_ccreds/default.nix
@@ -0,0 +1,19 @@
+{stdenv, fetchurl, pam, openssl, db}:
+
+stdenv.mkDerivation {
+  name = "pam_ccreds-10";
+
+  src = fetchurl {
+    url = "http://www.padl.com/download/pam_ccreds.tgz";
+    sha256 = "1h7zyg1b1h69civyvrj95w22dg0y7lgw3hq4gqkdcg35w1y76fhz";
+  };
+  patchPhase = ''
+    sed 's/-o root -g root//' -i Makefile.in
+  '';
+
+  buildInputs = [pam openssl db];
+  meta = {
+    homepage = "http://www.padl.com/OSS/pam_ccreds.html";
+    description = "The pam_ccreds module provides the means for Linux workstations to locally authenticate using an enterprise identity when the network is unavailable.";
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8e5715aeb23c..e78c19362e29 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4727,6 +4727,10 @@ let
 
   # pam_bioapi ( see http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader )
 
+  pam_ccreds = callPackage ../os-specific/linux/pam_ccreds {
+    db = db4;
+  };
+
   pam_console = callPackage ../os-specific/linux/pam_console {
     libtool = libtool_1_5;
     flex = if stdenv.system == "i686-linux" then flex else flex2533;