LDAP-UX Client Services B.04.00 Administrator's Guide

Administering LDAP-UX Client Services

Integrating with Trusted Mode

Chapter 4 105

Integrating with Trusted Mode

This section describes features and limitations, PAM conﬁguration

changes and conﬁguration parameter for integrating LDAP-UX with

Trusted Mode.

Overview

LDAP-UX Client Services B.03.30 or later supports coexistence with

Trusted Mode. This means that local-based accounts can beneﬁt from the

Trusted Mode security policies, while LDAP-based accounts beneﬁt from

the security policies offered by the LDAP server. This release of

LDAP-UX also enables LDAP-based and local-based accounts to be

audited on the Trusted Mode.

The coexistence of LDAP-UX and Trusted Mode supports certain

security features, but also has limitations and usage requirements that

you need to be aware of. For detailed information, see “Features and

Limitations” on page 105.

Features and Limitations

This subsection describes features and limitations of integrating

LDAP-UX with Trusted Mode.

Auditing

Integrating LDAP-UX with Trusted Mode enables accounts stored in the

LDAP directory to login to a local host and to be audited on the Trusted

Mode. The following describes the auditing features and limitations. To

use these security features, you must enable the audit subsystem on the

Trusted Mode local host:

• Auditing of both LDAP-based and local-based (/etc/passwd)

accounts is possible. By default, auditing is disabled for all

LDAP-based accounts. However, you can use the audusr (option -a

or -d) command to alter the auditing ﬂag for individual LDAP-based

account.

• For LDAP-based accounts that are not yet known to the system, you

can conﬁgure an initial setting for the auditing ﬂag. You can

conﬁgure this ﬂag such that when an account becomes known to the