LDAP-UX Client Services B.04.00 with Microsoft Windows 2000/2003 Active Directory Administrator's Guide

Administering LDAP-UX Client Services

Integrating with Trusted Mode

Chapter 486

Integrating with Trusted Mode

This section describes features and limitations, PAM conﬁguration

changes and conﬁguration parameter for integrating LDAP-UX with

Trusted Mode.

Overview

Starting with LDAP-UX Client Services B.03.30, the product supports

coexistence with Trusted Mode. This means that local-based accounts

can beneﬁt from the Trusted Mode security policies while LDAP-based

accounts beneﬁt from the security policies offered by the LDAP server.

This release of LDAP-UX provides extensive password and account

policies, and also enables LDAP-based and local-based accounts to be

audited on the Trusted Mode.

The coexistence of LDAP-UX and Trusted Mode supports certain

security features, but also has limitations and usage requirements that

you need to be aware of. For detailed information, see “Features and

Limitations” on page 86.

Features and Limitations

This subsection describes features and limitations of integrating

LDAP-UX with Trusted Mode.

Auditing

Integrating LDAP-UX with Trusted Mode enables accounts stored in the

LDAP directory to login to a local host and to be audited on the Trusted

Mode. The following describes the auditing features and limitations. To

use these security features, you must enable the audit subsystem on the

Trusted Mode local host:

• Auditing of both LDAP-based and local-based (/etc/passwd)

accounts is possible. By default, auditing is disabled for all

LDAP-based accounts. However, you can use the audusr (option -a

or -d) command to alter the auditing ﬂag for individual LDAP-based

account.