LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide

with LDAP-UX Client Services B.04.00, pam_authz has been enhanced to allow system

administrators to configure and customize their local access rules in a local policy file,

/etc/opt/ldapux/pam_authz.policy. pam_authz uses these access control rules

defined in the local policy file to control the login authorization. Because pam_authz doesn't

provide authentication, it doesn't verify if a user account exists.

If the /etc/opt/ldapux/pam_authz.policy file does not exist in the system, pam_authz

performs access control based on the netgroup information found in the /etc/passwd and

/etc/netgroup files. If the /etc/opt/ldapux/pam_authz.policy file exists in the

system, pam_authz uses the access rules defined in the policy file to determine who can

For detailed information on this feature and how to configure the

/etc/opt/ldapux/pam_authz.policy file, see “PAM_AUTHZ Login Authorization ”

(page 106) or the pam_authz(5) man page.

• Do you want to configure the /etc/opt/ldaux/pam_authz.policy to enforce account

and password policies, stored in an LDAP directory server.

LDAP-UX provides pam_authz enhancement to support enforcement of account and

password policies, stored in an LDAP directory server. This feature works in conjunction

with SSH (Secure Shell), r-commands with rhost enabled where authentication is not

performed via the PAM subsystem, but is performed by the command itself.

For detailed information on this feature and how to configure the pam_authz.policy file,

see the “Security Policy Enforcement with Secure Shell (SSH) or r-commands” (page 118)

section for details.

• How will you increase the security level of the product to prevent an unwanted user from

logging in to the system using LDAP? What is the procedure to set up increased login

security?

The default is to allow all users stored in the LDAP directory to login. To disallow specific

users to login to a local system, you will have to configure the disable_uid_range flag

in /etc/opt/ldapux/ldapux_client.conf file. There are two sections in this file, the

[profile] section and the [NSS] section. HP recommends not editing the [profile] section. The

[NSS] section contains the disable_uid_range flag, along with two logging flags. For

example, the flag might look like:

disable_uid_range=0-100, 300-450, 189

Another common example would be to disable root access. This flag would look like:

disable_uid_range=0

This flag will prevent the users who have UNIX UIDs between 0 to 100, 300 to 450, or 189

from logging in to the local system.

When the disable_uid_range is turned on, the disabled uid will not be displayed when

you run commands such as pwget, listusers, logins,and so on.

NOTE: The passwdcommand may still allow you to change a password for a disabled

user when alternative authentication methods, such as PAM Kerberos, are used since LDAP

does not control these subsystems.

• How will you communicate with your user community about the change to Active Directory?

For the most part, your user community should be unaffected by the directory. Most HP-UX

commands will work as always.

Check the LDAP-UX Integration Release Notes for any other limitations and any solutions

that have been developed to workaround them.

Planning Your Installation 29