LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

Security Policy Enforcement with Secure Shell (SSH) or r-commands
PAM_AUTHZ has a limited ability to perform account and password security policy enforcement
without requiring LDAP-based authentication. This section provides information on how to
configure the security policy enforcement access rule, setup access permissions for global policy
attributes and configure PAM configuration file to support enforcement of account and password
policies, stored in an LDAP directory server, for applications such as SSH key-pair and
r-commands with rhost enabled.
This feature is designed to support applications such as SSH (Secure Shell) and the r-commands
(rlogin, rcp, etc..) with .rhost enabled. With these applications, authentication is not performed
via PAM (Pluggable Authentication Module) subsystem, but is performed by the command itself.
In these applications, when authentication is not performed by PAM, the LDAP directory server
is not given the opportunity to provide security policy enforcement, which normally occurs
during the LDAP authentication process.
To configure and use this feature for SSH key-pair or r-commands, you must perform the following
tasks:
• Set security policy enforcement access rule in the /etc/opt/ldapux/pam_authz.policy
file. See the“Security Policy Enforcement Access Rule ” (page 118) section for details.
• Set access permissions for global policy attributes. See the “Configuring Access Permissions
for Global Policy Attributes” (page 119) section for details.
• Configure the pam_authz library in the /etc/pam.conf file for the sshd and rcomds
services under the account management role. See the “Configuring PAM Configuration
File” (page 119) section for details.
Security Policy Enforcement Access Rule
Specifying status in the <action> field of a pam_authz.policy access rule triggers use of the
account and password security policy enforcement rule. When this rule is evaluated,
PAM_AUTHZ will call the <function_name> in the library specified by the <library_name>
field. PAM_AUTHZ returns the value which is one of the PAM return codes described in the
“PAM Return Codes ” (page 120) section below.
This access rule consists of the following three fields:
<action>:<library_name>:<function_name>
Fields in the Access Rule:
The following describes each field of the above access rule:
action
When the status option is specified, PAM_AUTHZ returns whatever
<function_name> in the <library_name> returns, which is one of the PAM
return codes.
library_name This field specifies the name of the library to be loaded that supports the
account and password policies for a particular directory server.
The following describes the valid values for this field:
• rhds: If this option is specified, PAM_AUTHZ loads the
/opt/ldapux/lib/libpolicy_rhds library to process security
policy configuration and examine the user's security policy status
attributes, stored in the Netscape/Red Hat Directory Server.
• ads: If this option specified, PAM_AUHZ loads
/opt/ldapux/lib/libpolicy_ads library to process security
policy configuration and examine the user's security policy status
attributes, stored in the Windows 2000, 2003 or 2003 R2 Active
Directory Server.
118 Administering LDAP-UX Client Services