LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

with LDAP-UX Client Services B.04.00, pam_authz has been enhanced to allow system
administrators to configure and customize their local access rules in a local policy file,
/etc/opt/ldapux/pam_authz.policy. pam_authz uses these access control rules
defined in the local policy file to control the login authorization. Because pam_authz doesn't
provide authentication, it doesn't verify if a user account exists.
If the /etc/opt/ldapux/pam_authz.policy file does not exist in the system, pam_authz
performs access control based on the netgroup information found in the /etc/passwd and
/etc/netgroup files. If the /etc/opt/ldapux/pam_authz.policy file exists in the
system, pam_authz uses the access rules defined in the policy file to determine who can
login to the system.
For detailed information on this feature and how to configure the
/etc/opt/ldapux/pam_authz.policy file, see “PAM_AUTHZ Login Authorization ”
(page 106) or the pam_authz(5) man page.
• Do you want to configure the /etc/opt/ldaux/pam_authz.policy to enforce account
and password policies, stored in an LDAP directory server.
LDAP-UX provides pam_authz enhancement to support enforcement of account and
password policies, stored in an LDAP directory server. This feature works in conjunction
with SSH (Secure Shell), r-commands with rhost enabled where authentication is not
performed via the PAM subsystem, but is performed by the command itself.
For detailed information on this feature and how to configure the pam_authz.policy file,
see the “Security Policy Enforcement with Secure Shell (SSH) or r-commands” (page 118)
section for details.
• How will you increase the security level of the product to prevent an unwanted user from
logging in to the system using LDAP? What is the procedure to set up increased login
security?
The default is to allow all users stored in the LDAP directory to login. To disallow specific
users to login to a local system, you will have to configure the disable_uid_range flag
in /etc/opt/ldapux/ldapux_client.conf file. There are two sections in this file, the
[profile] section and the [NSS] section. HP recommends not editing the [profile] section. The
[NSS] section contains the disable_uid_range flag, along with two logging flags. For
example, the flag might look like:
disable_uid_range=0-100, 300-450, 189
Another common example would be to disable root access. This flag would look like:
disable_uid_range=0
This flag will prevent the users who have UNIX UIDs between 0 to 100, 300 to 450, or 189
from logging in to the local system.
When the disable_uid_range is turned on, the disabled uid will not be displayed when
you run commands such as pwget, listusers, logins,and so on.
NOTE: The passwdcommand may still allow you to change a password for a disabled
user when alternative authentication methods, such as PAM Kerberos, are used since LDAP
does not control these subsystems.
• How will you communicate with your user community about the change to Active Directory?
For the most part, your user community should be unaffected by the directory. Most HP-UX
commands will work as always.
Check the LDAP-UX Integration Release Notes for any other limitations and any solutions
that have been developed to workaround them.
Planning Your Installation 29