LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

Changing Authentication methods...............................................................................................105
PAM_AUTHZ Login Authorization ..................................................................................................106
Policy And Access Rules................................................................................................................106
How Login Authorization Works..................................................................................................106
PAM_AUTHZ Supports Security Policy Enforcement..................................................................108
Authentication using LDAP.....................................................................................................108
Authentication with Secure Shell (SSH) and r-commands......................................................108
Policy File.......................................................................................................................................109
Policy Validator..............................................................................................................................110
An Example of Access Rule Evaluation...................................................................................110
Dynamic Variable Support............................................................................................................110
Constructing an Access Rule in pam_authz.policy.......................................................................111
Fields in an Access Rule...........................................................................................................111
Static List Access Rule....................................................................................................................114
Dynamic Variable Access Rule .....................................................................................................116
Supported Functions for Dynamic Variables...........................................................................116
Examples..................................................................................................................................116
Security Policy Enforcement with Secure Shell (SSH) or r-commands.........................................118
Security Policy Enforcement Access Rule ...............................................................................118
An example of Access Rules...............................................................................................119
Configuring Access Permissions for Global Policy Attributes.................................................119
Configuring PAM Configuration File......................................................................................119
Evaluating the Windows Active Directory Server Security Policy..........................................120
PAM Return Codes ..................................................................................................................120
Directory Server Security Policies............................................................................................121
Adding Additional Domain Controllers.............................................................................................122
Adding Users, Groups, and Hosts......................................................................................................122
User and Group Management............................................................................................................124
LDAP User and Group Command-Line Tools..............................................................................124
Listing Users..................................................................................................................................126
Listing Groups...............................................................................................................................127
Adding a User or a Group.............................................................................................................129
Examples of Adding a User .....................................................................................................129
Examples of Adding a Group...................................................................................................131
Modifying Defaults in /etc/opt/ldapux/ldapug.conf ...............................................................132
Modifying a User ..........................................................................................................................133
Modifying a Group........................................................................................................................134
Deleting a User or a Group............................................................................................................135
Examples..................................................................................................................................136
Checking LDAP-UX Configuration ..............................................................................................137
Checking if LDAP-UX is Configured.......................................................................................137
Listing Available Templates.....................................................................................................138
Discovering Required Attributes.............................................................................................138
Displaying Configuration Defaults..........................................................................................138
Displaying the LDAP-UX Profile's DN....................................................................................139
Displaying Default Search Base...............................................................................................139
Displaying Recommended Attributes......................................................................................139
Displaying Attribute Mapping for a Specific Name Service....................................................140
Displaying the Proxy User's Distinguished Name.............................................................................141
Verifying the Proxy User.....................................................................................................................141
Creating a New Proxy User................................................................................................................141
Example.........................................................................................................................................141
Displaying the Current Profile............................................................................................................141
Creating a New Profile........................................................................................................................142
Modifying a Profile.............................................................................................................................142
6 Table of Contents