LDAP-UX Client Services B.05.01 Administrator Guide for HP directory servers and Windows ADS

ManualsBrandsHP ManualsSoftwareHP-UX LDAP-UX Integration Software

431

432

433

434

435

436

437

438

439

440

D.6 Sample PAM configuration file for security policy enforcement with

Windows ADS

This section provides a sample PAM configuration file to support account and password policy

enforcement for secure shell (ssh) key pairs and r-commands. The PAM_AUTHZ library must be

configured in the pam.conf file for the sshd and rcomds services under the account management

section. The PAM_AUTHZ library must be specified as required.

NOTE: The PAM_AUTHZ library should be configured in the pam.conf authentication

management and account management sections only. It should be listed before the PAM_LDAP or

PAM_KERBEROS libraries and flagged as required. In the following sample file, it is configured

in the account management section only.

For a list of all steps that you might need to perform to set up Kerberos support, see Section 3.4.2

(page 128).

# PAM configuration

# This pam.conf file is intended as an example only.

# see pam.conf(4) for more details

################################################################

# This sample file will authenticate the user who belongs to #

# either the Kerberos or Unix system. Using this configuration #

# file, if the user is authenticated through Kerberos, the Unix#

# authentication will not be invoked. However, if the Kerberos #

# authentication fails for the user, then the fallback #

# authentication mechanism PAM-Unix will be invoked to #

# authenticate the user. The assumption is the user is either #

# present in Kerberos or in Unix system. #

# #

# The module pam_hpsec is stacked as mandatory module above #

# all the modules for making security checks before #

# authentication. #

################################################################

# Authentication management

su auth required libpam_hpsec.so.1

su auth sufficient libpam_krb5.so.1

su auth required libpam_unix.so.1 try_first_pass

dtlogin auth required libpam_hpsec.so.1

dtlogin auth sufficient libpam_krb5.so.1

dtlogin auth required libpam_unix.so.1 try_first_pass

dtaction auth required libpam_hpsec.so.1

dtaction auth sufficient libpam_krb5.so.1

dtaction auth required libpam_unix.so.1 try_first_pass

ftp auth required libpam_hpsec.so.1

ftp auth sufficient libpam_krb5.so.1

ftp auth required libpam_unix.so.1 try_first_pass

rcomds auth required libpam_hpsec.so.1

rcomds auth sufficient libpam_krb5.so.1

rcomds auth required libpam_unix.so.1

OTHER auth required libpam_hpsec.so.1

OTHER auth required libpam_authz.so.1

OTHER auth required libpam_unix.so.1 try_first_pass

# Account management

su account required libpam_hpsec.so.1

su account required libpam_authz.so.1 policy=/etc/opt/ldapux/su.policy

432 Sample PAM configuration (pam.conf) files