Re: Passwords in OpenLDAP - another question

[Christian DUCLOU <Christian.Duclou@eeigm.inpl-nancy.fr>]

Hi,

Jadick, Joe a écrit:

> Brent,
>
> I apologize for not getting back to you sooner but I was on vacation; 
> then working on other stuff.
>
> Most of what I have read seems to indicate that you add an entry like 
> this to the /etc/pam.d/sshd file:
>
> auth sufficient /lib/security/pam_ldap.so
>
> in front of the default entry:
>
> auth required /lib/security/pam_unix.so shadow nullok use_first_pass
>
> Also, it looks like you make a similar change to the account entry.
>
> However, my /etc/pam.d/sshd file (RedHat 8.0) looks like this:
>
> [root@anadts41 pam.d]# cat sshd
> #%PAM-1.0
> auth       required     /lib/security/pam_stack.so service=system-auth
> auth       required     /lib/security/pam_nologin.so
> account    required     /lib/security/pam_stack.so service=system-auth
> password   required     /lib/security/pam_stack.so service=system-auth
> session    required     /lib/security/pam_stack.so service=system-auth
> session    required     /lib/security/pam_limits.so
> session    optional     /lib/security/pam_console.so
> [root@anadts41 pam.d]#
>
> I haven't been able to find a definition of what pam_stack.so is (in 
> the Linux-PAM System Administrators' Guide, for example) so I don't 
> know if this is correct or not.
pam_stack.so work as an include directive, so library defined in 
"/etc/pam.d/system_auth file are stacked in place where "pam_stack.so" is.

BEWARE: several (all??) pam.d/<files> use stack_pam.so and by the way 
open authention with LDAP for these services.

Samples (RedHat)
Suppose the system_auth file content is:

## File /etc/pam.d/system-auth
#%PAM-1.0
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/pam_ldap.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so
account     sufficient    /lib/security/$ISA/pam_localuser.so
account     [default=bad success=ok user_unknown=ignore 
service_err=ignore system_err=ignore]   /lib/security/pam_ldap.so


password    required      /lib/security/$ISA/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/$ISA/pam_unix.so nullok 
use_authtok md5
shadow
password    sufficient    /lib/security//pam_ldap.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_ldap.so


and also
## File /etc/pam.d/su
#%PAM-1.0
auth       sufficient   /lib/security/$ISA/pam_rootok.so
auth       required     /lib/security/$ISA/pam_stack.so service=system-auth
account    required     /lib/security/$ISA/pam_stack.so service=system-auth
password   required     /lib/security/$ISA/pam_stack.so service=system-auth
session    required     /lib/security/$ISA/pam_stack.so service=system-auth
session    optional     /lib/security/$ISA/pam_xauth.so


> Thanx for any assistance anyone can provide a PAM/LDAP newbee (in case 
> that wasn't evident from my question!).
>
> Joe
>
>
>
>
> -----Original Message-----
> From: Brent Kearney [mailto:brent@kearneys.ca]
> Sent: Tuesday, June 24, 2003 2:51 PM
> To: Jadick, Joe
> Cc: openldap-software@OpenLDAP.org
> Subject: Re: Passwords in OpenLDAP - another question
>
>
> On Tue, Jun 24, 2003 at 02:11:03PM -0700, Jadick, Joe wrote:
> > Hi,
> >
> > I have a follow-up question to the original thread.
> >
> > My environment is Red Hat Linux, 8.0 with OpenLDAP 2.1.17.
> >
> > I added a user via useradd; migrated him to LDAP using the migration 
> tools;
> > and then deleted him via userdel.
> >
> > I find that I can su to this account from another one and, after 
> providing
> > the password, everything works OK.
> >
> > Also, the getent and ldapsearch displays seem to be correct (both 
> when the
> > user was in LDAP and files and after I deleted him from files).
> >
> > However, when I try to log into the account directly using SSH it won't
> > accept the password.
> >
> > Any ideas what I'm doing wrong?
>
> Have you modified the /etc/pam.d/* files appropriately (specifically,
> the one for ssh)?
>
> Brent
>
>
> --
> http://oss.netmojo.ca/
>
> **********************************************************************
>
> This message contains confidential information intended only for the 
> use of the addressee(s)
>
> named above and may contain information that is legally privileged.  
> If you are not the
>
> addressee, or the person responsible for delivering it to the 
> addressee, you are hereby
> notified that reading, disseminating, distributing or copying this 
> message is strictly prohibited. 
>
> If you have received this message by mistake, please immediately 
> notify us by replying to the
>
> message and delete the original message immediately thereafter.
>
>  
>
> Thank 
> you.                                                                                                       
> FADLD Tag
> **********************************************************************