[ale] [Fwd: Re: OpenLDAP: So close and yet so far]

[jim.kinney at gmail.com (Jim Kinney)]

move the pam_ladp line up one. The line above it will always capture
an event and the ldap line is never called. pam is a sequential
process down the chain.

In fact, if you want to tighten the security, put the pam_deny line
before any "sufficient" lines in auth.

On Wed, Jun 3, 2009 at 12:36 PM, Jeff Hubbs<jeffrey.hubbs at gmail.com> wrote:
> Jerald -
>
> That line is in there...in fact, let me paste the whole system-auth file:
>
> #%PAM-1.0
>
> auth??????????? required??????? pam_env.so
> auth??????????? sufficient????? pam_unix.so try_first_pass likeauth nullok
> auth??????????? sufficient????? pam_ldap.so use_first_pass
> auth??????????? required??????? pam_deny.so
>
> account???????? required??????? pam_unix.so
> account???????? sufficient????? pam_ldap.so
>
> password??????? required??????? pam_cracklib.so difok=2 minlen=8 dcredit=2
> ocredit=2 try_first_pass retry=3
> password??????? sufficient????? pam_unix.so try_first_pass nullok md5 shadow
> use_authtok
> password??????? sufficient????? pam_ldap.so use_authtok
> password??????? required??????? pam_deny.so
>
> session???????? required??????? pam_limits.so
> session???????? required??????? pam_unix.so
> session???????? optional??????? pam_ldap.so
>
>
>>
>>
>> Also, to let pam know about ldap, look for a line like so:
>>
>> auth??????? sufficient??? pam_ldap.so use_first_pass
>>
>> in /etc/pam.d/system-auth
>>
>> Also, if you want to have home directories automagically made for
>> first-time logins, you need:
>>
>> session???? required????? pam_mkhomedir.so
>
> Cool trick - dunno if I'll use that now but it's good to know.
>
> Thanks,
> Jeff
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
>
>



-- 
-- 
James P. Kinney III
Actively in pursuit of Life, Liberty and Happiness