Black Box ACS120 User's Guide download pdf (Page 347)

Appendix D - Linux-PAM

User Guide 347

Directory-based Configuration

It is possible to configure libpam via the contents of the /etc/ pam.d/ directory. This is more

flexible than using the single configuration file. In this case, the directory is filled with files--

each of which has a filename equal to a service-name (in lower-case)--the personal configura-

tion file for the named service. The BLACK BOX ® Advanced Console Server Linux-PAM was

compiled to use both

/etc/pam.d/ and /etc/pam.conf in sequence. In this mode, entries in /etc/pam.d/ override

those of /etc/pam.conf.

The syntax of each file in /etc/pam.d/ is similar to that of the /etc/pam.conf file and is made

up of lines of the following form:

module-type control-flag module-path arguments

try_first_pass The module should attempt authentication with the previously

typed password (from the preceding auth module). If that doesn’t

work, then the user is prompted for a password. (This option is

intended for auth modules only).

use_mapped_

pass

This argument is not currently supported by any of the modules in

the Linux-PAM distribution because of possible consequences

associated with U.S. encryption exporting restrictions.

expose_account In general, the leakage of some information about user accounts is

not a secure policy for modules to adopt. Sometimes information

such as user names or home directories, or preferred shell, can be

used to attack a user’s account. In some circumstances, however,

this sort of information is not deemed a threat: displaying a user’s

full name when asking them for a password in a secured

environment could- also be called being ‘friendly’. The

expose_account argument is a standard module argument to

encourage a module to be less discrete about account information

as deemed appropriate by the local administrator. Any line in (one

of) the configuration file(s), that is not formatted correctly will

generally tend (erring on the side of caution) to make the

authentication process fail. A corresponding error is written to the

system log files with a call to syslog(3).

1 2 ... 342 343 344 345 346 347 348 349 350 351 352 ... 449 450

No comments

Black Box ACS120 User's Guide Page 347