New answers tagged

1

It will create the homedir at whatever location is listed as the users homedir, there is no "default". Everything else doesn't make any sense. If you want Alice's home directory to be /nfs/home/alice, put it into the LDAP record.


0

No schema change is required for Authentication - posixAccount, posixGroup etc work fine for me. I haven't implemented sudo in ODSEE, but did research the topic a while ago. There's loads of documentation online - see the sudo LDAP documentation or Solaris community forums for the current schema extensions.


1

For some reason, users which are not members of the gauth group are able to log into the machine without supplying any password at all You removed from the PAM stack @include common-auth line in the start, which takes care of normal authentication. If I am right, PAM checks all auth mechanisms in the PAM stack and if one of them "allows" connection (...


1

When playing around with the PAM stack I usually do not use the service, that I in fact want to modify, since this is a "productive" service. So in this case I would test with /etc/pam.d/login instead of ssh. login can be tested by simply calling: login If the PAM config looks good, I can transfer it to gdm, ssh or whatever. (Who needs a local login ;-) ...


0

You need to use multiple Match Group directives: Match Group foo # blah settings Match Group bar # blah settings ... Standard settings


0

maybe the exact question is how to configure pam to disallow passwords? Correct. You've already stumbled upon the fact that setting UsePAM no is generally bad advice. Not only does it prevent any form of PAM based authentication, it also disables account and session modules. Access control and session configuration are good things. First, let's build a ...


0

One of the pam modules have made the password null and it is passed to the pam_unix. Once I fixed it, it started working fine. Thanks.


2

Edit: Based on the contents of the provided account stack, it looks like pam_krb5.so will be skipped if pam_localuser.so succeeds. This is the most likely cause of the password aging restrictions not being applied. Here's what we know so far: The logged messages confirm that the user's password has expired. pam_krb5 succeeds in authentication despite ...



Top 50 recent answers are included