pam@xxxxxxxxxxxx wrote:
>> session required pam_stack.so service=system-auth
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>Check and see which modules are getting pulled in by these calls to
>pam_stack.so. Look at /etc/pam.d/system-auth.
>
>Red Hat, RH-derived, and a number of other systems use this to allow easy
>changes to the authentication method(s) usable by ALL (or most) services.
>
>-kgd
Here's what it looks like:
#%PAM-1.0
auth required /lib/security/pam_env.so
auth sufficient /lib/security/pam_unix.so likeauth nullok
auth required /lib/security/pam_deny.so
account required /lib/security/pam_unix.so
password required /lib/security/pam_cracklib.so retry=3
password sufficient /lib/security/pam_unix.so nullok md5 shadow use_authtok
password required /lib/security/pam_deny.so
session required /lib/security/pam_limits.so
session required /lib/security/pam_unix.s0
I'm assuming all the magic is happening in pam_unix. A quick look at /usr/doc/pam-0.77/modules/README.pam_unix.gz shows the possible options as:
The following options are recognized:
debug - log more debugging info
audit - a little more extreme than debug
use_first_pass - don't prompt the user for passwords
take them from PAM_ items instead
try_first_pass - don't prompt the user for the passwords
unless PAM_(OLD)AUTHTOK is unset
use_authtok - like try_first_pass, but * fail * if the new
PAM_AUTHTOK has not been previously set.
(intended for stacking password modules only)
not_set_pass - don't set the PAM_ items with the passwords
used by this module.
shadow - try to maintian a shadow based system.
md5 - when a user changes their password next,
encrypt it with the md5 algorithm.
bigcrypt - when a user changes their password next,
excrypt it with the DEC C2 - algorithm(0).
nodelay - used to prevent failed authentication
resulting in a delay of about 1 second.
nis - use NIS RPC for setting new password
remember=X - remember X old passwords, they are kept in
/etc/security/opasswd in MD5 crypted form
broken_shadow - ignore errors reading shadow information for
users in the account management module
None of these options jump out as being much help. I've seen web docs that talk about an skey pam modules but there all so old. Furthermore I don't see them in /etc/pam.d and skey works (just not without getting a passwd prompt first).
Thanks,
_______________________________________________
Pam-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/pam-list
