Hi:
How can I unsubscribe to the pam list?
Thanks
--- Scott Ruckh <sruckh@xxxxxxxxxxx> wrote:
> lists@xxxxxxxxxxx wrote:
> > I have been attempting to enable pam_cracklib to
> check a password in a password history file with no
> luck. No matter what I seem to try, nothing is ever
> added to the opasswd file. I have tried this on
> several stations with no luck so I must be missing
> something. I have been following the documentation
> a the following URL:
> > www.deer-run.com/~hal/sysadmin/pam_cracklib.html
> >
> > The problem is I can't seem to get it to work.
> So, I loaded up a test machine from scratch using
> RHEL 4.4 with all updates as of 3-14-07. I then did
> the following:
> >
> > 1.) touch /etc/security/opasswd {creates the
> necessary old password file}
> > 2.) chown root:root /etc/security/opasswd
> > 3.) chmod 600 /etc/security/opasswd
> > Note I have opened the permissions up on this file
> for testing with no more luck.
> > 4.) I modified the system-auth file which I'm
> pretty sure is the file this flavor of Linux uses
> with the following line:
> > password sufficient
> /lib/security/$ISA/pam_unix.so nullok use_authtok
> md5 shadow remember=12
> >
> >
> > Here is the entire file. The only thing changed
> from the default file is the line above. I simply
> added remember=12 to it.
> >
> > #%PAM-1.0
> > # This file is auto-generated.
> > # User changes will be destroyed the next time
> authconfig is run.
> > auth required
> /lib/security/$ISA/pam_env.so
> > auth sufficient
> /lib/security/$ISA/pam_unix.so likeauth nullok
> > auth required
> /lib/security/$ISA/pam_deny.so
> >
> > account required
> /lib/security/$ISA/pam_unix.so
> > account sufficient
> /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
> > account required
> /lib/security/$ISA/pam_permit.so
> >
> > password requisite
> /lib/security/$ISA/pam_cracklib.so retry=3
> > password sufficient
> /lib/security/$ISA/pam_unix.so nullok use_authtok
> md5 shadow remember=12
> > password required
> /lib/security/$ISA/pam_deny.so
> >
> > session required
> /lib/security/$ISA/pam_limits.so
> > session required
> /lib/security/$ISA/pam_unix.so
> >
> > If I change the line above from sufficient to
> required as in the example on the site referenced
> above such as follows:
> > password sufficient
> /lib/security/$ISA/pam_unix.so nullok use_authtok
> md5 shadow remember=12
> >
> > I then get the error:
> > passwd: Authentication token manipulation error
> > {This tells me I must be editing the correct file}
> >
> > What do I need to do to create the password
> history file using pam_cracklib?
> >
> > _______________________________________________
> > Pam-list mailing list
> > Pam-list@xxxxxxxxxx
> > https://www.redhat.com/mailman/listinfo/pam-list
> >
> >
> Kyle, I believe you need to add your 'remember=12'
> flag to the account
> section and not where you have it now (in the
> password section).
>
> I don not believe this section from the Linux Pam
> Administrators' Guide
> is very clear.
>
> The account component performs the task of
> establishing the status of
> the user's account and password based on the
> following shadow elements:
> expire, last_change, max_change, min_change,
> warn_change. In the case of
> the latter, it may offer advice to the user on
> changing their password
> or, through the PAM_AUTHTOKEN_REQD return, delay
> giving service to the
> user until they have established a new password. The
> entries listed
> above are documented in the shadow(5) manual page.
> Should the user's
> record not contain one or more of these entries, the
> corresponding
> shadow check is not performed.
>
> _______________________________________________
> Pam-list mailing list
> Pam-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/pam-list
>
____________________________________________________________________________________
Don't get soaked. Take a quick peek at the forecast
with the Yahoo! Search weather shortcut.
http://tools.search.yahoo.com/shortcuts/#loc_weather
_______________________________________________
Pam-list mailing list
Pam-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/pam-list
