Naming and Directory Services (DNS, NIS, and LDAP)

Configuring PAMpam_ldap is the authentication and account management PAM module for LDAP. Seethe pam_ldap(5) man page and Appendix A for more information about the featurescurrently supported with pam_ldap.Configuring PAM to Use UNIX policyTo configure PAM to use UNIX policy, follow the sample in “Example pam.confFile for pam_ldap” on page 199. Add the lines that contain pam_ldap.so.1 to theclient’s /etc/pam.conf file. For details, see the pam.conf(4) man page.Configuring PAM to Use LDAP server_policyTo configure PAM to use LDAP server_policy, follow the sample in “Examplepam_conf file for pam_ldap Configured for Account Management” on page 201. Addthe lines that contain pam_ldap.so.1 to the client’s /etc/pam.conf file. Inaddition, if any PAM module in the sample pam.conf file specifies the binding flagand the server_policy option, use the same flag and option for the correspondingmodule in the client’s /etc/pam.conf file. Also, add the server_policy option tothe line that contains the service module pam_authtok_store.so.1.Note – After you enable pam_ldap account management, all users must provide apassword any time they log in to the system. A login password is required forauthentication. Therefore, nonpassword-based logins using tools such as rsh,rlogin, orssh will fail.■■The binding control flagUsing the binding control flag allows a local password override of a remote(LDAP) password. For example, if a user account is found on both the local filesand the LDAP namespace, the password associated with the local account takesprecedence over the remote password. Thus, if the local password expires,authentication fails even if the remote LDAP password is still valid.The server_policy optionThe server_policy option instructs pam_unix_auth, pam_unix_account,and pam_passwd_auth to ignore a user found in the LDAP namespace and toallow pam_ldap to perform authentication or account validation. In the case ofpam_authtok_store, a new password is passed to the LDAP server withoutencryption. The password is thereby stored in the directory according to thepassword encryption scheme configured on the server. For more information, seepam.conf(4) and pam_ldap(5).184 System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) • January 2005