Pam ldap

Anpassen der Pam

Die Authentifizierung(installation nimmt einstellung schon vor)

• cat /etc/pam.d/common-auth

auth    [success=2 default=ignore]      pam_unix.so nullok
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so

Das Accounting

• cat /etc/pam.d/common-account

account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 default=ignore]      pam_ldap.so
account requisite                       pam_deny.so
account required                        pam_permit.so

Passwort änderungen

use_authtok gegebenfalls entfernen

• cat /etc/pam.d/common-password

password        [success=2 default=ignore]      pam_unix.so obscure yescrypt
password        [success=1 user_unknown=ignore default=die]     pam_ldap.so try_first_pass
password        requisite                       pam_deny.so
password        required                        pam_permit.so

Die Session

• cat /etc/pam.d/common-session

session [default=1]                     pam_permit.so
session requisite                       pam_deny.so
session required                        pam_permit.so
session required pam_mkhomedir.so  skel=/etc/skel umask=0022  
session required                        pam_unix.so
session optional                        pam_ldap.so
session optional                        pam_systemd.so

Anmeldung mit Gruppenrichtlinien (optional)

/etc/ldap.conf
pam_groupdn cn=it,ou=groups,dc=xinux,dc=net
pam_member_attribute member

su -

• su - thomas