-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/26/2010 01:35 AM, DJ Lucas wrote:
>
> Debian and Ubuntu
> are explicitly denying in the common-{account,auth,password} files to
> help and keep you from shooting yourself in the foot (accidental deny or
> other unintended failure). The option exists to do conditionals, so it
> would be something like the following for system-auth:
>
> # if auth in pam_unix is successful, jump over the next 1 lines
> auth [success=1 default=ignore] pam_unix.so
> # if we get here, deny and die
> auth requisite pam_deny.so
> # if we get this far (no requisite), always permit
> auth required pam_permit.so
>
> Any interest in that failsafe in BLFS?
>
Question still stands.
> Something similar to the following (actually taken mostly from Ubuntu)
> is what I would put into the book. Please note that I haven't tested
> this (close to existing book) basic configuration below as I have a much
> nastier looking PAM stack ATM that I haven't converted to use system-*
> (which would have been much easier when all was said and done):
OK...have tested now if anybody would like to report back. Works well
for me for both ldap and file auth:
system-auth:
==================================================================
# Begin /etc/pam.d/system-auth
auth required pam_unix.so
# End /etc/pam.d/system-auth
system-account:
==================================================================
# Begin /etc/pam.d/system-account
account required pam_unix.so
# End /etc/pam.d/system-account
system-password:
==================================================================
# Begin /etc/pam.d/system-password
# check new passwords for strength (man pam_cracklib)
password required pam_cracklib.so type=Linux retry=3 difok=5 \
diffignore=23 minlen=9 dcredit=1 \
ucredit=1 lcredit=1 ocredit=1 \
dictpath=/lib/cracklib/pw_dict
# use md5 hash for encryption, use shadow, and use the
# authentication token (chosen password) set by pam_cracklib
# above
password required pam_unix.so md5 shadow use_authtok
# End /etc/pam.d/system-password
system-session:
==================================================================
# Begin /etc/pam.d/system-session
session required pam_unix.so
# End /etc/pam.d/system-session
login:
==================================================================
# Begin /etc/pam.d/login
# Set failure delay before next prompt to 3 seconds
auth optional pam_faildelay.so delay=3000000
# Check to make sure that the user is allowed to login
auth requisite pam_nologin.so
# Check to make sure that root is allowed to login
auth required pam_securetty.so
# Additional group memberships - disabled by default
#auth optional pam_group.so
# include the default auth settings
auth include system-auth
# check access for the user
account required pam_access.so
# include the default account settings
account include system-account
# Set default environment variables for the user
session required pam_env.so
# Set resource limits for the user
session required pam_limits.so
# Display date of last login - Disabled by default
#session optional pam_lastlog.so
# Display the message of the day - Disabled by default
#session optional pam_motd.so
# Check user's mail - Disabled by default
#session optional pam_mail.so standard quiet
# Use xauth keys (if available)
session optional pam_xauth.so
# include the default session and password settings
session include system-session
password include system-password
# End /etc/pam.d/login
passwd:
==================================================================
# Begin /etc/pam.d/passwd
password include system-password
# End /etc/pam.d/passwd
su:
==================================================================
# Begin /etc/pam.d/su
# always allow root
auth sufficient pam_rootok.so
# include the default account settings
account include system-account
# Use xauth keys (if available)
session optional pam_xauth.so
# Set default environment variables for the service user
session required pam_env.so
# include system session defaults
session include system-session
# End /etc/pam.d/su
chage:
==================================================================
#Begin /etc/pam.d/chage
# always allow root
auth sufficient pam_rootok.so
# include system defaults for auth account and session
auth include system-auth
account include system-account
session include system-session
# Always permit for authentication updates
password required pam_permit.so
# End /etc/pam.d/chage
other:
==================================================================
# Begin /etc/pam.d/other
auth required pam_warn.so
auth required pam_deny.so
account required pam_warn.so
account required pam_deny.so
password required pam_warn.so
password required pam_deny.so
session required pam_warn.so
session required pam_deny.so
- -- DJ Lucas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
iQIcBAEBAgAGBQJMJ75lAAoJEIUM+xKzBYsIVusP/iIYSYGwkpnUE3m7RbMnwgEr
kCPumpD708givAuMGtUXUrvf0btEkob3J0QrsNOrOALWBkqucl8lU9mMmy+VaaHL
8n/EZ35MaCc1WR5SdBKVh8hi0/MhmvQ9w7tM4Mr4lKzLGgge0bUCWMGWrwdIxgzc
pk3n1VFTwlxUvWC2As6kLTRtXL8jKWWull5/9FzgmBnHzsug2Bbkd5LlOKBLCYbS
cV1c5RO3y3lMkUY6R5HLRunNab9GfadUHkRh7AcnRHl3TAJIb52xfAhEcdRR4ZCQ
HNtFSCEFF/1quKTuEhj8bwLKgPTnXCkTE6YC6pW6/AQ16NGekgZxXyapkH+g372w
s7xC4hzIPhuaxlMHPF5WIZy8+6IbiPjq1MgtPfkaf4iqVRRdsd8zNdjhuiptKsAn
TZLJR2+9cM9w8tSybxXXCuytgsWqpg7tGmrfeRrRAYNTfJPUTE+xC/KaRZg10QkO
zA1BusAFwdC7woxlpgJslGtPULlFzKa8Tsa7mAnDK6xPsCA1y679URd7uv6cSU1D
ZyMdWTxC9g6OZuH6x+AGDAOgKiQOifCRJrTRkFReqrZAZDAMsBcKJh+a3wSVkr+5
hOxhyfKazE7MVvCa6Sq5zIVf9zvFmpZ5GaDFjYgOXjIsHfir7nhrt4wXF9P46Qtw
yedsuFgzHXlS7/NPXt1p
=cCk7
-----END PGP SIGNATURE-----
--
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
--
http://linuxfromscratch.org/mailman/listinfo/blfs-dev
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page
