1. You do not have to add the user to Linux when configured properly. 2. You are correct that eTrust PAM r8 can only have 1 group attached to a user since that's all ACF2 currently allows. To add more groups to a user, it must be done from Linux. This is something we are looking to address in a future ACF2 release. 3. I believe you meant to ask how to you perform authorization. Unfortunately, this is a limit of PAM. PAM performs autentication only and does not get invoked for authorization. UNIX file attributes, rwxrwxrwx, are used to control file access after PAM authenticates the user id/pswd. Please contact CA ACF2 support for any additional help or for any additional questions and we'd be glad to help you. Mitch Rozonkiewiecz Director, Development CA
________________________________ From: Linux on 390 Port on behalf of Yu Safin Sent: Thu 10/5/2006 3:16 PM To: [email protected] Subject: CA's PAM-Client and PAM-Server We are doing a proof of concept using CA's pam-client, pam-server and ACF2. The pam-client (we received the binaries from CA) was installed on our Linux guest. The pam-server was install under zOS as a started task (it is a USS service). ACF2 was there already for zOS security. We added the Linux segment to ACF2. We have run into some issues that you might be able to help us with. 1) when we define a user on the ACF2 segment for Linux, we also seem to need to have the same user on the Linux side in /etc/passwd. This is contrary to my understanding. 2) we can't seem find a way to define more than one group for the user. We have to go to the Linux guest to add groups and membships of those groups. 3) we seem to be able to authenticate users during telnet/ssh sign ons but how do we perform authentication? I.e. how do I make sure that a user does not execute or read files. I would like to manage by definining roles/groups and then making a user a member of one or more groups. ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
