What should go in password-auth vs system-auth in RHEL6?

 22시 42분 2014년 1월 28일 업데이트

문제

  • What should go in password-auth vs system-auth in RHEL6?
  • Changes made to /etc/pam.d/system-auth not honored for network services.
  • In RHEL5 we would configure it in /etc/pam.d/system-auth. However it seems that the way to go in RHEL6 is to add entry in /etc/pam.d/sshd. I got it working using the latter but I just wanted to make sure we ate using the vendor-recommended (best practice) settings.

환경

  • Red Hat Enterprise Linux 6

해결

  • You should add things like pam_sss.so and pam_tally2.so that are both for remote and local authentication to both password-auth and system-auth.

  • If you don't use fingerprint or smartcard readers, nor use authconfig to manipulate the pam files, you can just include system-auth in password-auth and then only need to update one file.

근본 원인

  • With RHEL6, some changes are made with the pam authentication to include better support for fingerprint and smartcard readers.

  • The problem with /etc/pam.d/system-auth is that it contains modules that are not usable in remote configurations so remote services such as sshdvsftpd now use /etc/pam.d/password-auth.

진단 단계


+ Recent posts