Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 35 / 450

tion is made with central configuration files and all changes are automatically inherited
by the PAM configuration of each service.
The first include file (
common-auth
) calls two modules of the
auth
type:
pam_env.so
and
pam_unix2.so
. See Example 2.2, “Default Configuration for
the auth Section” (page 21).
Example 2.2 Default Configuration for the auth Section
auth required pam_env.so
auth required pam_unix2.so
The first one,
pam_env
, loads the file
/etc/security/pam_env.conf
to set
the environment variables as specified in this file. This can be used to set the
DISPLAY
variable to the correct value, because the
pam_env
module knows about the location
from which the login is taking place. The second one,
pam_unix2
, checks the user's
login and password against
/etc/passwd
and
/etc/shadow
.
The whole stack of
auth
modules is processed before sshd gets any feedback about
whether the login has succeeded. Given that all modules of the stack have the
required
control flag, they must all be processed successfully before sshd receives
a message about the positive result. If one of the modules is not successful, the entire
module stack is still processed and only then is sshd notified about the negative result.
As soon as all modules of the
auth
type have been successfully processed, another
include statement is processed, in this case, that in Example 2.3, “Default Configuration
for the account Section” (page 21).
common-account
contains just one module,
pam_unix2
. If
pam_unix2
returns the result that the user exists, sshd receives a
message announcing this success and the next stack of modules (
password
) is pro-
cessed, shown in Example 2.4, “Default Configuration for the password Section”
(page 21).
Example 2.3 Default Configuration for the account Section
account required pam_unix2.so
Example 2.4 Default Configuration for the password Section
password requisite pam_pwcheck.so nullok cracklib
password required pam_unix2.so nullok use_authtok
Authentication with PAM 21