Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007, Installation Manual

Page: 516 / 982

Example 27.1 PAM Configuration for sshd
#%PAM-1.0
auth include common-auth
auth required pam_nologin.so
account include common-account
password include common-password
session include common-session
# Enable the following line to get resmgr support for
# ssh sessions (see /usr/share/doc/packages/resmgr/README.SuSE)
#session optional pam_resmgr.so fake_ttyname
The typical PAM configuration of an application (sshd, in this case) contains four include
statements referring to the configuration files of four module types:
common-auth
,
common-account
,
common-password
, and
common-session
. These four
files hold the default configuration for each module type. By including them instead of
calling each module separately for each PAM application, automatically get an updated
PAM configuration if the administrator changes the defaults. In former times, you had
to adjust all configuration files manually for all applications when changes to PAM
occurred or a new application was installed. Now the PAM configuration is made with
central configuration files and all changes are automatically inherited by the PAM
configuration of each service.
The first include file (
common-auth
) calls two modules of the
auth
type:
pam_env
and
pam_unix2
. See Example 27.2, “Default Configuration for the
auth
Section”
(page 498).
Example 27.2 Default Configuration for the auth Section
auth required pam_env.so
auth required pam_unix2.so
The first one,
pam_env
, loads the file
/etc/security/pam_env.conf
to set
the environment variables as specified in this file. This can be used to set the
DISPLAY
variable to the correct value, because the
pam_env
module knows about the location
from which the login is taking place. The second one,
pam_unix2
, checks the user's
login and password against
/etc/passwd
and
/etc/shadow
.
After the modules specified in
common-auth
have been successfully called, a third
module called
pam_nologin
checks whether the file
/etc/nologin
exists. If it
does, no user other than
root
may log in. The whole stack of
auth
modules is pro-
cessed before sshd gets any feedback about whether the login has succeeded. Given
498 Installation and Administration