Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007, Installation Manual

Page: 517 / 982

that all modules of the stack have the
required
control flag, they must all be processed
successfully before sshd receives a message about the positive result. If one of the
modules is not successful, the entire module stack is still processed and only then is
sshd notified about the negative result.
As soon as all modules of the
auth
type have been successfully processed, another
include statement is processed, in this case, that in Example 27.3, “Default Configuration
for the
account
Section” (page 499).
common-account
contains just one module,
pam_unix2
. If
pam_unix2
returns the result that the user exists, sshd receives a
message announcing this success and the next stack of modules (
password
) is pro-
cessed, shown in Example 27.4, “Default Configuration for the
password
Section”
(page 499).
Example 27.3 Default Configuration for the account Section
account required pam_unix2.so
Example 27.4 Default Configuration for the password Section
password required pam_pwcheck.so nullok
password required pam_unix2.so nullok use_first_pass use_authtok
#password required pam_make.so /var/yp
Again, the PAM configuration of sshd involves just an include statement referring to
the default configuration for
password
modules located in
common-password
.
These modules must successfully be completed (control flag
required
) whenever
the application requests the change of an authentication token. Changing a password
or another authentication token requires a security check. This is achieved with the
pam
_pwcheck
module. The
pam_unix2
module used afterwards carries over any old
and new passwords from
pam_pwcheck
, so the user does not need to authenticate
again. This also makes it impossible to circumvent the checks carried out by
pam
_pwcheck
. The modules of the
password
type should be used wherever the preceding
modules of the
account
or the
auth
type are configured to complain about an expired
password.
Example 27.5 Default Configuration for the session Section
session required pam_limits.so
session required pam_unix2.so
Authentication with PAM 499