IDS Forum

RE: how to setup PAM Kerberose on IDS 10.FC6

Posted By: Jim Cramer
Date: Thursday, 10 May 2007, at 4:18 p.m.

In Response To: Re: how to setup PAM Kerberose on IDS 10.FC6 (Wiesiek Glod)

Hi Wiesiek:

Thanks for your reply and configuration.

I am confused by 1 thing.
Your sqlhosts has your pam_serv Pam Service Name
set to "passwd".

Your /etc/pam.d file is called "informix" and with Linux
I thought that the file name is the same as the Pam Service
Name.

Should these 2 Pam Service Names be the same?

Regards,

Jim

> -----Original Message-----
> From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On
> Behalf Of Wiesiek Glod
> Sent: Wednesday, May 09, 2007 3:25 PM
> To: ids@iiug.org
> Subject: Re: how to setup PAM Kerberose on IDS 10.FC6 [9102]
>
> Hi all,
>
> Currently we are using PAM authorization IDS 9.40.x on Linux
> Debian Sarge.
> I had some problems with configure PAM-LDAP an authorize
> users to W3K AD.
>
> Below my configuration:
>
> sqlhosts:
>
> instance onsoctcp host service
> s=4,pam_serv=(passwd),pamauth=(password)
>
> /etc/pam.d/informix
>
> auth required pam_ldap.so debug
>
> On linux Debian works nss_ldap gateway.
>
> I don't know that is good configurtaion but works 0,5year OK.
>
> Maybe I help you ...
>
> On Wed, 2007-05-09 at 14:49 -0400, Jim Cramer wrote:
> > Hi Martin Fuerderer (and anyone else who is kind enough
> >
> > to help out),
> >
> > Last Oct, you posted the below note to the ids@iiug list
> about how to
> > setup PAM for Informix IDS server.
> >
> > I am trying to get PAM working on IDS and need some help.
> > I have tried but keep getting this message in online.log:
> > "listener-thread: err = -952: oserr = 0: errstr =
> >
> > jcramer@a-coe002.engr.uiowa.edu: User
> >
> > (jcramer@a-coe002.engr.uiowa.edu)'s
> >
> > password is not correct for the database server."
> >
> > I am using:
> > IDS 10.00.FC6
> > HP-UX B.11.23 U ia64
> >
> > 1) I am trying to use pam_krb5 authentication via our Kerberos
> > Security Server
> >
> > 2) I am trying to use IDS in the PAM "Simple Password
> Authentication"
> > pamauth mode
> >
> > 3) I want to use my existing client's without modification. My
> > understanding is that they need modification only when PAM is
> > operating in the "Challenge" pamauth mode and that the Krb5
> > authentication service does not utilize a
> Challenge-Response behavior.
> > Thus, I assumed that none of my clients will require
> modification in
> > order to use IDS-PAM this way.
> >
> > Is this assumption correct?
> >
> > 4) HPUX has an hpux-specific PAM module called pam_hpsec. It's man
> > page says
> >
> > "The use of pam_hpsec is mandatory for services like login, dtlogin,
> >
> > ftp, remsh/rexec and ssh. It is required that these services stack
> >
> > this module on the top of the stack above one or more non-optional
> >
> > modules such as pam_unix, pam_krb5, or pam_ldap. Application writers
> >
> > and system administrators must consider whether it is appropriate to
> >
> > use pam_hpsec for any given application. This module is specific to
> >
> > HP-UX, and the functionality may vary significantly between
> releases.
> >
> > Do you know if this is required for IDS, which in my case is the
> > "application that they are referring to", in order to use PAM?
> >
> > 5) From what little I have found on IDS PAM from the IBM/Informix
> > support site, IIUG site, developerWorks, various Informix-related
> > blogs, I found one reference which claims that something
> needs to be
> > put in the IDS concsm.cfg file when using PAM. It is in the IBM
> > Redbook:
> > http://www.redbooks.ibm.com/abstracts/sg247299.html?Open
> >
> > on page 250, 2nd paragraph under section 8.5.1.
> >
> > Is this true??? If so, is there a reference to PAM-specific
> > configurations in concsm.cfg. The IDS10 Admin Guide/Ref
> does not have
> > anything about PAM in it's section on this file.
> > I have not found any other IDS PAM references to using this file.
> >
> > Here is my configuration:
> >
> > In sqlhosts I have:
> > tidsidcard onsoctcp 128.255.17.10 sqltidsidcard
> > s=4,pam_serv=(ifmx),pamauth=(password)
> >
> > In /etc/pam.conf I have:
> > ifmx auth required /usr/lib/security/hpux64/libpam_krb5.so.1 debug
> >
> > Thanks for any assistance that you can provide.
> >
> > Jim Cramer
> > University of Iowa
> >
> >
> ----------------------------------------------------------------------
> > ----
> > Hi,
> >
> > sorry for late reply ... :-(
> >
> > Following is an example about how to
> > do a basic setup. It's a cut&paste from an internal www-page that I
> > once created on this topic. I hope it is readable and understandable
> > anyway:
> >
> > --------------------------------------------------------------
> > OS Setup for PAM
> >
> > PAMs typically reside as shared libs in /usr/lib/security. The
> > configuration for each PAM is in /etc/pam.conf. On Linux
> however, if
> > directory /etc/pam.d exists, then each module has its own
> > configuration file in this directory and /etc/pam.conf is ignored.
> >
> > The following example illustrates a possible configuration for a
> > single PAM:
> >
> > The service name of the PAM is "pam_chal"
> > and the shared library implementing it is
> > /usr/lib/security/pam_chal.so. The configuration for this
> PAM service
> > consists of the following two lines:
> >
> > pam_chal <TAB> auth required <TAB> /usr/lib/security/pam_chal.so
> > pam_chal <TAB> account required <TAB> /usr/lib/security/pam_chal.so
> >
> > where <TAB> denotes a tab character. This may be necessary,
> since it
> > could be possible that the middle parameter in the line consists of
> > only one token, which might confuse the parser when reading the
> > configuration. These two lines are in /etc/pam.conf. On
> Linux, if the
> > directory /etc/pam.d exists, they should be placed in file
> > /etc/pam.d/pam_chal.
> >
> > IDS Setup for PAM
> >
> > To make a specific IDS server name PAM-enabled, a new set of
> > additional parameters is used in the sqlhosts file for this server
> > name. The parameters are:
> >
> > s=4,pam_serv=(...),pamauth=(...)
> >
> > Example 1:
> >
> > mfu1_pam ontlitcp onbarfix
> s=4,pam_serv=(pam_chal),pamauth=(challenge)
> >
> > This line in the sqlhosts file will setup the server name
> mfu1_pam to
> > use the PAM with the service name pam_chal. The authentication mode
> > for this server name will be challenge, so clients
> connecting to this
> > servername must be prepared to handle a PAM challenge.
> >
> > Example 2:
> >
> > mfu1_pam ontlitcp onbarfix s=4,pam_serv=(other),pamauth=(password)
> >
> > This line in the sqlhosts file will setup the server name
> mfu1_pam to
> > use the PAM with the service name other which usually is
> implemented
> > by the system provided PAM module pam_unix.so. The
> authentication mode
> > for this server name will be password, so clients
> connecting to this
> > servername must be prepared to provide the password with the
> > connection request. Implicit connections will be rejected.
> > --------------------------------------------------------------
> >
> > Regards,
> > Martin
> --
> wkg
>
>
> **************************************************************
> *****************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>

Messages In This Thread

• how to setup PAM Kerberose on IDS 10.FC6
  Jim Cramer -- Wednesday, 9 May 2007, at 2:49 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Wiesiek Glod -- Wednesday, 9 May 2007, at 4:24 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Thursday, 10 May 2007, at 4:18 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Wiesiek Glod -- Thursday, 10 May 2007, at 5:20 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Amitava Chakraborty -- Wednesday, 9 May 2007, at 11:26 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Thursday, 10 May 2007, at 4:16 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Nilesh Ozarkar -- Wednesday, 9 May 2007, at 11:30 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Friday, 18 May 2007, at 4:58 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Wiesiek Glod -- Friday, 18 May 2007, at 5:44 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Friday, 18 May 2007, at 6:19 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Wednesday, 23 May 2007, at 12:39 p.m.
          • RE: how to setup PAM Kerberose on IDS 10.FC6
            Wiesiek Glod -- Wednesday, 23 May 2007, at 2:49 p.m.
            • RE: how to setup PAM Kerberose on IDS 10.FC6
              Jim Cramer -- Wednesday, 23 May 2007, at 3:11 p.m.
          • RE: how to setup PAM Kerberose on IDS 10.FC6
            Wiesiek Glod -- Wednesday, 23 May 2007, at 3:07 p.m.
            • RE: how to setup PAM Kerberose on IDS 10.FC6
              Jim Cramer -- Wednesday, 23 May 2007, at 3:17 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Nilesh Ozarkar -- Monday, 21 May 2007, at 7:30 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Wednesday, 23 May 2007, at 11:59 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.