IDS Forum

RE: how to setup PAM Kerberose on IDS 10.FC6

Posted By: Wiesiek Glod
Date: Thursday, 10 May 2007, at 5:20 p.m.

In Response To: RE: how to setup PAM Kerberose on IDS 10.FC6 (Jim Cramer)

Hi Jim,

On Thu, 2007-05-10 at 16:18 -0400, Jim Cramer wrote:
> Hi Wiesiek:
>
> Thanks for your reply and configuration.
>
> I am confused by 1 thing.
> Your sqlhosts has your pam_serv Pam Service Name
> set to "passwd".
>
> Your /etc/pam.d file is called "informix" and with Linux
> I thought that the file name is the same as the Pam Service
> Name.
>
> Should these 2 Pam Service Names be the same?
>

By the time this configuration works on development
envinronment. I the first time I setup the similar
configuration suggested by IBM doc but not works.
I enabled debug PAM logging on Linux and saw that
informix PAM checked informix services in PAM Linux
when I added this to /etc/pam.d all works OK.
Currently I haven't time to analyse exactly this
situation.
But my current production system works on HP-UX
11.23 on Itanium plus NIS+ and the next 1 or 2
years I will plan migrate authorization system do
pam_ldap or kerberos so I very interest PAM
authorization on HP-UX an IDS.

P.S. My application connect to server by

Informix Connect. I have some problems

with PAM authorization until I installed

newest version Informix Connect.

I heard than development team have problem

with jdbc connect to IDS but I don't know

that they resolved this problem.

> Regards,
>
> Jim
>
> > -----Original Message-----
> > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On
> > Behalf Of Wiesiek Glod
> > Sent: Wednesday, May 09, 2007 3:25 PM
> > To: ids@iiug.org
> > Subject: Re: how to setup PAM Kerberose on IDS 10.FC6 [9102]
> >
> > Hi all,
> >
> > Currently we are using PAM authorization IDS 9.40.x on Linux
> > Debian Sarge.
> > I had some problems with configure PAM-LDAP an authorize
> > users to W3K AD.
> >
> > Below my configuration:
> >
> > sqlhosts:
> >
> > instance onsoctcp host service
> > s=4,pam_serv=(passwd),pamauth=(password)
> >
> > /etc/pam.d/informix
> >
> > auth required pam_ldap.so debug
> >
> > On linux Debian works nss_ldap gateway.
> >
> > I don't know that is good configurtaion but works 0,5year OK.
> >
> > Maybe I help you ...
> >
> > On Wed, 2007-05-09 at 14:49 -0400, Jim Cramer wrote:
> > > Hi Martin Fuerderer (and anyone else who is kind enough
> > >
> > > to help out),
> > >
> > > Last Oct, you posted the below note to the ids@iiug list
> > about how to
> > > setup PAM for Informix IDS server.
> > >
> > > I am trying to get PAM working on IDS and need some help.
> > > I have tried but keep getting this message in online.log:
> > > "listener-thread: err = -952: oserr = 0: errstr =
> > >
> > > jcramer@a-coe002.engr.uiowa.edu: User
> > >
> > > (jcramer@a-coe002.engr.uiowa.edu)'s
> > >
> > > password is not correct for the database server."
> > >
> > > I am using:
> > > IDS 10.00.FC6
> > > HP-UX B.11.23 U ia64
> > >
> > > 1) I am trying to use pam_krb5 authentication via our Kerberos
> > > Security Server
> > >
> > > 2) I am trying to use IDS in the PAM "Simple Password
> > Authentication"
> > > pamauth mode
> > >
> > > 3) I want to use my existing client's without modification. My
> > > understanding is that they need modification only when PAM is
> > > operating in the "Challenge" pamauth mode and that the Krb5
> > > authentication service does not utilize a
> > Challenge-Response behavior.
> > > Thus, I assumed that none of my clients will require
> > modification in
> > > order to use IDS-PAM this way.
> > >
> > > Is this assumption correct?
> > >
> > > 4) HPUX has an hpux-specific PAM module called pam_hpsec. It's man
> > > page says
> > >
> > > "The use of pam_hpsec is mandatory for services like login, dtlogin,
> > >
> > > ftp, remsh/rexec and ssh. It is required that these services stack
> > >
> > > this module on the top of the stack above one or more non-optional
> > >
> > > modules such as pam_unix, pam_krb5, or pam_ldap. Application writers
> > >
> > > and system administrators must consider whether it is appropriate to
> > >
> > > use pam_hpsec for any given application. This module is specific to
> > >
> > > HP-UX, and the functionality may vary significantly between
> > releases.
> > >
> > > Do you know if this is required for IDS, which in my case is the
> > > "application that they are referring to", in order to use PAM?
> > >
> > > 5) From what little I have found on IDS PAM from the IBM/Informix
> > > support site, IIUG site, developerWorks, various Informix-related
> > > blogs, I found one reference which claims that something
> > needs to be
> > > put in the IDS concsm.cfg file when using PAM. It is in the IBM
> > > Redbook:
> > > http://www.redbooks.ibm.com/abstracts/sg247299.html?Open
> > >
> > > on page 250, 2nd paragraph under section 8.5.1.
> > >
> > > Is this true??? If so, is there a reference to PAM-specific
> > > configurations in concsm.cfg. The IDS10 Admin Guide/Ref
> > does not have
> > > anything about PAM in it's section on this file.
> > > I have not found any other IDS PAM references to using this file.
> > >
> > > Here is my configuration:
> > >
> > > In sqlhosts I have:
> > > tidsidcard onsoctcp 128.255.17.10 sqltidsidcard
> > > s=4,pam_serv=(ifmx),pamauth=(password)
> > >
> > > In /etc/pam.conf I have:
> > > ifmx auth required /usr/lib/security/hpux64/libpam_krb5.so.1 debug
> > >
> > > Thanks for any assistance that you can provide.
> > >
> > > Jim Cramer
> > > University of Iowa
> > >
> > >
> > ----------------------------------------------------------------------
> > > ----
> > > Hi,
> > >
> > > sorry for late reply ... :-(
> > >
> > > Following is an example about how to
> > > do a basic setup. It's a cut&paste from an internal www-page that I
> > > once created on this topic. I hope it is readable and understandable
> > > anyway:
> > >
> > > --------------------------------------------------------------
> > > OS Setup for PAM
> > >
> > > PAMs typically reside as shared libs in /usr/lib/security. The
> > > configuration for each PAM is in /etc/pam.conf. On Linux
> > however, if
> > > directory /etc/pam.d exists, then each module has its own
> > > configuration file in this directory and /etc/pam.conf is ignored.
> > >
> > > The following example illustrates a possible configuration for a
> > > single PAM:
> > >
> > > The service name of the PAM is "pam_chal"
> > > and the shared library implementing it is
> > > /usr/lib/security/pam_chal.so. The configuration for this
> > PAM service
> > > consists of the following two lines:
> > >
> > > pam_chal <TAB> auth required <TAB> /usr/lib/security/pam_chal.so
> > > pam_chal <TAB> account required <TAB> /usr/lib/security/pam_chal.so
> > >
> > > where <TAB> denotes a tab character. This may be necessary,
> > since it
> > > could be possible that the middle parameter in the line consists of
> > > only one token, which might confuse the parser when reading the
> > > configuration. These two lines are in /etc/pam.conf. On
> > Linux, if the
> > > directory /etc/pam.d exists, they should be placed in file
> > > /etc/pam.d/pam_chal.
> > >
> > > IDS Setup for PAM
> > >
> > > To make a specific IDS server name PAM-enabled, a new set of
> > > additional parameters is used in the sqlhosts file for this server
> > > name. The parameters are:
> > >
> > > s=4,pam_serv=(...),pamauth=(...)
> > >
> > > Example 1:
> > >
> > > mfu1_pam ontlitcp onbarfix
> > s=4,pam_serv=(pam_chal),pamauth=(challenge)
> > >
> > > This line in the sqlhosts file will setup the server name
> > mfu1_pam to
> > > use the PAM with the service name pam_chal. The authentication mode
> > > for this server name will be challenge, so clients
> > connecting to this
> > > servername must be prepared to handle a PAM challenge.
> > >
> > > Example 2:
> > >
> > > mfu1_pam ontlitcp onbarfix s=4,pam_serv=(other),pamauth=(password)
> > >
> > > This line in the sqlhosts file will setup the server name
> > mfu1_pam to
> > > use the PAM with the service name other which usually is
> > implemented
> > > by the system provided PAM module pam_unix.so. The
> > authentication mode
> > > for this server name will be password, so clients
> > connecting to this
> > > servername must be prepared to provide the password with the
> > > connection request. Implicit connections will be rejected.
> > > --------------------------------------------------------------
> > >
> > > Regards,
> > > Martin
> > --
> > wkg
> >
> >
> > **************************************************************
> > *****************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
--
wkg

Messages In This Thread

• how to setup PAM Kerberose on IDS 10.FC6
  Jim Cramer -- Wednesday, 9 May 2007, at 2:49 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Wiesiek Glod -- Wednesday, 9 May 2007, at 4:24 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Thursday, 10 May 2007, at 4:18 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Wiesiek Glod -- Thursday, 10 May 2007, at 5:20 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Amitava Chakraborty -- Wednesday, 9 May 2007, at 11:26 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Thursday, 10 May 2007, at 4:16 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Nilesh Ozarkar -- Wednesday, 9 May 2007, at 11:30 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Friday, 18 May 2007, at 4:58 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Wiesiek Glod -- Friday, 18 May 2007, at 5:44 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Friday, 18 May 2007, at 6:19 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Wednesday, 23 May 2007, at 12:39 p.m.
          • RE: how to setup PAM Kerberose on IDS 10.FC6
            Wiesiek Glod -- Wednesday, 23 May 2007, at 2:49 p.m.
            • RE: how to setup PAM Kerberose on IDS 10.FC6
              Jim Cramer -- Wednesday, 23 May 2007, at 3:11 p.m.
          • RE: how to setup PAM Kerberose on IDS 10.FC6
            Wiesiek Glod -- Wednesday, 23 May 2007, at 3:07 p.m.
            • RE: how to setup PAM Kerberose on IDS 10.FC6
              Jim Cramer -- Wednesday, 23 May 2007, at 3:17 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Nilesh Ozarkar -- Monday, 21 May 2007, at 7:30 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Wednesday, 23 May 2007, at 11:59 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.