IDS Forum

how to setup PAM Kerberose on IDS 10.FC6

Posted By: Jim Cramer
Date: Wednesday, 9 May 2007, at 2:49 p.m.

Hi Martin Fuerderer (and anyone else who is kind enough

to help out),

Last Oct, you posted the below note to the ids@iiug list
about how to setup PAM for Informix IDS server.

I am trying to get PAM working on IDS and need some help.
I have tried but keep getting this message in online.log:
"listener-thread: err = -952: oserr = 0: errstr =

jcramer@a-coe002.engr.uiowa.edu: User

(jcramer@a-coe002.engr.uiowa.edu)'s

password is not correct for the database server."

I am using:
IDS 10.00.FC6
HP-UX B.11.23 U ia64

1) I am trying to use pam_krb5 authentication via our Kerberos
Security Server

2) I am trying to use IDS in the PAM "Simple Password
Authentication" pamauth mode

3) I want to use my existing client's without modification. My
understanding is that they need modification only when PAM is
operating in the "Challenge" pamauth mode and that the Krb5
authentication service does not utilize a Challenge-Response
behavior. Thus, I assumed that none of my clients will require
modification in order to use IDS-PAM this way.

Is this assumption correct?

4) HPUX has an hpux-specific PAM module called pam_hpsec. It's
man page says

"The use of pam_hpsec is mandatory for services like login, dtlogin,

ftp, remsh/rexec and ssh. It is required that these services stack

this module on the top of the stack above one or more non-optional

modules such as pam_unix, pam_krb5, or pam_ldap. Application writers

and system administrators must consider whether it is appropriate to

use pam_hpsec for any given application. This module is specific to

HP-UX, and the functionality may vary significantly between releases.

Do you know if this is required for IDS, which in my case is the
"application that they are referring to", in order to use PAM?

5) From what little I have found on IDS PAM from the IBM/Informix
support site, IIUG site, developerWorks, various Informix-related
blogs, I found one reference which claims that something needs to
be put in the IDS concsm.cfg file when using PAM. It is in the
IBM Redbook:
http://www.redbooks.ibm.com/abstracts/sg247299.html?Open

on page 250, 2nd paragraph under section 8.5.1.

Is this true??? If so, is there a reference to PAM-specific
configurations in concsm.cfg. The IDS10 Admin Guide/Ref does
not have anything about PAM in it's section on this file.
I have not found any other IDS PAM references to using this file.

Here is my configuration:

In sqlhosts I have:
tidsidcard onsoctcp 128.255.17.10 sqltidsidcard
s=4,pam_serv=(ifmx),pamauth=(password)

In /etc/pam.conf I have:
ifmx auth required /usr/lib/security/hpux64/libpam_krb5.so.1 debug

Thanks for any assistance that you can provide.

Jim Cramer
University of Iowa

--------------------------------------------------------------------------
Hi,

sorry for late reply ... :-(

Following is an example about how to
do a basic setup. It's a cut&paste from an
internal www-page that I once created on this
topic. I hope it is readable and understandable
anyway:

--------------------------------------------------------------
OS Setup for PAM

PAMs typically reside as shared libs in /usr/lib/security. The
configuration for each PAM is in /etc/pam.conf. On Linux
however, if directory /etc/pam.d exists, then each module has
its own configuration file in this directory and /etc/pam.conf
is ignored.

The following example illustrates a possible configuration
for a single PAM:

The service name of the PAM is "pam_chal"
and the shared library implementing it is
/usr/lib/security/pam_chal.so. The configuration for this
PAM service consists of the following two lines:

pam_chal <TAB> auth required <TAB> /usr/lib/security/pam_chal.so
pam_chal <TAB> account required <TAB> /usr/lib/security/pam_chal.so

where <TAB> denotes a tab character. This may be necessary,
since it could be possible that the middle parameter in
the line consists of only one token, which might confuse
the parser when reading the configuration. These two lines
are in /etc/pam.conf. On Linux, if the directory /etc/pam.d
exists, they should be placed in file /etc/pam.d/pam_chal.

IDS Setup for PAM

To make a specific IDS server name PAM-enabled, a new set of
additional parameters is used in the sqlhosts file for this
server name. The parameters are:

s=4,pam_serv=(...),pamauth=(...)

Example 1:

mfu1_pam ontlitcp onbarfix s=4,pam_serv=(pam_chal),pamauth=(challenge)

This line in the sqlhosts file will setup the server name
mfu1_pam to use the PAM with the service name pam_chal. The
authentication mode for this server name will be challenge,
so clients connecting to this servername must be prepared
to handle a PAM challenge.

Example 2:

mfu1_pam ontlitcp onbarfix s=4,pam_serv=(other),pamauth=(password)

This line in the sqlhosts file will setup the server name
mfu1_pam to use the PAM with the service name other which
usually is implemented by the system provided PAM module
pam_unix.so. The authentication mode for this server name
will be password, so clients connecting to this servername
must be prepared to provide the password with the connection
request. Implicit connections will be rejected.
--------------------------------------------------------------

Regards,
Martin
--
Martin Fuerderer
IBM Informix Development Munich, Germany

Messages In This Thread

• how to setup PAM Kerberose on IDS 10.FC6
  Jim Cramer -- Wednesday, 9 May 2007, at 2:49 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Wiesiek Glod -- Wednesday, 9 May 2007, at 4:24 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Thursday, 10 May 2007, at 4:18 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Wiesiek Glod -- Thursday, 10 May 2007, at 5:20 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Amitava Chakraborty -- Wednesday, 9 May 2007, at 11:26 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Thursday, 10 May 2007, at 4:16 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Nilesh Ozarkar -- Wednesday, 9 May 2007, at 11:30 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Friday, 18 May 2007, at 4:58 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Wiesiek Glod -- Friday, 18 May 2007, at 5:44 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Friday, 18 May 2007, at 6:19 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Wednesday, 23 May 2007, at 12:39 p.m.
          • RE: how to setup PAM Kerberose on IDS 10.FC6
            Wiesiek Glod -- Wednesday, 23 May 2007, at 2:49 p.m.
            • RE: how to setup PAM Kerberose on IDS 10.FC6
              Jim Cramer -- Wednesday, 23 May 2007, at 3:11 p.m.
          • RE: how to setup PAM Kerberose on IDS 10.FC6
            Wiesiek Glod -- Wednesday, 23 May 2007, at 3:07 p.m.
            • RE: how to setup PAM Kerberose on IDS 10.FC6
              Jim Cramer -- Wednesday, 23 May 2007, at 3:17 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Nilesh Ozarkar -- Monday, 21 May 2007, at 7:30 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Wednesday, 23 May 2007, at 11:59 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.