IDS Forum

Re: how to setup PAM Kerberose on IDS 10.FC6

Posted By: Wiesiek Glod
Date: Wednesday, 9 May 2007, at 4:24 p.m.

In Response To: how to setup PAM Kerberose on IDS 10.FC6 (Jim Cramer)

Hi all,

Currently we are using PAM authorization
IDS 9.40.x on Linux Debian Sarge.
I had some problems with configure PAM-LDAP
an authorize users to W3K AD.

Below my configuration:

sqlhosts:

instance onsoctcp host service s=4,pam_serv=(passwd),pamauth=(password)

/etc/pam.d/informix

auth required pam_ldap.so debug

On linux Debian works nss_ldap gateway.

I don't know that is good configurtaion
but works 0,5year OK.

Maybe I help you ...

On Wed, 2007-05-09 at 14:49 -0400, Jim Cramer wrote:
> Hi Martin Fuerderer (and anyone else who is kind enough
>
> to help out),
>
> Last Oct, you posted the below note to the ids@iiug list
> about how to setup PAM for Informix IDS server.
>
> I am trying to get PAM working on IDS and need some help.
> I have tried but keep getting this message in online.log:
> "listener-thread: err = -952: oserr = 0: errstr =
>
> jcramer@a-coe002.engr.uiowa.edu: User
>
> (jcramer@a-coe002.engr.uiowa.edu)'s
>
> password is not correct for the database server."
>
> I am using:
> IDS 10.00.FC6
> HP-UX B.11.23 U ia64
>
> 1) I am trying to use pam_krb5 authentication via our Kerberos
> Security Server
>
> 2) I am trying to use IDS in the PAM "Simple Password
> Authentication" pamauth mode
>
> 3) I want to use my existing client's without modification. My
> understanding is that they need modification only when PAM is
> operating in the "Challenge" pamauth mode and that the Krb5
> authentication service does not utilize a Challenge-Response
> behavior. Thus, I assumed that none of my clients will require
> modification in order to use IDS-PAM this way.
>
> Is this assumption correct?
>
> 4) HPUX has an hpux-specific PAM module called pam_hpsec. It's
> man page says
>
> "The use of pam_hpsec is mandatory for services like login, dtlogin,
>
> ftp, remsh/rexec and ssh. It is required that these services stack
>
> this module on the top of the stack above one or more non-optional
>
> modules such as pam_unix, pam_krb5, or pam_ldap. Application writers
>
> and system administrators must consider whether it is appropriate to
>
> use pam_hpsec for any given application. This module is specific to
>
> HP-UX, and the functionality may vary significantly between releases.
>
> Do you know if this is required for IDS, which in my case is the
> "application that they are referring to", in order to use PAM?
>
> 5) From what little I have found on IDS PAM from the IBM/Informix
> support site, IIUG site, developerWorks, various Informix-related
> blogs, I found one reference which claims that something needs to
> be put in the IDS concsm.cfg file when using PAM. It is in the
> IBM Redbook:
> http://www.redbooks.ibm.com/abstracts/sg247299.html?Open
>
> on page 250, 2nd paragraph under section 8.5.1.
>
> Is this true??? If so, is there a reference to PAM-specific
> configurations in concsm.cfg. The IDS10 Admin Guide/Ref does
> not have anything about PAM in it's section on this file.
> I have not found any other IDS PAM references to using this file.
>
> Here is my configuration:
>
> In sqlhosts I have:
> tidsidcard onsoctcp 128.255.17.10 sqltidsidcard
> s=4,pam_serv=(ifmx),pamauth=(password)
>
> In /etc/pam.conf I have:
> ifmx auth required /usr/lib/security/hpux64/libpam_krb5.so.1 debug
>
> Thanks for any assistance that you can provide.
>
> Jim Cramer
> University of Iowa
>
> --------------------------------------------------------------------------
> Hi,
>
> sorry for late reply ... :-(
>
> Following is an example about how to
> do a basic setup. It's a cut&paste from an
> internal www-page that I once created on this
> topic. I hope it is readable and understandable
> anyway:
>
> --------------------------------------------------------------
> OS Setup for PAM
>
> PAMs typically reside as shared libs in /usr/lib/security. The
> configuration for each PAM is in /etc/pam.conf. On Linux
> however, if directory /etc/pam.d exists, then each module has
> its own configuration file in this directory and /etc/pam.conf
> is ignored.
>
> The following example illustrates a possible configuration
> for a single PAM:
>
> The service name of the PAM is "pam_chal"
> and the shared library implementing it is
> /usr/lib/security/pam_chal.so. The configuration for this
> PAM service consists of the following two lines:
>
> pam_chal <TAB> auth required <TAB> /usr/lib/security/pam_chal.so
> pam_chal <TAB> account required <TAB> /usr/lib/security/pam_chal.so
>
> where <TAB> denotes a tab character. This may be necessary,
> since it could be possible that the middle parameter in
> the line consists of only one token, which might confuse
> the parser when reading the configuration. These two lines
> are in /etc/pam.conf. On Linux, if the directory /etc/pam.d
> exists, they should be placed in file /etc/pam.d/pam_chal.
>
> IDS Setup for PAM
>
> To make a specific IDS server name PAM-enabled, a new set of
> additional parameters is used in the sqlhosts file for this
> server name. The parameters are:
>
> s=4,pam_serv=(...),pamauth=(...)
>
> Example 1:
>
> mfu1_pam ontlitcp onbarfix s=4,pam_serv=(pam_chal),pamauth=(challenge)
>
> This line in the sqlhosts file will setup the server name
> mfu1_pam to use the PAM with the service name pam_chal. The
> authentication mode for this server name will be challenge,
> so clients connecting to this servername must be prepared
> to handle a PAM challenge.
>
> Example 2:
>
> mfu1_pam ontlitcp onbarfix s=4,pam_serv=(other),pamauth=(password)
>
> This line in the sqlhosts file will setup the server name
> mfu1_pam to use the PAM with the service name other which
> usually is implemented by the system provided PAM module
> pam_unix.so. The authentication mode for this server name
> will be password, so clients connecting to this servername
> must be prepared to provide the password with the connection
> request. Implicit connections will be rejected.
> --------------------------------------------------------------
>
> Regards,
> Martin
--
wkg

Messages In This Thread

• how to setup PAM Kerberose on IDS 10.FC6
  Jim Cramer -- Wednesday, 9 May 2007, at 2:49 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Wiesiek Glod -- Wednesday, 9 May 2007, at 4:24 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Thursday, 10 May 2007, at 4:18 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Wiesiek Glod -- Thursday, 10 May 2007, at 5:20 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Amitava Chakraborty -- Wednesday, 9 May 2007, at 11:26 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Thursday, 10 May 2007, at 4:16 p.m.
  • Re: how to setup PAM Kerberose on IDS 10.FC6
    Nilesh Ozarkar -- Wednesday, 9 May 2007, at 11:30 p.m.
    • RE: how to setup PAM Kerberose on IDS 10.FC6
      Jim Cramer -- Friday, 18 May 2007, at 4:58 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Wiesiek Glod -- Friday, 18 May 2007, at 5:44 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Friday, 18 May 2007, at 6:19 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Wednesday, 23 May 2007, at 12:39 p.m.
          • RE: how to setup PAM Kerberose on IDS 10.FC6
            Wiesiek Glod -- Wednesday, 23 May 2007, at 2:49 p.m.
            • RE: how to setup PAM Kerberose on IDS 10.FC6
              Jim Cramer -- Wednesday, 23 May 2007, at 3:11 p.m.
          • RE: how to setup PAM Kerberose on IDS 10.FC6
            Wiesiek Glod -- Wednesday, 23 May 2007, at 3:07 p.m.
            • RE: how to setup PAM Kerberose on IDS 10.FC6
              Jim Cramer -- Wednesday, 23 May 2007, at 3:17 p.m.
      • RE: how to setup PAM Kerberose on IDS 10.FC6
        Nilesh Ozarkar -- Monday, 21 May 2007, at 7:30 p.m.
        • RE: how to setup PAM Kerberose on IDS 10.FC6
          Jim Cramer -- Wednesday, 23 May 2007, at 11:59 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.