# PAM configuration # # Customized to try pam_unix, then pam_krb5 # # Unless explicitly defined, all services use the modules # defined in the "other" section. # # Modules are defined with relative pathnames, i.e., they are # relative to /usr/lib/security/$ISA. Absolute path names, as # present in this file in previous releases are still acceptable. # # Authentication # # passwd command (explicit because of a different authentication module) # passwd auth required pam_passwd_auth.so.1 # # Default definition for Authentication management # Used when service name is not explicitly mentioned for authentication # management # other auth requisite pam_authtok_get.so.1 other auth sufficient pam_unix_auth.so.1 other auth required pam_krb5.so.1 use_first_pass # # Account # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_projects.so.1 cron account required pam_unix_account.so.1 # See notes about pam_krb5 in "other" section below cron account optional pam_krb5.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account requisite pam_roles.so.1 other account required pam_projects.so.1 other account required pam_unix_account.so.1 # According to the pam_krb5 man page, this checks for password expiration. # I'm not sure this does anything since I've flagged it as optional. # I'm not sure if I can make it required because of root. other account optional pam_krb5.so.1 # # Session # # Default definition for Session management # Used when service name is not explicitly mentioned for session management # other session optional pam_krb5.so.1 other session required pam_unix_session.so.1 # # Password # # (Don't list pam_krb5 here, this section is only for root. Regular # users must use the centralized department password changing mechanism.) # # Default definition for Password management # Used when service name is not explicitly mentioned for password management # other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 #