Hi,
I was looking at http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel6... and it says to change PAM files that end in "-ac" but the rule is that the autoconf program can re-write (clobber) PAM files that end in "-ac" and if you want to avoid that you copy the "-ac" file to a new name such as one that ends in "-local" and then reset the symbolic link from pointing to the "-ac" file to pointing at you "-local" file.
Can the documentation be updated to reflect this?
Thanks, Ken
Sorry didn't notice how out-of-date that web site has become.
On Wed, Jan 16, 2013 at 2:46 PM, Kenneth Stailey kstailey.lists@gmail.com wrote:
Hi,
I was looking at http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel6... and it says to change PAM files that end in "-ac" but the rule is that the autoconf program can re-write (clobber) PAM files that end in "-ac" and if you want to avoid that you copy the "-ac" file to a new name such as one that ends in "-local" and then reset the symbolic link from pointing to the "-ac" file to pointing at you "-local" file.
Can the documentation be updated to reflect this?
Thanks, Ken
On 1/16/13 5:52 PM, Kenneth Stailey wrote:
Sorry didn't notice how out-of-date that web site has become.
It was last updated on 13-JAN, then again tonight. It's not *that* out of date! ;)
On Wed, Jan 16, 2013 at 2:46 PM, Kenneth Stailey kstailey.lists@gmail.com wrote:
Hi,
I was looking at http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel6... and it says to change PAM files that end in "-ac" but the rule is that the autoconf program can re-write (clobber) PAM files that end in "-ac" and if you want to avoid that you copy the "-ac" file to a new name such as one that ends in "-local" and then reset the symbolic link from pointing to the "-ac" file to pointing at you "-local" file.
Can the documentation be updated to reflect this?
The only "-ac" file I could see referenced was /etc/pam.d/system-auth-ac. As you mention, users should be editing /etc/pam.d/system-auth.... of which SysAdmins can leave in place as a symlink to system-auth-ac or symlink it to system-auth-local so authconfig won't clobber it.
I view the fix as updating the docs to consistently reference users to /etc/pam.d/system-auth. If users decide to symlink that to -local that's their (highly recommended) choice.
Thoughts?
scap-security-guide@lists.fedorahosted.org