On Fri, Sep 30, 2011 at 02:26:46PM +0200, Andy Kannberg wrote:
I've modified nsswitch.conf to use sss, and also the
system-auth to use
the sssd-pam library. These look like:
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
#account required pam_access.so
accessfile=/etc/security/access.netgroup.conf
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so nullok use_authtok md5 shadow
password sufficient pam_sss.so use_authtok
password required pam_deny.so
#session required pam_limits.so
session required pam_unix.so
session required pam_keyinit.so revoke
session optional pam_sss.so
Anyone who can help me out with this ? I'm kinda stuck. Google didn't
show up any useful results.
On my EL6 systems, /etc/pam.d/sshd (which is what sshd uses) is
referencing /etc/pam.d/password-auth rather than /etc/pam.d/system-auth,
which is a change since EL5. Did you update /etc/pam.d/password-auth as
well?
HTH,
Nalin