PAM files ending in "-ac"

Shawn Wells shawn at redhat.com
Thu Jan 17 03:40:53 UTC 2013


On 1/16/13 5:52 PM, Kenneth Stailey wrote:
> Sorry didn't notice how out-of-date that web site has become.

It was last updated on 13-JAN, then again tonight. It's not *that* out 
of date! ;)

> On Wed, Jan 16, 2013 at 2:46 PM, Kenneth Stailey
> <kstailey.lists at gmail.com>  wrote:
>> >Hi,
>> >
>> >I was looking at
>> >http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel6-nistrefs-server.html
>> >and it says to change PAM files that end in "-ac" but the rule is that
>> >the autoconf program can re-write (clobber) PAM files that end in
>> >"-ac" and if you want to avoid that you copy the "-ac" file to a new
>> >name such as one that ends in "-local" and then reset the symbolic
>> >link from pointing to the "-ac" file to pointing at you "-local" file.
>> >
>> >Can the documentation be updated to reflect this?
>> >


The only "-ac" file I could see referenced was 
/etc/pam.d/system-auth-ac. As you mention, users should be editing 
/etc/pam.d/system-auth.... of which SysAdmins can leave in place as a 
symlink to system-auth-ac or symlink it to system-auth-local so 
authconfig won't clobber it.

I view the fix as updating the docs to consistently reference users to 
/etc/pam.d/system-auth. If users decide to symlink that to -local that's 
their (highly recommended) choice.

Thoughts?


More information about the scap-security-guide mailing list