PAM files ending in "-ac"
Shawn Wells
shawn at redhat.com
Thu Jan 17 03:40:53 UTC 2013
On 1/16/13 5:52 PM, Kenneth Stailey wrote:
> Sorry didn't notice how out-of-date that web site has become.
It was last updated on 13-JAN, then again tonight. It's not *that* out
of date! ;)
> On Wed, Jan 16, 2013 at 2:46 PM, Kenneth Stailey
> <kstailey.lists at gmail.com> wrote:
>> >Hi,
>> >
>> >I was looking at
>> >http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel6-nistrefs-server.html
>> >and it says to change PAM files that end in "-ac" but the rule is that
>> >the autoconf program can re-write (clobber) PAM files that end in
>> >"-ac" and if you want to avoid that you copy the "-ac" file to a new
>> >name such as one that ends in "-local" and then reset the symbolic
>> >link from pointing to the "-ac" file to pointing at you "-local" file.
>> >
>> >Can the documentation be updated to reflect this?
>> >
The only "-ac" file I could see referenced was
/etc/pam.d/system-auth-ac. As you mention, users should be editing
/etc/pam.d/system-auth.... of which SysAdmins can leave in place as a
symlink to system-auth-ac or symlink it to system-auth-local so
authconfig won't clobber it.
I view the fix as updating the docs to consistently reference users to
/etc/pam.d/system-auth. If users decide to symlink that to -local that's
their (highly recommended) choice.
Thoughts?
More information about the scap-security-guide
mailing list