Account Management With pam_unix

Starting in the Solaris 10 10/09 release, the enableShadowUpdate switch is available. When enableShadowUpdate is set to true, LDAP offers the same functionality as the files naming service for account management.

If the enableShadowUpdate switch is set to true on the client, account management functionality that is available to local accounts is also available to LDAP accounts. Functionality includes password aging, account expiry and notification, failed login account locking, and so on. Also, the -dluNfnwx options to the passwd command are now supported in LDAP. Thus, the full functionality of the passwd command and the pam_unix* modules in the files naming service is supported in the LDAP naming service. The enableShadowUpdate switch provides a way to implement consistent account management for users who are defined in both the files and the LDAP scope.

To prevent users from modifying their own account management data and thereby circumventing password policy, the LDAP server is configured to prevent user write access to the user's own shadow data on the server. An administrator with admin credentials performs the shadow data updates for a client system. Such a configuration, however, conflicts with the pam_ldap module, which requires that passwords be modifiable by users. Therefore, account management by pam_ldap and pam_unix are incompatible.

Do not use both pam_ldap and pam_unix in the same LDAP naming domain. Either all clients use pam_ldap or all clients use pam_unix. This limitation might indicate that you need a dedicated LDAP server. For example, a web or email application might expect users to change their own password on the LDAP server.

The implementation of enableShadowUpdate also requires that the admin credential (adminDN plus adminPassword) be stored locally on every client. Even though adminPassword is encrypted and can only be read from the /var/ldap/ldap_client_cred file by the ldap_cachemgr daemon, special care must be taken to protect the admin credential. To protect the credential, make it different from the server's directory manager (cn=directory manager). Another protection would be to configure the serviceAuthenticationMethod with a value of tls:simple or better for the passwd-cmd service, so that the value of adminPassword is not sent in the clear and therefore becomes vulnerable to snooping.

Unlike using pam_ldap for account management, using pam_unix for account management does not require a change to the /etc/pam.conf file. The default /etc/pam.conf file is sufficient.