This section lists the files included in the SEAM product.
Table 23-1 SEAM Files
File Name |
Description |
---|---|
/etc/gss/gsscred.conf |
Default file types for the gsscred table |
/etc/gss/mech |
Mechanisms for RPCSEC_GSS |
/etc/gss/qop |
Quality of Protection parameters for RPCSEC_GSS |
/etc/nfssec.conf |
Defines NFS authentication security modes |
/etc/krb5/krb5.conf |
Kerberos realm configuration file |
/etc/krb5/krb5.keytab |
Keytab for network application servers |
/etc/krb5/warn.conf |
Kerberos warning configuration file |
/etc/pam.conf |
PAM configuration file |
/tmp/krb5cc_uid |
Default credentials cache (uid is the decimal UID of the user) |
/tmp/ovsec_adm.xxxxxx |
Temporary credentials cache for the lifetime of the password changing operation (xxxxxx is a random string) |
The default PAM configuration file delivered with SEAM includes commented out entries to use the Kerberos capabilities. The new file includes entries for the authentication service, account management, session management, and password management modules.
For the authentication module, the new entries are for rlogin, login, and dtlogin. An example of these entries is shown below. All of these services use the new PAM library, /usr/lib/security/pam_krb5.so.1, to provide Kerberos authentication.
The first three entries employ the try_first_pass option, which requests authentication using the user's initial password. Using the initial password means that the user is not prompted for another password even if multiple mechanisms are listed. An other entry is included as the default entry for all entries requiring authentication that are not specified.
# cat /etc/pam.conf . . rlogin auth optional /usr/lib/security/pam_krb5.so.1 try_first_pass login auth optional /usr/lib/security/pam_krb5.so.1 try_first_pass dtlogin auth optional /usr/lib/security/pam_krb5.so.1 try_first_pass krlogin auth required /usr/lib/security/pam_krb5.so.1 acceptor ktelnet auth required /usr/lib/security/pam_krb5.so.1 acceptor krsh auth required /usr/lib/security/pam_krb5.so.1 acceptor other auth optional /usr/lib/security/pam_krb5.so.1 try_first_pass |
For the account management, dtlogin has a new entry that uses the Kerberos library, as shown below. An other entry is included to provide a default rule. Currently no actions are taken by the other entry.
dtlogin account optional /usr/lib/security/pam_krb5.so.1 other account optional /usr/lib/security/pam_krb5.so.1 |
The last two entries in the /etc/pam.conf file are shown below. The other entry for session management destroys user credentials. The new other entry for password management selects the Kerberos library.
other session optional /usr/lib/security/pam_krb5.so.1 other password optional /usr/lib/security/pam_krb5.so.1 try_first_pass |