UniOTP PAM Agent - Revision history

Bao at 02:25, 16 August 2016

2016-08-16T02:25:46Z

Joseph at 03:45, 28 June 2012

2012-06-28T03:45:10Z

← Older revision		Revision as of 14:45, 28 June 2012
Line 7:		Line 7:
	'''Environment '''		'''Environment '''
	<p>Operating System: Red Hat Enterprise 5</p>		<p>Operating System: Red Hat Enterprise 5</p>

			'''Important'''
			<p>Please note that currently there is no ability to safely test if a user account bound with UniOTP authenticates successfully on Linux after installation and configuration. Backup all important data and proceed diligently.</p>

	== Installation ==		== Installation ==
Line 30:		Line 33:
	[[Image:uniotppam img04.jpg]]		[[Image:uniotppam img04.jpg]]
	<!--J-->		<!--J-->
	<p>After installation, the system will ~~ask you~~ "Change configuration file now? [y/n]". If you want to change the configuration file now, input y and press enter, otherwise, input n and press enter. Here, input n and press enter, and I will change the configuration file later. The following information will display.</p>		<p>After installation has completed, the system will prompt "Change configuration file now? [y/n]". If you want to change the configuration file now, input y and press enter, otherwise, input n and press enter. Here, input n and press enter, and I will change the configuration file later. The following information will display.</p>

	<p>Please make sure the configuration file has been configured correctly, before restart your computer, otherwise it may cause login failure next time.</p>		<p>Please make sure the configuration file has been configured correctly, before restart your computer, otherwise it may cause login failure next time.</p>
Line 36:		Line 39:
	[[Image:uniotppam img05.jpg]]		[[Image:uniotppam img05.jpg]]

	==== ~~Check the~~ PAM Agent Installation ====		==== Verify PAM Agent Installation ====

	<p>You can check if the PAM agent has been installed successfully, by the following method.</p>		<p>You can check if the PAM agent has been installed successfully, by the following method.</p>
Line 64:		Line 67:
	[[Image:uniotppam img10.jpg]]		[[Image:uniotppam img10.jpg]]

	[User name]: a valid system account name (example: [root])		<p>[User name]: a valid system account name (example: [root])
	uniotp_account: the mapping account name of dynamic password for [user name]		uniotp_account: the mapping account name of dynamic password for [user name]
	authserver: authentication server IP address		authserver: authentication server IP address
	share: shared secret key (obtained from authentication service administrator)		share: shared secret key (obtained from authentication service administrator)
	port: authentication server connecting port		port: authentication server connecting port
	maxwait: the maximum time waiting for authentication server response		maxwait: the maximum time waiting for authentication server response</p>

	==== Configure the PAM Authentication Agent ====		==== Configure the PAM Authentication Agent ====
Line 77:		Line 80:
	[[Image:uniotppam img11.jpg]]		[[Image:uniotppam img11.jpg]]

	==== Configure ~~command line login authentication~~ ====		==== Configure Command Line Login Authentication ====

	<p>Open the login file in directory "/etc/pam.d", and add "auth required pam_secu.so" in the row.</p>		<p>Open the login file in directory "/etc/pam.d", and add "auth required pam_secu.so" in the row.</p>
Line 87:		Line 90:
	<p>Save and quit. Now you have finished all PAM agent configurations for command line login authentication.</p>		<p>Save and quit. Now you have finished all PAM agent configurations for command line login authentication.</p>

	There are four control-flag keywords: required, requisite, sufficient, optional and include.		<p>There are four control-flag keywords: required, requisite, sufficient, optional and include.</p>
	'''required;''' this indicates that the success of the module is required for the module-type facility		'''required;''' this indicates that the success of the module is required for the module-type facility to succeed. Failure of this module will not be apparent to the user until all of the remaining modules (of the same module-type) have been executed.</p>
	to succeed. Failure of this module will not be apparent to the user until all of the remaining		<p>'''requisite;''' like required, however, in the case that such a module returns a failure, control is directly returned to the application. The return value is that associated with the first required or requisite module to fail. Note, this flag can be used to protect against the possibility of a user getting the opportunity to enter a password over an unsafe medium. It is conceivable that such behavior might inform an attacker of valid accounts on a system. This possibility should be weighed against the not insignificant concerns of exposing a sensitive password in a hostile environment.</p>
	modules (of the same module-type) have been executed.		<p>'''sufficient;''' the success of this module is deemed `sufficient' to satisfy the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no previous required module has failed, no more `stacked' modules of this type are invoked. (Note, in this case subsequent required modules are not invoked.). A failure of this module is not deemed as fatal to satisfying the application that this module-type has succeeded.</p>
	'''requisite;''' like required, however, in the case that such a module returns a failure, control		<p>'''optional;''' as its name suggests, this control-flag marks the module as not being critical to the success or failure of the user's application for service. In general, Linux-PAM ignores such a module when determining if the module stack will succeed or fail. However, in the absence of any definite successes or failures of previous or subsequent stacked modules this module will determine the nature of the response to the application. One example of this latter case, is when the other modules return something like PAM_IGNORE.</p>
	is directly returned to the application. The return value is that associated with the first		<p>'''include;''' this tells PAM to include all lines of given type from the configuration file specified as an argument to this control. The whole idea is to create few "systemwide" pam configs and include parts of them in application pam configs. pam_secu.so support debug function. If you input debug following pam_secu.so the debug information will be added to the system log file (like: auth sufficient pam_secu.so debug). And you can specify the configuration file by using conf –directory (like: auth sufficient pam_secu.so conf –/etc/secu_pam_agent.conf, the agent will find configuration file from the specified directory, instead of the default one).</p>
	required or requisite module to fail. Note, this flag can be used to protect against the
	possibility of a user getting the opportunity to enter a password over an unsafe medium.
	It is conceivable that such behavior might inform an attacker of valid accounts on
	a system. This possibility should be weighed against the not insignificant concerns of
	exposing a sensitive password in a hostile environment.
	'''sufficient;''' the success of this module is deemed `sufficient' to satisfy the Linux-PAM
	library that this module-type has succeeded in its purpose. In the event that no
	previous required module has failed, no more `stacked' modules of this type are
	invoked. (Note, in this case subsequent required modules are not invoked.). A failure
	of this module is not deemed as fatal to satisfying the application that this
	module-type has succeeded.
	'''optional;''' as its name suggests, this control-flag marks the module as not being critical to the
	success or failure of the user's application for service. In general, Linux-PAM ignores such a
	module when determining if the module stack will succeed or fail. However, in the absence of any
	definite successes or failures of previous or subsequent stacked modules this module will
	determine the nature of the response to the application. One example of this latter case,
	is when the other modules return something like PAM_IGNORE.
	'''include;''' this tells PAM to include all lines of given type from the configuration file specified
	as an argument to this control. The whole idea is to create few "systemwide" pam configs and
	include parts of them in application pam configs.
	pam_secu.so support debug function. If you input debug following pam_secu.so the debug
	information will be added to the system log file (like: auth sufficient pam_secu.so debug).
	And you can specify the configuration file by using conf –directory (like: auth sufficient
	pam_secu.so conf –/etc/secu_pam_agent.conf, the agent will find configuration
	file from the specified directory, instead of the default one ).

	==== Configure Desktop ~~login authentication~~ ====		==== Configure Desktop Login Authentication ====

	<p>Open the PAM configuration file for gdm in directory "/etc/pam.d", and add "auth required pam_secu.so" in the first row.</p>		<p>Open the PAM configuration file for gdm in directory "/etc/pam.d", and add "auth required pam_secu.so" in the first row.</p>
Line 129:		Line 107:
	<p>Save and quit. Now you have finished all PAM agent configurations for desktop login authentication.</p>		<p>Save and quit. Now you have finished all PAM agent configurations for desktop login authentication.</p>

	Please make sure the configuration file has been configured correctly, before restarting		<p>Please make sure the configuration file has been configured correctly, before restarting your computer, otherwise it may cause login failure next time.</p>
	your computer, otherwise it may cause login failure next time.

	==== Configure Remote ~~terminal~~ Login Authentication ====		==== Configure Remote Terminal Login Authentication ====

	<p>Open the sshd file in directory /etc/pam.d and add "auth sufficient pam_secu.so sshd" in the row.</p>		<p>Open the sshd file in directory /etc/pam.d and add "auth sufficient pam_secu.so sshd" in the row.</p>
Line 140:		Line 117:
	[[Image:uniotppam img17.jpg]]		[[Image:uniotppam img17.jpg]]

	For remote login authentication configuration, you can only use sufficient.		<p>For remote login authentication configuration, you can only use sufficient.</p>

	<p>Save and quit. Now you have finished all PAM agent configurations for remote terminal login authentication.</p>		<p>Save and quit. Now you have finished all PAM agent configurations for remote terminal login authentication.</p>
Line 146:		Line 123:
	== Testing PAM Authentication Agent ==		== Testing PAM Authentication Agent ==

	==== Testing Command Line ~~Aauthentication~~ ====		==== Testing Command Line Authentication ====

	<p>Input user name [root] and press enter. Now the system will ask for OTP[PIN]:. Just input the dynamic password generated by your OTP device and your PIN following OTP in this line and press enter. In the next Password line, input your static password and press enter. You will login as root, if you see [root@localhost ~]#.</p>		<p>Input user name [root] and press enter. Now the system will ask for OTP[PIN]:. Just input the dynamic password generated by your OTP device and your PIN following OTP in this line and press enter. In the next Password line, input your static password and press enter. You will login as root, if you see [root@localhost ~]#.</p>

Joseph at 07:01, 8 June 2012

2012-06-08T07:01:44Z

← Older revision		Revision as of 18:01, 8 June 2012
Line 132:		Line 132:
	your computer, otherwise it may cause login failure next time.		your computer, otherwise it may cause login failure next time.

	==== Configure ~~remote~~ terminal ~~login authentication~~ ====		==== Configure Remote terminal Login Authentication ====

	<p>Open the sshd file in directory /etc/pam.d and add "auth sufficient pam_secu.so sshd" in the row.</p>		<p>Open the sshd file in directory /etc/pam.d and add "auth sufficient pam_secu.so sshd" in the row.</p>

Joseph at 05:56, 8 June 2012

2012-06-08T05:56:25Z

← Older revision		Revision as of 16:56, 8 June 2012
Line 1:		Line 1:
	[[category:UniOTP_Tools]]		[[category:UniOTP_Tools]]

			<!--Use with other Linux operating systems-->

	<p>This document details how to install and configure the UniOTP PAM Authentication Agent in the Red Hat Enterprise Linux 5 operating system, and how to use UniOTP's authentication system as an additional factor in user authentication.</p>		<p>This document details how to install and configure the UniOTP PAM Authentication Agent in the Red Hat Enterprise Linux 5 operating system, and how to use UniOTP's authentication system as an additional factor in user authentication.</p>
Line 162:		Line 164:
	<p>Please Input OTP and PIN, and then press enter. If you can login the system, you have successfully configured the PAM agent for desktop login authentication.</p>		<p>Please Input OTP and PIN, and then press enter. If you can login the system, you have successfully configured the PAM agent for desktop login authentication.</p>

	==== Testing ~~remote login authentication~~ ====		==== Testing Remote Login Authentication ====

	<p>We use SecureCRT as the remote login tool. After UniOTP protection is enabled for remote login authentication. You must input OTP+PIN in password to login to the host computer, and click on OK.</p>		<p>We use SecureCRT as the remote login tool. After UniOTP protection is enabled for remote login authentication. You must input OTP+PIN in password to login to the host computer, and click on OK.</p>

Joseph at 05:53, 8 June 2012

2012-06-08T05:53:27Z

← Older revision		Revision as of 16:53, 8 June 2012
Line 30:		Line 30:
	<p>After installation, the system will ask you "Change configuration file now? [y/n]". If you want to change the configuration file now, input y and press enter, otherwise, input n and press enter. Here, input n and press enter, and I will change the configuration file later. The following information will display.</p>		<p>After installation, the system will ask you "Change configuration file now? [y/n]". If you want to change the configuration file now, input y and press enter, otherwise, input n and press enter. Here, input n and press enter, and I will change the configuration file later. The following information will display.</p>

	Please make sure the configuration file has been configured correctly, before restart your		<p>Please make sure the configuration file has been configured correctly, before restart your computer, otherwise it may cause login failure next time.</p>
	computer, otherwise it may cause login failure next time.

	[[Image:uniotppam img05.jpg]]		[[Image:uniotppam img05.jpg]]
Line 52:		Line 51:
	== PAM Agent Configuration ==		== PAM Agent Configuration ==

	==== Configure ~~the~~ secu_pam_agent.conf ~~file~~ ====		==== Configure secu_pam_agent.conf ====

	<p>This file contains settings about system account, mapping of dynamic password name for system account, authentication server IP address shared key and authentication server port. For more details, please read introduction in the secu_pam_agent.conf file.</p>		<p>This file contains settings about system account, mapping of dynamic password name for system account, authentication server IP address shared key and authentication server port. For more details, please read introduction in the secu_pam_agent.conf file.</p>
Line 158:		Line 157:

	<p>Input user name [root], and then the password interface will appear.</p>		<p>Input user name [root], and then the password interface will appear.</p>

			[[Image:uniotppam img20.jpg\|370px]]

			<p>Please Input OTP and PIN, and then press enter. If you can login the system, you have successfully configured the PAM agent for desktop login authentication.</p>

			==== Testing remote login authentication ====

			<p>We use SecureCRT as the remote login tool. After UniOTP protection is enabled for remote login authentication. You must input OTP+PIN in password to login to the host computer, and click on OK.</p>

			[[Image:uniotppam img21.jpg\|370px]]

			<p>Once login has been successful, the following picture is displayed:</p>

			[[Image:uniotppam img22.jpg\|370px]]

Joseph at 05:13, 8 June 2012

2012-06-08T05:13:39Z

← Older revision		Revision as of 16:13, 8 June 2012
Line 12:		Line 12:
	<p>Navigate to the directory where the setup package "pam_secu.tar.gz" is located. In the example screenshot below, the setup package is located in "/tmp/Desktop". Type "cd" to navigate to folder, and "tar" to extract the setup package, as shown below.</p>		<p>Navigate to the directory where the setup package "pam_secu.tar.gz" is located. In the example screenshot below, the setup package is located in "/tmp/Desktop". Type "cd" to navigate to folder, and "tar" to extract the setup package, as shown below.</p>

	[[Image:uniotppam img01.jpg~~\|370px~~]]		[[Image:uniotppam img01.jpg]]

	<p>Using the "tar" command, the extracted files will be extracted to the same directory as the archive file "pam_secure.tar.gz".</p>		<p>Using the "tar" command, the extracted files will be extracted to the same directory as the archive file "pam_secure.tar.gz".</p>

	[[Image:uniotppam img02.jpg~~\|370px~~]]		[[Image:uniotppam img02.jpg]]

	==== Install the PAM Authentication Agent ====		==== Install the PAM Authentication Agent ====
Line 22:		Line 22:
	<p>To be able to install the PAM Agent, you must be logged in as root. Once logged in as root, in the directory of the extracted file, input "./install" to install the PAM Agent.</p>		<p>To be able to install the PAM Agent, you must be logged in as root. Once logged in as root, in the directory of the extracted file, input "./install" to install the PAM Agent.</p>

	[[Image:uniotppam img03.jpg~~\|370px~~]]		[[Image:uniotppam img03.jpg]]

	<p>The below will appear.</p>		<p>The below will appear.</p>

	[[Image:uniotppam img04.jpg~~\|370px~~]]		[[Image:uniotppam img04.jpg]]
	<!--J-->		<!--J-->
	<p>After installation, the system will ask you "Change configuration file now? [y/n]". If you want to change the configuration file now, input y and press enter, otherwise, input n and press enter. Here, input n and press enter, and I will change the configuration file later. The following information will display.</p>		<p>After installation, the system will ask you "Change configuration file now? [y/n]". If you want to change the configuration file now, input y and press enter, otherwise, input n and press enter. Here, input n and press enter, and I will change the configuration file later. The following information will display.</p>
Line 33:		Line 33:
	computer, otherwise it may cause login failure next time.		computer, otherwise it may cause login failure next time.

	[[Image:uniotppam img05.jpg~~\|370px~~]]		[[Image:uniotppam img05.jpg]]

	==== Check the PAM Agent Installation ====		==== Check the PAM Agent Installation ====
Line 40:		Line 40:

	<p>1. Go to /lib/security to check the pam_secu.so file.</p>		<p>1. Go to /lib/security to check the pam_secu.so file.</p>
	[[Image:uniotppam img06.jpg~~\|370px~~]]		[[Image:uniotppam img06.jpg]]

	<p>2. Go to /user/lib to check the libuniotp_agent_c.so file.</p>		<p>2. Go to /user/lib to check the libuniotp_agent_c.so file.</p>
	[[Image:uniotppam img07.jpg~~\|370px~~]]		[[Image:uniotppam img07.jpg]]

	<p>3. Go to /etc to check the secu_pam_agent.conf file</p>		<p>3. Go to /etc to check the secu_pam_agent.conf file</p>
	[[Image:uniotppam img08.jpg~~\|370px~~]]		[[Image:uniotppam img08.jpg]]

	<p>If all these files can be found in the corresponding directory, the PAM Agent has been installed successfully, and the next step is to configure the PAM Agent.</p>		<p>If all these files can be found in the corresponding directory, the PAM Agent has been installed successfully, and the next step is to configure the PAM Agent.</p>
Line 56:		Line 56:
	<p>This file contains settings about system account, mapping of dynamic password name for system account, authentication server IP address shared key and authentication server port. For more details, please read introduction in the secu_pam_agent.conf file.</p>		<p>This file contains settings about system account, mapping of dynamic password name for system account, authentication server IP address shared key and authentication server port. For more details, please read introduction in the secu_pam_agent.conf file.</p>

	[[Image:uniotppam img09.jpg~~\|370px~~]]		[[Image:uniotppam img09.jpg]]

	<p>The following file will be opened. Add a system user and other corresponding parameters as following picture.		<p>The following file will be opened. Add a system user and other corresponding parameters as following picture.
	</p>		</p>

	[[Image:uniotppam img10.jpg~~\|370px~~]]		[[Image:uniotppam img10.jpg]]

	[User name]: a valid system account name (example: [root])		[User name]: a valid system account name (example: [root])
Line 74:		Line 74:
	<p>The PAM authentication agent configuration is that adding the OTP Server PAM authentication agent program to the authentication module service, which is in /etc/pam.d.</p>		<p>The PAM authentication agent configuration is that adding the OTP Server PAM authentication agent program to the authentication module service, which is in /etc/pam.d.</p>

	[[Image:uniotppam img11.jpg~~\|370px~~]]		[[Image:uniotppam img11.jpg]]

	==== Configure command line login authentication ====		==== Configure command line login authentication ====
Line 80:		Line 80:
	<p>Open the login file in directory "/etc/pam.d", and add "auth required pam_secu.so" in the row.</p>		<p>Open the login file in directory "/etc/pam.d", and add "auth required pam_secu.so" in the row.</p>

	[[Image:uniotppam img12.jpg~~\|370px~~]]		[[Image:uniotppam img12.jpg]]

	[[Image:uniotppam img13.jpg~~\|370px~~]]		[[Image:uniotppam img13.jpg]]

	<p>Save and quit. Now you have finished all PAM agent configurations for command line login authentication.</p>		<p>Save and quit. Now you have finished all PAM agent configurations for command line login authentication.</p>
Line 122:		Line 122:
	<p>Open the PAM configuration file for gdm in directory "/etc/pam.d", and add "auth required pam_secu.so" in the first row.</p>		<p>Open the PAM configuration file for gdm in directory "/etc/pam.d", and add "auth required pam_secu.so" in the first row.</p>

	[[Image:uniotppam img14.jpg~~\|370px~~]]		[[Image:uniotppam img14.jpg]]

	[[Image:uniotppam img15.jpg~~\|370px~~]]		[[Image:uniotppam img15.jpg]]

	<p>Save and quit. Now you have finished all PAM agent configurations for desktop login authentication.</p>		<p>Save and quit. Now you have finished all PAM agent configurations for desktop login authentication.</p>
Line 135:		Line 135:
	<p>Open the sshd file in directory /etc/pam.d and add "auth sufficient pam_secu.so sshd" in the row.</p>		<p>Open the sshd file in directory /etc/pam.d and add "auth sufficient pam_secu.so sshd" in the row.</p>

	[[Image:uniotppam img16.jpg~~\|370px~~]]		[[Image:uniotppam img16.jpg]]

	[[Image:uniotppam img17.jpg~~\|370px~~]]		[[Image:uniotppam img17.jpg]]

	For remote login authentication configuration, you can only use sufficient.		For remote login authentication configuration, you can only use sufficient.
Line 145:		Line 145:
	== Testing PAM Authentication Agent ==		== Testing PAM Authentication Agent ==

	==== Testing Command ~~line authentication~~ ====		==== Testing Command Line Aauthentication ====

	<p>Input user name [root] and press enter. Now the system will ask for OTP[PIN]:. Just input the dynamic password generated by your OTP device and your PIN following OTP in this line and press enter. In the next Password line, input your static password and press enter. You will login as root, if you see [root@localhost ~]#.</p>		<p>Input user name [root] and press enter. Now the system will ask for OTP[PIN]:. Just input the dynamic password generated by your OTP device and your PIN following OTP in this line and press enter. In the next Password line, input your static password and press enter. You will login as root, if you see [root@localhost ~]#.</p>
Line 151:		Line 151:
	[[Image:uniotppam img18.jpg\|370px]]		[[Image:uniotppam img18.jpg\|370px]]

	==== Testing Desktop ~~login authentication~~ ====		==== Testing Desktop Login Authentication ====

	<p>After configuring the gdm file, you can login the system by using the GUI, input the user name when the following login interface appear.</p>		<p>After configuring the gdm file, you can login the system by using the GUI, input the user name when the following login interface appear.</p>

Joseph at 04:57, 8 June 2012

2012-06-08T04:57:16Z

← Older revision		Revision as of 15:57, 8 June 2012
Line 1:		Line 1:
	[[category:UniOTP_Tools]]		[[category:UniOTP_Tools]]

	<p>This ~~User guide includes introduction of~~ UniOTP PAM Authentication Agent ~~installation and configuration~~ in Red Hat Enterprise Linux 5 system, and ~~using the~~ UniOTP authentication system ~~to protect login~~ authentication.</p>		<p>This document details how to install and configure the UniOTP PAM Authentication Agent in the Red Hat Enterprise Linux 5 operating system, and how to use UniOTP's authentication system as an additional factor in user authentication.</p>
	~~<br>~~
	'''Environment ~~Used~~'''		'''Environment '''
	<p>Operating ~~system~~: Red Hat Enterprise 5</p>		<p>Operating System: Red Hat Enterprise 5</p>

	== Installation ==		== Installation ==

	==== Extract pam_secu.tar.gz ~~File~~ ====		==== Extract pam_secu.tar.gz ====

	<p>Go to the directory where ~~you save your~~ setup package (pam_secu.tar.gz). ~~For~~ example~~, in our system~~, the setup package is ~~stored~~ in /tmp/Desktop. ~~Use~~ cd ~~command~~ to ~~switch~~ to ~~that~~ folder, and tar ~~command~~ to extract the setup package, as ~~the following picture~~.</p>		<p>Navigate to the directory where the setup package "pam_secu.tar.gz" is located. In the example screenshot below, the setup package is located in "/tmp/Desktop". Type "cd" to navigate to folder, and "tar" to extract the setup package, as shown below.</p>

	[[Image:uniotppam img01.jpg\|370px]]		[[Image:uniotppam img01.jpg\|370px]]

	<p>~~You will see~~ the ~~following information~~, ~~after~~ the ~~package is extracted. All~~ extracted files will be ~~stored in~~ the same directory as the pam_secure.tar.gz.</p>		<p>Using the "tar" command, the extracted files will be extracted to the same directory as the archive file "pam_secure.tar.gz".</p>

	[[Image:uniotppam img02.jpg\|370px]]		[[Image:uniotppam img02.jpg\|370px]]

	==== Install PAM Authentication Agent ====		==== Install the PAM Authentication Agent ====

	<p>To install the PAM Agent~~, firstly~~, you must ~~login~~ as root ~~and then~~ input “./~~install” and press enter~~ to ~~start~~ install PAM Agent.</p>		<p>To be able to install the PAM Agent, you must be logged in as root. Once logged in as root, in the directory of the extracted file, input "./install" to install the PAM Agent.</p>

	[[Image:uniotppam img03.jpg\|370px]]		[[Image:uniotppam img03.jpg\|370px]]

	<p>The ~~following information~~ will ~~display~~.</p>		<p>The below will appear.</p>

	[[Image:uniotppam img04.jpg\|370px]]		[[Image:uniotppam img04.jpg\|370px]]
			<!--J-->
	<p>After installation, the system will ask you ~~“Change~~ configuration file now? [y/n]”. If you want to change the configuration file now, input y and press enter, otherwise, input n and press enter. Here, input n and press enter, and I will change the configuration file later. The following information will display.</p>		<p>After installation, the system will ask you "Change configuration file now? [y/n]". If you want to change the configuration file now, input y and press enter, otherwise, input n and press enter. Here, input n and press enter, and I will change the configuration file later. The following information will display.</p>

	Please make sure the configuration file has been configured correctly, before restart your		Please make sure the configuration file has been configured correctly, before restart your
Line 78:		Line 78:
	==== Configure command line login authentication ====		==== Configure command line login authentication ====

	<p>Open the login file in directory “/etc/pam.d”, and add ~~“auth~~ required pam_secu.~~so”~~ in the row.</p>		<p>Open the login file in directory "/etc/pam.d", and add "auth required pam_secu.so" in the row.</p>

	[[Image:uniotppam img12.jpg\|370px]]		[[Image:uniotppam img12.jpg\|370px]]
Line 120:		Line 120:
	==== Configure Desktop login authentication ====		==== Configure Desktop login authentication ====

	<p>Open the PAM configuration file for gdm in directory “/etc/pam.d”, and add ~~“auth~~ required pam_secu.~~so”~~ in the first row.</p>		<p>Open the PAM configuration file for gdm in directory "/etc/pam.d", and add "auth required pam_secu.so" in the first row.</p>

	[[Image:uniotppam img14.jpg\|370px]]		[[Image:uniotppam img14.jpg\|370px]]
Line 133:		Line 133:
	==== Configure remote terminal login authentication ====		==== Configure remote terminal login authentication ====

	<p>Open the sshd file in directory /etc/pam.d and add ~~“auth~~ sufficient pam_secu.so ~~sshd”~~ in the row.</p>		<p>Open the sshd file in directory /etc/pam.d and add "auth sufficient pam_secu.so sshd" in the row.</p>

	[[Image:uniotppam img16.jpg\|370px]]		[[Image:uniotppam img16.jpg\|370px]]

Damien: /* Configure command line login authentication */

2012-04-25T08:33:40Z

Configure command line login authentication

← Older revision		Revision as of 19:33, 25 April 2012
Line 106:		Line 106:
	success or failure of the user's application for service. In general, Linux-PAM ignores such a		success or failure of the user's application for service. In general, Linux-PAM ignores such a
	module when determining if the module stack will succeed or fail. However, in the absence of any		module when determining if the module stack will succeed or fail. However, in the absence of any
	definite successes or failures of previous or subsequent stacked modules this module will determine the		definite successes or failures of previous or subsequent stacked modules this module will
	nature of the response to the application. One example of this latter case, is when the other modules return something like PAM_IGNORE.		determine the nature of the response to the application. One example of this latter case,
			is when the other modules return something like PAM_IGNORE.
	'''include;''' this tells PAM to include all lines of given type from the configuration file specified		'''include;''' this tells PAM to include all lines of given type from the configuration file specified
	as an argument to this control. The whole idea is to create few "systemwide" pam configs and include parts of them in application pam configs.		as an argument to this control. The whole idea is to create few "systemwide" pam configs and
	pam_secu.so support debug function. If you input debug following pam_secu.so the debug information will be added to the system log file (like: auth sufficient pam_secu.so debug).		include parts of them in application pam configs.
	And you can specify the configuration file by using conf –directory (like: auth sufficient pam_secu.so conf –/etc/secu_pam_agent.conf, the agent will find configuration file from the specified directory, instead of the default one ).		pam_secu.so support debug function. If you input debug following pam_secu.so the debug
			information will be added to the system log file (like: auth sufficient pam_secu.so debug).
			And you can specify the configuration file by using conf –directory (like: auth sufficient
			pam_secu.so conf –/etc/secu_pam_agent.conf, the agent will find configuration
			file from the specified directory, instead of the default one ).

	==== Configure Desktop login authentication ====		==== Configure Desktop login authentication ====

Damien at 08:29, 25 April 2012

2012-04-25T08:29:58Z

Damien at 08:27, 25 April 2012

2012-04-25T08:27:38Z

← Older revision		Revision as of 19:27, 25 April 2012
Line 103:		Line 103:
	of this module is not deemed as fatal to satisfying the application that this		of this module is not deemed as fatal to satisfying the application that this
	module-type has succeeded.		module-type has succeeded.
	optional; as its name suggests, this control-flag marks the module as not being critical to the success or failure of the user's application for service. In general, Linux-PAM ignores such a module when determining if the module stack will succeed or fail. However, in the absence of any definite successes or failures of previous or subsequent stacked modules this module will determine the nature of the response to the application. One example of this latter case, is when the other modules return something like PAM_IGNORE.		optional; as its name suggests, this control-flag marks the module as not being critical to the
	include; this tells PAM to include all lines of given type from the configuration file specified as an argument to this control. The whole idea is to create few "systemwide" pam configs and include parts of them in application pam configs.		success or failure of the user's application for service. In general, Linux-PAM ignores such a module when determining if the module stack will succeed or fail. However, in the absence of any definite successes or failures of previous or subsequent stacked modules this module will determine the nature of the response to the application. One example of this latter case, is when the other modules return something like PAM_IGNORE.
			include; this tells PAM to include all lines of given type from the configuration file specified
			as an argument to this control. The whole idea is to create few "systemwide" pam configs and include parts of them in application pam configs.
	pam_secu.so support debug function. If you input debug following pam_secu.so the debug information will be added to the system log file (like: auth sufficient pam_secu.so debug).		pam_secu.so support debug function. If you input debug following pam_secu.so the debug information will be added to the system log file (like: auth sufficient pam_secu.so debug).
	And you can specify the configuration file by using conf –directory (like: auth sufficient pam_secu.so conf –/etc/secu_pam_agent.conf, the agent will find configuration file from the specified directory, instead of the default one ).		And you can specify the configuration file by using conf –directory (like: auth sufficient pam_secu.so conf –/etc/secu_pam_agent.conf, the agent will find configuration file from the specified directory, instead of the default one ).
Line 118:		Line 120:
	<p>Save and quit. Now you have finished all PAM agent configurations for desktop login authentication.</p>		<p>Save and quit. Now you have finished all PAM agent configurations for desktop login authentication.</p>

	Please make sure the configuration file has been configured correctly, before ~~restart~~ your computer, otherwise it may cause login failure next time.		Please make sure the configuration file has been configured correctly, before restarting
			your computer, otherwise it may cause login failure next time.

	==== Configure remote terminal login authentication ====		==== Configure remote terminal login authentication ====

← Older revision		Revision as of 19:29, 25 April 2012
Line 87:		Line 87:

	There are four control-flag keywords: required, requisite, sufficient, optional and include.		There are four control-flag keywords: required, requisite, sufficient, optional and include.
	required; this indicates that the success of the module is required for the module-type facility		'''required;''' this indicates that the success of the module is required for the module-type facility
	to succeed. Failure of this module will not be apparent to the user until all of the remaining		to succeed. Failure of this module will not be apparent to the user until all of the remaining
	modules (of the same module-type) have been executed.		modules (of the same module-type) have been executed.
	requisite; like required, however, in the case that such a module returns a failure, control		'''requisite;''' like required, however, in the case that such a module returns a failure, control
	is directly returned to the application. The return value is that associated with the first		is directly returned to the application. The return value is that associated with the first
	required or requisite module to fail. Note, this flag can be used to protect against the		required or requisite module to fail. Note, this flag can be used to protect against the
Line 97:		Line 97:
	a system. This possibility should be weighed against the not insignificant concerns of		a system. This possibility should be weighed against the not insignificant concerns of
	exposing a sensitive password in a hostile environment.		exposing a sensitive password in a hostile environment.
	sufficient; the success of this module is deemed `sufficient' to satisfy the Linux-PAM		'''sufficient;''' the success of this module is deemed `sufficient' to satisfy the Linux-PAM
	library that this module-type has succeeded in its purpose. In the event that no		library that this module-type has succeeded in its purpose. In the event that no
	previous required module has failed, no more `stacked' modules of this type are		previous required module has failed, no more `stacked' modules of this type are
Line 103:		Line 103:
	of this module is not deemed as fatal to satisfying the application that this		of this module is not deemed as fatal to satisfying the application that this
	module-type has succeeded.		module-type has succeeded.
	optional; as its name suggests, this control-flag marks the module as not being critical to the		'''optional;''' as its name suggests, this control-flag marks the module as not being critical to the
	success or failure of the user's application for service. In general, Linux-PAM ignores such a module when determining if the module stack will succeed or fail. However, in the absence of any definite successes or failures of previous or subsequent stacked modules this module will determine the nature of the response to the application. One example of this latter case, is when the other modules return something like PAM_IGNORE.		success or failure of the user's application for service. In general, Linux-PAM ignores such a
	include; this tells PAM to include all lines of given type from the configuration file specified		module when determining if the module stack will succeed or fail. However, in the absence of any
			definite successes or failures of previous or subsequent stacked modules this module will determine the
			nature of the response to the application. One example of this latter case, is when the other modules return something like PAM_IGNORE.
			'''include;''' this tells PAM to include all lines of given type from the configuration file specified
	as an argument to this control. The whole idea is to create few "systemwide" pam configs and include parts of them in application pam configs.		as an argument to this control. The whole idea is to create few "systemwide" pam configs and include parts of them in application pam configs.
	pam_secu.so support debug function. If you input debug following pam_secu.so the debug information will be added to the system log file (like: auth sufficient pam_secu.so debug).		pam_secu.so support debug function. If you input debug following pam_secu.so the debug information will be added to the system log file (like: auth sufficient pam_secu.so debug).