As security measures become increasingly complex, administrators must be given tools that simplify their management. For this reason, RHN Satellite supports network-based authentication systems via Pluggable Authentication Modules (PAM). PAM is a suite of libraries that helps system administrators integrate the Satellite with a centralized authentication mechanism, thus eliminating the need for remembering multiple passwords.
RHN Satellite supports LDAP, Kerberos, and other network-based authentication systems via PAM. To enable the Satellite to use PAM and your organization's authentication infrastructure, follow the steps below.
To ensure that PAM authentication functions properly, install the pam-devel package.
Set up a PAM service file (usually
/etc/pam.d/rhn-satellite) and have the Satellite use it by adding the following line to
pam_auth_service = rhn-satellite
This assumes the PAM service file is named
To enable a user to authenticate against PAM, select the checkbox labeled Pluggable Authentication Modules (PAM). It is positioned below the password and password confirmation fields on the Create User page.
As an example, for a Red Hat Enterprise Linux 5 i386 system, to authenticate against Kerberos one could put the following in
auth required pam_env.so
auth sufficient pam_krb5.so no_user_check
auth required pam_deny.so
account required pam_krb5.so no_user_check
Please note that changing the password on the RHN website changes only the local password on the RHN Satellite, which may not be used at all if PAM is enabled for that user. In the above example, for instance, the Kerberos password will not be changed.