-
Language:
English
-
Language:
English
Red Hat Training
A Red Hat training course is available for Red Hat Satellite
Chapter 5. PAM Authentication
RHN Satellite supports network-based authentication systems using Pluggable Authentication Modules (PAM). PAM is a suite of libraries that helps system administrators integrate the RHN Satellite with a centralized authentication mechanism, which eliminates the need to remember multiple passwords.
RHN Satellite is able to use PAM with LDAP, Kerberos, Directory Server, or another network-based authentication system. This chapter outlines setting up PAM to work with your organization's authentication infrastructure.
Procedure 5.1. Setting up PAM authentication
- Ensure you have the latest version of the
selinux-policy-targeted
package:# yum update selinux-policy-targeted
- Set the
allow_httpd_mod_auth_pam
SELinux boolean to on:# setsebool -P allow_httpd_mod_auth_pam 1
- Open the
/etc/rhn/rhn.conf
file in your preferred text editor, and add the following line. This will create a PAM service file at/etc/pam.d/rhn-satellite
:pam_auth_service = rhn-satellite
- To set up authentication, open the
/etc/pam.d/rhn-satellite
service file in your preferred text editor, and add the appropriate rules. For more detail about configuring PAM, refer to the Pluggable Authentication Modules (PAM) in the Red Hat Enterprise Linux Deployment Guide.
Note
Check that the PAM authentication works correctly before using it with RHN Satellite.
Example 5.1. Using PAM with Kerberos on a Red Hat Enterprise Linux 5 i386 system
This example enables PAM with Kerberos authentication on a Red Hat Enterprise Linux 5 i386 system.
Open the
/etc/pam.d/rhn-satellite
service file in your preferred text editor, and add the following rules:
#%PAM-1.0 auth required pam_env.so auth sufficient pam_krb5.so no_user_check auth required pam_deny.so account required pam_krb5.so no_user_check
Note that changing the password on the RHN website changes only the local password on the Satellite server, which may not be used at all if PAM is enabled for that user. In the above example, for instance, the Kerberos password will not be changed.
Example 5.2. Using PAM with LDAP
This example enables PAM with LDAP authentication.
Open the
/etc/pam.d/rhn-satellite
service file in your preferred text editor, and add the following rules:
#%PAM-1.0 auth required pam_env.so auth sufficient pam_ldap.so no_user_check auth required pam_deny.so account required pam_ldap.so no_user_check