Re: tac_plus AD integration with PAM

Try use pam_ldap for account (authorize) part. You will need to create 
pam_ldap.conf or ldap.conf, depends on your server OS, to query a user's 
attribute (uid).

Your pam.d/tac_plus account part would look like:

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so 
<------
account     required      pam_permit.so



On Thu, 20 Mar 2014, Donato Rivera wrote:

> Greetings,
>
>
> I am attempting to integrate my tac_plus solution with AD using PAM. I have tried numerous iterations I found online with no luck. I am listing my config below, the krb5.conf seems to pass which I will also list. Any assistance is greatly appreciated.
>
>
> AD Credentials Test using kerberos:
>
>
> [[email protected]]# kinit Dan
> Password for Dan@domain:
>
> [[email protected]]# klist
> Ticket cache: FILE:/tmp/krb5cc_0
> Default principal: Dan@domain
>
> Valid starting     Expires            Service principal
> 03/20/14 10:00:50  03/20/14 20:00:56  krbtgt/domain
>        renew until 03/27/14 10:00:50
>
>
> Configuration:
>
>
> /etc/tac_plus.conf
>
> key = "TestKey"
> accounting file = /var/log/tac.acct.log
> # authentication users not appearing elsewhere via
> # the file /etc/passwd
> #default authentication = file /etc/passwd
>
>
> # A group that can change some limited configuration on switchports
> # related to host-side network configuration
>
> group = Admin {
>        # login = file /etc/passwd
>        # or authenticated via PAM:
>        # login = PAM
>         service = exec {
>         priv-lvl = 15
>                }
>                 }
>
> user = dan {
>        login = PAM
>        member = Admin
> }
>
>
> /etc/pam.d/tac_plus
>
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        sufficient    pam_krb5.so use_first_pass
> auth        required      pam_deny.so
>
> account     required      pam_unix.so broken_shadow
> account     sufficient    pam_localuser.so
> account     sufficient    pam_succeed_if.so uid < 500 quiet
> account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
> account     required      pam_permit.so
>
> password    requisite     pam_cracklib.so try_first_pass retry=3
> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
> use_authtok
> password    sufficient    pam_krb5.so use_authtok
> password    required      pam_deny.so
>
> session     optional      pam_keyinit.so revoke
> session     required      pam_limits.so
> session     [success=1 default=ignore] pam_succeed_if.so service in
> crond quiet use_uid
> session     required      pam_unix.so
> session     optional      pam_krb5.so
>
>
> /etc/krb5.conf
>
> default = FILE:/var/log/krb5libs.log
> kdc = FILE:/var/log/krb5kdc.log
> admin_server = FILE:/var/log/kadmind.log
>
> [libdefaults]
> default_realm = domain_name
> dns_lookup_realm = false
> dns_lookup_kdc = false
> ticket_lifetime = 24h
> renew_lifetime = 7d
> forwardable = true
>
> [realms]
> domain_name = {
>  kdc = x.x.x.x
>  admin_server = x.x.x.x
> }
>
> [domain_realm]
> domain_name = domain_name
>
>
> Thanks,
>
> Danny
>

-- 
--Yu Wang

****************************************************
       Computer & Network System Administrator
****************************************************