https://community.hpe.com/t5/operating-system-hp-ux/kerberos-problem/m-p/4730124#M386367 Hi guys. <BR />Use authentication via kerberos for domain users on HP-UX servers. If the domain controller is unavailable or network interfaces in the down, server is no authentification domain user (using the local password for domain user from console). How to solve this problem? <BR /><BR /># cat /etc/pam.conf<BR /><BR />#<BR /># PAM configuration<BR />#<BR /># This pam.conf file is intended as an example only.<BR /># see pam.conf(4) for more details<BR />#<BR />#<BR />################################################################<BR /># This sample file will authenticate the user who belongs to #<BR /># either Kerberos or Unix system. Using this configuration file#<BR /># if the user is authenticated through Kerberos then the Unix #<BR /># authentication will not be invoked. However,if the Kerberos #<BR /># authentication fails for the user, then the fallback #<BR /># authentication mechanism PAM-Unix will be invoked to #<BR /># authenticate the user.The assumption is the user is either #<BR /># present in Kerberos or in Unix system. #<BR /># #<BR /># In case, the administrator wants the password for all the #<BR /># users to be synchronous between Kerberos and Unix systems, #<BR /># then the control flag should to be set to "required" for all #<BR /># the entries with use_first_pass option set for pam_unix. #<BR /># If password synchronization is optional then try_first_pass #<BR /># option need to be set for pam_unix, so that the user can #<BR /># login using the appropriate passwords. #<BR /># #<BR /># The module pam_hpsec(5) is stacked as mandatory module above #<BR /># all the modules for making security checks before #<BR /># authentication. #<BR />################################################################<BR />#<BR />#<BR /># Authentication management<BR />#<BR />login auth required libpam_hpsec.so.1<BR />login auth sufficient libpam_krb5.so.1<BR />login auth required libpam_unix.so.1 try_first_pass<BR />su auth required libpam_hpsec.so.1<BR />su auth sufficient libpam_krb5.so.1<BR />su auth required libpam_unix.so.1 try_first_pass<BR />dtlogin auth required libpam_hpsec.so.1<BR />dtlogin auth sufficient libpam_krb5.so.1<BR />dtlogin auth required libpam_unix.so.1 try_first_pass<BR />dtaction auth required libpam_hpsec.so.1<BR />dtaction auth required libpam_unix.so.1 try_first_pass<BR />dtaction auth sufficient libpam_krb5.so.1<BR />ftp auth required libpam_updbe.so.1<BR />ftp auth required libpam_hpsec.so.1<BR />ftp auth sufficient libpam_krb5.so.1<BR />ftp auth required libpam_unix.so.1 try_first_pass<BR />sshd auth required libpam_updbe.so.1<BR />sshd auth required libpam_hpsec.so.1<BR />sshd auth sufficient libpam_krb5.so.1<BR />sshd auth required libpam_unix.so.1 try_first_pass<BR />OTHER auth required libpam_unix.so.1<BR />#<BR /># Account management<BR />#<BR />login account required libpam_hpsec.so.1<BR />login account sufficient libpam_krb5.so.1<BR />login account required libpam_unix.so.1<BR />su account required libpam_hpsec.so.1<BR />su account sufficient libpam_krb5.so.1<BR />su account required libpam_unix.so.1<BR />dtlogin account required libpam_hpsec.so.1<BR />dtlogin account sufficient libpam_krb5.so.1<BR />dtlogin account required libpam_unix.so.1<BR />dtaction account required libpam_hpsec.so.1<BR />dtaction account sufficient libpam_krb5.so.1<BR />dtaction account required libpam_unix.so.1<BR />ftp account required libpam_hpsec.so.1<BR />ftp account sufficient libpam_krb5.so.1<BR />ftp account required libpam_unix.so.1<BR />sshd account required libpam_hpsec.so.1<BR />sshd account required libpam_unix.so.1<BR />OTHER account required libpam_unix.so.1<BR />#<BR /># Session management<BR />#<BR />login session required libpam_hpsec.so.1<BR />login session sufficient libpam_krb5.so.1<BR />login session required libpam_unix.so.1<BR />dtlogin session required libpam_hpsec.so.1<BR />dtlogin session sufficient libpam_krb5.so.1<BR />dtlogin session required libpam_unix.so.1<BR />dtaction session required libpam_hpsec.so.1<BR />dtaction session sufficient libpam_krb5.so.1<BR />dtaction session required libpam_unix.so.1<BR />OTHER session required libpam_unix.so.1<BR />#<BR /># Password management<BR />#<BR />login password required libpam_hpsec.so.1<BR />login password sufficient libpam_krb5.so.1<BR />login password required libpam_unix.so.1<BR />passwd password required libpam_hpsec.so.1<BR />passwd password sufficient libpam_krb5.so.1<BR />passwd password required libpam_unix.so.1<BR />dtlogin password required libpam_hpsec.so.1<BR />dtlogin password sufficient libpam_krb5.so.1<BR />dtlogin password required libpam_unix.so.1<BR />dtaction password required libpam_hpsec.so.1<BR />dtaction password sufficient libpam_krb5.so.1<BR />dtaction password required libpam_unix.so.1<BR />OTHER password required libpam_unix.so.1<BR /> Thu, 23 Dec 2010 08:53:13 GMT Goriik 2010-12-23T08:53:13Z https://community.hpe.com/t5/operating-system-hp-ux/kerberos-problem/m-p/4730124#M386367 Hi guys. <BR />Use authentication via kerberos for domain users on HP-UX servers. If the domain controller is unavailable or network interfaces in the down, server is no authentification domain user (using the local password for domain user from console). How to solve this problem? <BR /><BR /># cat /etc/pam.conf<BR /><BR />#<BR /># PAM configuration<BR />#<BR /># This pam.conf file is intended as an example only.<BR /># see pam.conf(4) for more details<BR />#<BR />#<BR />################################################################<BR /># This sample file will authenticate the user who belongs to #<BR /># either Kerberos or Unix system. Using this configuration file#<BR /># if the user is authenticated through Kerberos then the Unix #<BR /># authentication will not be invoked. However,if the Kerberos #<BR /># authentication fails for the user, then the fallback #<BR /># authentication mechanism PAM-Unix will be invoked to #<BR /># authenticate the user.The assumption is the user is either #<BR /># present in Kerberos or in Unix system. #<BR /># #<BR /># In case, the administrator wants the password for all the #<BR /># users to be synchronous between Kerberos and Unix systems, #<BR /># then the control flag should to be set to "required" for all #<BR /># the entries with use_first_pass option set for pam_unix. #<BR /># If password synchronization is optional then try_first_pass #<BR /># option need to be set for pam_unix, so that the user can #<BR /># login using the appropriate passwords. #<BR /># #<BR /># The module pam_hpsec(5) is stacked as mandatory module above #<BR /># all the modules for making security checks before #<BR /># authentication. #<BR />################################################################<BR />#<BR />#<BR /># Authentication management<BR />#<BR />login auth required libpam_hpsec.so.1<BR />login auth sufficient libpam_krb5.so.1<BR />login auth required libpam_unix.so.1 try_first_pass<BR />su auth required libpam_hpsec.so.1<BR />su auth sufficient libpam_krb5.so.1<BR />su auth required libpam_unix.so.1 try_first_pass<BR />dtlogin auth required libpam_hpsec.so.1<BR />dtlogin auth sufficient libpam_krb5.so.1<BR />dtlogin auth required libpam_unix.so.1 try_first_pass<BR />dtaction auth required libpam_hpsec.so.1<BR />dtaction auth required libpam_unix.so.1 try_first_pass<BR />dtaction auth sufficient libpam_krb5.so.1<BR />ftp auth required libpam_updbe.so.1<BR />ftp auth required libpam_hpsec.so.1<BR />ftp auth sufficient libpam_krb5.so.1<BR />ftp auth required libpam_unix.so.1 try_first_pass<BR />sshd auth required libpam_updbe.so.1<BR />sshd auth required libpam_hpsec.so.1<BR />sshd auth sufficient libpam_krb5.so.1<BR />sshd auth required libpam_unix.so.1 try_first_pass<BR />OTHER auth required libpam_unix.so.1<BR />#<BR /># Account management<BR />#<BR />login account required libpam_hpsec.so.1<BR />login account sufficient libpam_krb5.so.1<BR />login account required libpam_unix.so.1<BR />su account required libpam_hpsec.so.1<BR />su account sufficient libpam_krb5.so.1<BR />su account required libpam_unix.so.1<BR />dtlogin account required libpam_hpsec.so.1<BR />dtlogin account sufficient libpam_krb5.so.1<BR />dtlogin account required libpam_unix.so.1<BR />dtaction account required libpam_hpsec.so.1<BR />dtaction account sufficient libpam_krb5.so.1<BR />dtaction account required libpam_unix.so.1<BR />ftp account required libpam_hpsec.so.1<BR />ftp account sufficient libpam_krb5.so.1<BR />ftp account required libpam_unix.so.1<BR />sshd account required libpam_hpsec.so.1<BR />sshd account required libpam_unix.so.1<BR />OTHER account required libpam_unix.so.1<BR />#<BR /># Session management<BR />#<BR />login session required libpam_hpsec.so.1<BR />login session sufficient libpam_krb5.so.1<BR />login session required libpam_unix.so.1<BR />dtlogin session required libpam_hpsec.so.1<BR />dtlogin session sufficient libpam_krb5.so.1<BR />dtlogin session required libpam_unix.so.1<BR />dtaction session required libpam_hpsec.so.1<BR />dtaction session sufficient libpam_krb5.so.1<BR />dtaction session required libpam_unix.so.1<BR />OTHER session required libpam_unix.so.1<BR />#<BR /># Password management<BR />#<BR />login password required libpam_hpsec.so.1<BR />login password sufficient libpam_krb5.so.1<BR />login password required libpam_unix.so.1<BR />passwd password required libpam_hpsec.so.1<BR />passwd password sufficient libpam_krb5.so.1<BR />passwd password required libpam_unix.so.1<BR />dtlogin password required libpam_hpsec.so.1<BR />dtlogin password sufficient libpam_krb5.so.1<BR />dtlogin password required libpam_unix.so.1<BR />dtaction password required libpam_hpsec.so.1<BR />dtaction password sufficient libpam_krb5.so.1<BR />dtaction password required libpam_unix.so.1<BR />OTHER password required libpam_unix.so.1<BR /> Thu, 23 Dec 2010 08:53:13 GMT https://community.hpe.com/t5/operating-system-hp-ux/kerberos-problem/m-p/4730124#M386367 Goriik 2010-12-23T08:53:13Z https://community.hpe.com/t5/operating-system-hp-ux/kerberos-problem/m-p/4730125#M386368 # cat /etc/pam_user.conf<BR /><BR />domainuser auth /usr/lib/security/$ISA/libpam_krb5.so.1 ignore<BR />domainuser password /usr/lib/security/$ISA/libpam_krb5.so.1 ignore<BR />domainuser account /usr/lib/security/$ISA/libpam_krb5.so.1 ignore<BR />domainuser session /usr/lib/security/$ISA/libpam_krb5.so.1 ignore<BR />domainuser auth /usr/lib/security/$ISA/libpam_unix.so.1 try_first_pass<BR />domainuser password /usr/lib/security/$ISA/libpam_unix.so.1<BR /> Thu, 23 Dec 2010 08:59:36 GMT https://community.hpe.com/t5/operating-system-hp-ux/kerberos-problem/m-p/4730125#M386368 Goriik 2010-12-23T08:59:36Z