topic Re: disable pam for builtin services in Operating System - HP-UX

disable pam for builtin services

mango_1 — Tue, 22 Apr 2003 14:08:33 GMT

hello all! I think that HPUX11.00 uses pam for some of its services like login, su and others. I was wondering if there was a way to disable it. Thanks!

Re: disable pam for builtin services

Umapathy S — Tue, 22 Apr 2003 15:37:20 GMT

PAM is a bridge between the services (login, su...) and the program/API that does the real work.

The services you mentioned are all built to use PAM which in turn calls up the programs/API to do the work.

Inorder to replace the PAM for these services, you may need to use services that dont use PAM.

if you use ldd on login, su you will see that they use PAM and removing them is difficult.

Hope this helps

cheers
Umapathy

Re: disable pam for builtin services

Keith Buck — Wed, 23 Apr 2003 16:05:54 GMT

You can configure PAM in /etc/pam.conf.

I'm not sure what you mean by "disable PAM". Without PAM, you won't be able to login at all.

Do you want to grant additional access (not enforce PAM restrictions) or decrease access (enforce more restrictions than PAM does)?

Hope that helps a little...

-Keith

Re: disable pam for builtin services

mango_1 — Wed, 23 Apr 2003 18:42:38 GMT

thanks for the help! I thought pam was an additional add on for the built in services. Meaning there is a command or configuration that I could use that will set login to not use pam and doing it the old fashioned way. And login will check /etc/passwd, etc. Just wanted to confirm that. :) thanks!

Re: disable pam for builtin services

doug hosking — Wed, 23 Apr 2003 18:53:47 GMT

You can think of PAM as a 'mandatory configurable option' on 11.00 systems. You can alter how it is configured but it must be configured. Large portions of the login code (the portions related to authentication, session management, etc.) were moved into PAM. There's not duplicate code in login and PAM, so if you remove PAM, you won't be able to login at all.

Some programs in 11.00 did not initially use PAM but patches were later provided that added the PAM support. I believe ftpd was one of those, but it's been so long that I forget the details. In situations like that, you could remove the patches and go back to a pre-PAM version of ftpd. However things like login ALWAYS had PAM support in 11.00 so this choice does not apply to login.

Re: disable pam for builtin services

Raghuram_3 — Fri, 25 Apr 2003 04:18:25 GMT

Hi, pam.conf specifies which security module to be used for authentication/account verification, etc. By default, login still uses /etc/passwd for account checking, but through PAM APIs. This can be substituted with a different authentication like kerberos by a suitable change in pam.conf

Re: disable pam for builtin services

Radhakrishnan Venkatara — Fri, 25 Apr 2003 04:35:47 GMT

check this links:

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/J5849-90007/J5849-90007_top.html&con=/hpux/onlinedocs/J5849-90007/00/00/23-con.html&toc=/hpux/onlinedocs/J5849-90007/00/00/23-toc.html&searchterms=pam.conf&queryid=20030325-092528

Here's a link describing PAM configuration:

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B8723-90003/B8723-90003_top.html&con=/hpux/onlinedocs/B8723-90003/00/00/35-con.html&toc=/hpux/onlinedocs/B8723-90003/00/00/35-toc.html&searchterms=pam%20AND%20ntlm%20AND%20config&queryid=20001218-062008

Here is another about configuration:

http://www.dementia.org/~shadow/pam.html

radhakrishnan

Re: disable pam for builtin services

Radhakrishnan Venkatara — Fri, 25 Apr 2003 04:36:17 GMT

Re: disable pam for builtin services

Radhakrishnan Venkatara — Fri, 25 Apr 2003 04:37:46 GMT

Re: disable pam for builtin services

Radhakrishnan Venkatara — Fri, 25 Apr 2003 04:38:38 GMT

Re: disable pam for builtin services

Radhakrishnan Venkatara — Fri, 25 Apr 2003 04:40:08 GMT

Re: disable pam for builtin services

Radhakrishnan Venkatara — Fri, 25 Apr 2003 04:40:39 GMT

Re: disable pam for builtin services

Radhakrishnan Venkatara — Fri, 25 Apr 2003 04:43:50 GMT

Re: disable pam for builtin services

Radhakrishnan Venkatara — Fri, 25 Apr 2003 04:44:28 GMT

Re: disable pam for builtin services

Radhakrishnan Venkatara — Fri, 25 Apr 2003 04:44:30 GMT