Trusted system on HP 11.00 with LDAP

[Arnold Ling]

We have an LDAP server running at the backend for user authentication (over 10,000 users). At the frontend I use the /etc/passwd file for user authentication with uid less than 100 (including root user). The frontend is an HP L box running 11.00. Because of some security reasons, we have to move the /etc/passwd to a shadow password file, which can only be acheived through a trusted system on HP-UX. When I turn the L box to a trusted system. I just can not authenticate all the users on my LDAP server. They just can not log in L box. However, I can still authenticate these users on my local /etc/passwd file. How can I run a trusted system which can still authenticate regular user through the LDAP server?

I know HP-UX 11.00 trusted system can not run with NIS, it can run with /etc/passwd and NIS+, how about LDAP?

[Chris Garman]

How did you configure the system to use LDAP before it was trusted?

[Frederic Soriano]

Have you looked at your /etc/pam.conf ?
You should have lines similar to these ones for 'auth' on your server:

#
# Authentication management
#

# dtlogin

dtlogin auth sufficient /usr/lib/security/libpam_unix.1
dtlogin auth required /usr/lib/security/libpam_ldap.1 use_first_pass

# dtaction

dtaction auth sufficient /usr/lib/security/libpam_unix.1
dtaction auth required /usr/lib/security/libpam_ldap.1 use_first_pass

# login

login auth sufficient /usr/lib/security/libpam_unix.1
login auth required /usr/lib/security/libpam_ldap.1 use_first_pass

# su

su auth sufficient /usr/lib/security/libpam_unix.1
su auth required /usr/lib/security/libpam_ldap.1 use_first_pass

# OTHER

OTHER auth sufficient /usr/lib/security/libpam_unix.1
OTHER auth required /usr/lib/security/libpam_ldap.1 use_first_pass

I hope this helps !

Regards.

[Alex Glennie]

Yes it is supported

detailed information on LDAP integration, go to
http://docs.hp.com/hpux/internet/

[Marian Geroc]

Maybe it is supported, but it is not working. We tested trusted system with pam-ldap authentification, but user can't login.

[Abhishek Lahiri_1]

Has anything changed yet?


2 years from the first question.