13.2.6. Configuring Services: PAM

Procedure 13.3. Configuring PAM

1. Use authconfig to enable SSSD for system authentication.

   # authconfig --update --enablesssd --enablesssdauth

   This automatically updates the PAM configuration to reference all of the SSSD modules:

   #%PAM-1.0
   # This file is auto-generated.
   # User changes will be destroyed the next time authconfig is run.
   auth        required      pam_env.so
   auth        sufficient    pam_unix.so nullok try_first_pass
   auth        requisite     pam_succeed_if.so uid >= 500 quiet
   auth sufficient pam_sss.so use_first_pass
   auth        required      pam_deny.so
   
   account     required      pam_unix.so 
   account     sufficient    pam_localuser.so
   account     sufficient    pam_succeed_if.so uid < 500 quiet
   account [default=bad success=ok user_unknown=ignore] pam_sss.so
   account     required      pam_permit.so
   
   password    requisite     pam_cracklib.so try_first_pass retry=3
   password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
   password sufficient pam_sss.so use_authtok
   password    required      pam_deny.so
   
   session     optional      pam_keyinit.so revoke
   session     required      pam_limits.so
   session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
   session sufficient pam_sss.so
   session     required      pam_unix.so

   These modules can be set to include statements, as necessary.
2. Open the sssd.conf file.

   # vim /etc/sssd/sssd.conf

3. Make sure that PAM is listed as one of the services that works with SSSD.

   [sssd]
   config_file_version = 2
   reconnection_retries = 3
   sbus_timeout = 30
   services = nss, pam

4. In the [pam] section, change any of the PAM parameters. These are listed in Table 13.3, “SSSD [pam] Configuration Parameters”.

   [pam]
   reconnection_retries = 3
   offline_credentials_expiration = 2
   offline_failed_login_attempts = 3
   offline_failed_login_delay = 5

5. Restart SSSD.

   ~]# service sssd restart