by Hi everybody,
I have a question about adding a pam module under Solaris 2.6.
I want to add a pam module which does one time password authen-
tication (OPIE) but I am unsure how to add the module to the
stack in pam.conf.
The module should do the following: Check if the login is a
remote login from a non local network. If it is non local do
OPIE authentication but no unix passwd authentication since
we do not want the unix password to be transmitted over the
network. If it is a local login (i.e. on the local network)
then do not do OPIE authentication but just do normal unix
type password authentication. I have written (but not yet
tested) such a module based on a Linux pam_opie implementation
but the problem is how to add it to the pam.conf file.
I could do the following in /etc/pam.conf:
login auth sufficient /usr/lib/security/pam_opie.so.1
login auth required /usr/lib/security/pam_unix.so.1
login auth required /usr/lib/security/pam_dial_auth.so.1
If somebody logs in from remote and gives the correct OPIE key
then he can log in without giving the unix passwd. However, if
he gives the wrong response then pam_unix will ask for the
unix password which is not what we want. Or is this a mis-
understanding of the working of pam? If somebody logs in from
the local network I can return PAM_IGNORE and do normal unix
password authentication.
The second option is the following /etc/pam.conf:
login auth requisite /usr/lib/security/pam_opie.so.1
login auth required /usr/lib/security/pam_unix.so.1
login auth required /usr/lib/security/pam_dial_auth.so.1
Now, if somebody logs in from a remote network and gives the
wrong OPIE key, then access is immediately denied, but when he
gives the correct key, then he still has to pass the unix
password authentication which is also not what we want. A
local user works the same way as in the first option.
I can not see a way to achieve what I want except when I also
include normal unix password authentication into the pam_opie
module which is not what I want.
I would appreciate any hints on how to solve this problem.
Best Regards,
Matthias
+----------------------------------------+---------------------------------
| Matthias Ernst | Phone: +31-24-365-3122 |
| Laboratory for Physical Chemistry | Fax: +31-24-365-2112 |
| Toernooiveld 1 | |
| 6525 ED Nijmegen, The Netherlands | |
+----------------------------------------+---------------------------------
--
+----------------------------------------+---------------------------------
| Matthias Ernst | Phone: +31-24-365-3122 |
| Laboratory for Physical Chemistry | Fax: +31-24-365-2112 |
| Toernooiveld 1 | |
| 6525 ED Nijmegen, The Netherlands | |
+----------------------------------------+---------------------------------
| New address effective 1 July | Phone: +41-1-632-4374 |
| Laboratorium fuer physikalische Chemie | Fax: +41-1-632-1021 |
| Eidgenoessische Technische Hochschule | |