i.pamconf revision f875b4ebb1dd9fdbeb043557cab38ab3bf7f6e01
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence# CDDL HEADER START
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# The contents of this file are subject to the terms of the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# Common Development and Distribution License (the "License").
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence# You may not use this file except in compliance with the License.
15a44745412679c30a6d022733925af70a38b715David Lawrence# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
15a44745412679c30a6d022733925af70a38b715David Lawrence# See the License for the specific language governing permissions
15a44745412679c30a6d022733925af70a38b715David Lawrence# and limitations under the License.
15a44745412679c30a6d022733925af70a38b715David Lawrence# When distributing Covered Code, include this CDDL HEADER in each
15a44745412679c30a6d022733925af70a38b715David Lawrence# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# If applicable, add the following below this CDDL HEADER, with the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# fields enclosed by brackets "[]" replaced with your own identifying
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews# information: Portions Copyright [yyyy] [name of copyright owner]
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# CDDL HEADER END
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence#ident "%Z%%M% %I% %E% SMI"
c4717613e45323ed23dc6e9162cba89f1f83830cDavid Lawrence# Copyright 2007 Sun Microsystems, Inc. All rights reserved.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# Use is subject to license terms.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# No comments or blanks lines allowed in entries below
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencekrlogin auth required pam_unix_cred.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencekrlogin auth required pam_krb5.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencekrsh auth required pam_unix_cred.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencekrsh auth required pam_krb5.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencektelnet auth required pam_unix_cred.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencektelnet auth required pam_krb5.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# No comments or blanks lines allowed in entries below
fc80027fb54b501cdd88461bf879d078259e0226David Lawrenceppp auth requisite pam_authtok_get.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrenceppp auth required pam_dhkeys.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrenceppp auth required pam_unix_cred.so.1
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrenceppp auth required pam_unix_auth.so.1
2918b5bda6a55c301eb87992b5f2acd7176d0737David Lawrenceppp auth required pam_dial_auth.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# No comments or blanks lines allowed in entries below
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencecron account required pam_unix_account.so.1
d409ceeda41a256e8114423674d844d5f5035ee8Bob Halley# No comments or blanks lines allowed in entries below
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencedtlogin account requisite pam_roles.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencedtlogin account required pam_unix_account.so.1
8f804834e2b537da5c8bc81f986143a46147b490Andreas Gustafssondtsession account requisite pam_roles.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencedtsession account required pam_unix_account.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencegdm account requisite pam_roles.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencegdm account required pam_unix_account.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencexscreensaver account requisite pam_roles.so.1
8f804834e2b537da5c8bc81f986143a46147b490Andreas Gustafssonxscreensaver account required pam_unix_account.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencepasswd account requisite pam_roles.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencepasswd account required pam_unix_account.so.1
8f804834e2b537da5c8bc81f986143a46147b490Andreas Gustafssondtpasswd account requisite pam_roles.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrencedtpasswd account required pam_unix_account.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrenceother account required pam_tsol_account.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence if [ ! -f $dest ] ; then
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "${dest} default entries updated, \c" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "please examine/update customized entries" \
f8da2d95835c5216570a45e9000f740321503ae3David Lawrence #Update pam.conf with relative pathname
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence if grep '/usr/lib/security/$ISA/pam_' $dest > /dev/null 2>&1; then
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence if grep '/usr/lib/security/pam_' $dest > /dev/null 2>&1; then
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# Update pam.conf with entries for PAM modules pam_authtok_get,
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# pam_authtok_check, pam_authtok_store, pam_unix_auth, pam_unix_account,
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff# pam_unix_cred, pam_unix_session, pam_dhkeys and pam_passwd_auth
c4958494a98a59ce25e9fecad76a9ab0e36cc59fDanny Mayer echo "${dest} updating pam_unix with default PAM entries \c" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "please examine/update any new entries" \
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff $4 ~ /pam_unix.so/ && $2 == "auth" { \
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff print $1 "\t" $2 " " "requisite\t\t" \
5fe5a0c02634eaadfcbc3528bf2c184557110a3bAndreas Gustafsson print $1 "\t" $2 " " $3 "\t\t" \
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff print $1 "\t" $2 " " $3 "\t\t" \
1a487fb7d230403bf1b5d6628542134f52c80653Michael Graff print $1 "\t" $2 " " $3 "\t\t" \
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence $4 ~ /pam_passwd_auth.so.1/ && $2 == "auth" { \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence if ($1 == "passwd") \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence passwd_seen = 1;\
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence $4 ~ /pam_rhosts_auth/ && $1 == "rsh" && $3 == "required" { \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence print $1 "\t" $2 " " "sufficient\t\t" $4; \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence print $1 "\t" $2 " " "required\t\t" "pam_unix_cred.so.1"; \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence $4 ~ /pam_unix_cred/ && $3 == "required" { \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence cred_seen = 1;\
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence $4 ~ /pam_unix_auth/ && $1 == "rsh" && $3 == "required" { \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence if (cred_seen == 0) { \
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence print $1 "\t" $2 " " "required\t\t" \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence $4 ~ /pam_unix_auth/ && $3 == "required" { \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence if (cred_seen == 0) { \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence print $1 "\t" $2 " " "required\t\t" \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence if (passwd_seen == 0) { \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence print "passwd" "\t" "auth required\t\t" \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence $4 ~ /pam_unix.so/ && $2 == "account" { \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence print $1 "\t" $2 " " $3 "\t\t" \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence $4 ~ /pam_unix.so/ && $2 == "session" { \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence print $1 "\t" $2 " " $3 "\t\t" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence $4 ~ /pam_unix.so/ && $2 == "password" { \
c4717613e45323ed23dc6e9162cba89f1f83830cDavid Lawrence print $1 "\t" $2 " " $3 "\t\t" \
c4717613e45323ed23dc6e9162cba89f1f83830cDavid Lawrence print $1 "\t" $2 " " "requisite\t\t" \
c4717613e45323ed23dc6e9162cba89f1f83830cDavid Lawrence print $1 "\t" $2 " " "requisite\t\t" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence print $1 "\t" $2 " " $3 "\t\t" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence#update pam.conf with entries for roles
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence if [ $? = 1 ] ; then
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "${dest} updating default entries for roles, \c" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "please examine/update any new entries" \
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence $4 ~ /pam_role_auth/ { next } \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence $2 == "account" && $4 ~ /pam_unix/ { \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence print $1 "\t" $2 " requisite\t\t" \
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence#update pam.conf with entries for projects
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence grep 'pam_projects.so' $dest > /dev/null 2>&1
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence if [ $? = 0 ] ; then
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence echo "${dest} removing pam_project.so" >> ${CLEANUP_FILE}
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence grep -v pam_projects.so $dest > /tmp/pamconf.$$
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence# update pam.conf to append PPP entries if not already present
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence# (note: default list above already has role added, so we
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence# must do this after the upgrade above has run.)
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence # See if the entry already exists
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence"^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence if [ $? = 1 ] ; then
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence # Doesn't exist, enter into pam.conf
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence echo "$e1\t$e2 $e3\t\t$e4 $e5" >> /tmp/pamconf.$$
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # Append PPP lines if any were not present already.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "${dest} updating entries for PPP; \c" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "please examine/update any new entries" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# update pam.conf to append cron entries if not already present
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# (note: the kerberos default list above already has the cron entried added.)
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # See if the entry already exists
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence"^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence if [ $? = 1 ] ; then
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence # Doesn't exist, enter into pam.conf
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence echo "$e1\t$e2 $e3\t\t$e4 $e5" >> /tmp/pamconf.$$
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence # Append cron lines if any were not present already.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence echo "${dest} updating entries for cron, \c" \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence echo "please examine/update any new entries" \
0bd4e3591ac1a729c7ec8f811844119473350975David Lawrence# update pam.conf to remove the rlogin entry that uses pam_krb5.so.1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "Couldn't edit /tmp/pamconf.$$, rlogin lines have not been \
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence updated to remove pam_krb5.so.1." \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# update pam.conf to remove obsolete flags used with pam_krb5.so.1
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence sed -e "s/\(pam_krb5.so.1.*\)acceptor/\1/g" \
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence -e "s/\(pam_krb5.so.1.*\)use_first_pass/\1/g" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence -e "s/\(pam_krb5.so.1.*\)try_first_pass/\1/g" \
6a8832f784bd53aa6afbda22f6187cea6490e1e1Andreas Gustafsson -e "s/\(pam_krb5.so.1.*\)use_xfn_pass/\1/g" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence -e "s/\(pam_krb5.so.1.*\)try_xfn_pass/\1/g" \
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence echo "Couldn't edit /tmp/pamconf.$$ to remove obsolete flags: \
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence acceptor, use_first_pass, try_first_pass, use_xfn_pass, try_xfn_pass." \
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence# update pam.conf to remove the unnecessary unix_auth entries for the
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# kerberized services.
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence sed -e "/^[# ]*krlogin[ ]*auth[ ]*.*[ ]*pam_unix_auth.so.1/d" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence -e "/^[# ]*krsh[ ]*auth[ ]*.*[ ]*pam_unix_auth.so.1/d" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence -e "/^[# ]*ktelnet[ ]*auth[ ]*.*[ ]*pam_unix_auth.so.1/d" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence -e "s/^\([# ]*krlogin[ ]*auth[ ]*\)binding/\1required/" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence -e "s/^\([# ]*krsh[ ]*auth[ ]*\)binding/\1required/" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence -e "s/^\([# ]*ktelnet[ ]*auth[ ]*\)binding/\1required/" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "Couldn't edit /tmp/pamconf.$$, krlogin, krsh, ktelnet may \
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence still have pam_unix_auth in their stacks." \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# update pam.conf to append kerberos entries if not already present
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence (while read e1 e2 e3 e4 e5
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence if [ $? = 1 ] ; then
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence # Check if service name is 'dtlogin' and it is
ff30a206ecc63b6681716322ed7f017e3f51ea7fDavid Lawrence # mentioned explicitly, then add kerberos 'dtlogin'
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "$e1\t$e2 $e3\t\t$e4 $e5" >> /tmp/pamconf.$$
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # Does exist. To maintain proper stacking order: remove it
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # and append it to the bottom of the conf file.
edcd1247ad7e81bb8b430e610d9718f64c70f05dDavid Lawrence grep "^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
87cafc5e70f79f2586d067fbdd64f61bbab069d2David Lawrence sed -e "/^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4/d" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # Append kerberos lines if any were not present already.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "${dest} updating entries to add kerberos, \c" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "please examine/update any new entries" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# notify pam_ldap users to manually intervene and examine/update their pam.conf
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence# due to the change in pam_ldap functionalty.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence grep '^[^#].*pam_ldap.so' $dest > /dev/null 2>&1
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence if [ $? = 0 ] ; then
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "${dest} please examine/update the pam_ldap configuration \c" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "because its functionality has changed, \c" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "refer to pam_ldap(5) documentation for more information" \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence# Update pam.conf to append Trusted Extensions entries if not
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence# already present.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # If this is the 'other' entry, add it unless it already
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence"^[# ]*$e1[ ][ ]*$e2[ ][ ]*$e3[ ][ ]*$e4" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence if [ $? = 1 ] ; then
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # Doesn't exist, enter into pam.conf
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "$e1\t$e2 $e3\t\t$e4 $e5" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # Add other entries unless they already have a
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # stack of their own.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence if [ $? = 1 ] ; then
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "$e1\t$e2 $e3\t\t$e4 $e5" \
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence # Append TX lines if any were not present already.
fc80027fb54b501cdd88461bf879d078259e0226David Lawrence echo "${dest} updating entries for Trusted Extensions; \c" \
863ac191b448a13ae1a3a8ee3458344e11602737David Lawrence echo "please examine/update any new entries" \