Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 33

tion is made with central configuration files and all changes are automatically inherited
by the PAM configuration of each service.
The first include file (common-auth) calls two modules of the auth type:
pam_env.so and pam_unix2.so. See
the auth Section"
(page 21).
Example 2.2 Default Configuration for the auth Section
auth required
auth required
The first one, pam_env, loads the file /etc/security/pam_env.conf to set
the environment variables as specified in this file. This can be used to set the DISPLAY
variable to the correct value, because the pam_env module knows about the location
from which the login is taking place. The second one, pam_unix2, checks the user's
login and password against /etc/passwd and /etc/shadow.
The whole stack of auth modules is processed before sshd gets any feedback about
whether the login has succeeded. Given that all modules of the stack have the
required control flag, they must all be processed successfully before sshd receives
a message about the positive result. If one of the modules is not successful, the entire
module stack is still processed and only then is sshd notified about the negative result.
As soon as all modules of the auth type have been successfully processed, another
include statement is processed, in this case, that in
for the account Section"
pam_unix2. If pam_unix2 returns the result that the user exists, sshd receives a
message announcing this success and the next stack of modules (password) is pro-
Example 2.4, "Default Configuration for the password Section"
cessed, shown in
(page 21).
Example 2.3 Default Configuration for the account Section
account required
Example 2.4 Default Configuration for the password Section
password requisite
password required
Example 2.2, "Default Configuration for
pam_env.so
pam_unix2.so
(page 21). common-account contains just one module,
pam_unix2.so
pam_pwcheck.so nullok cracklib
pam_unix2.so nullok use_authtok
Example 2.3, "Default Configuration
Authentication with PAM 21