Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 04-08-2006 Installation Manual page 517

modules is not successful, the entire module stack is still processed and only then is
sshd notified about the negative result.
As soon as all modules of the auth type have been successfully processed, another
include statement is processed, in this case, that in
for the account Section"
pam_unix2. If pam_unix2 returns the result that the user exists, sshd receives a
message announcing this success and the next stack of modules (password) is pro-
cessed, shown in Example 28.4, "Default Configuration for the password Section"
(page 517).
Example 28.3 Default Configuration for the account Section
account required
Example 28.4 Default Configuration for the password Section
password required
password required
#password required
Again, the PAM configuration of sshd involves just an include statement referring to
the default configuration for password modules located in common-password.
These modules must successfully be completed (control flag required) whenever
the application requests the change of an authentication token. Changing a password
or another authentication token requires a security check. This is achieved with the pam
_pwcheck module. The pam_unix2 module used afterwards carries over any old
and new passwords from pam_pwcheck, so the user does not need to authenticate
again. This also makes it impossible to circumvent the checks carried out by pam
_pwcheck. The modules of the password type should be used wherever the preceding
modules of the account or the auth type are configured to complain about an expired
password.
Example 28.5 Default Configuration for the session Section
session required
session required
As the final step, the modules of the session type, bundled in the common-session
file are called to configure the session according to the settings for the user in question.
Although pam_unix2 is processed again, it has no practical consequences due to its
none option specified in the respective configuration file of this module, pam_unix2
.conf. The pam_limits module loads the file /etc/security/limits.conf,
(page 517). common-account contains just one module,
pam_unix2.so
pam_pwcheck.so nullok
pam_unix2.so nullok use_first_pass use_authtok
pam_make.so /var/yp
pam_limits.so
pam_unix2.so
Example 28.3, "Default Configuration
Authentication with PAM 517