Skip to content

Configure PAM Authentication

When PAM is configured, Reflection for Secure IT UNIX Client and Server transfers control of authentication to the PAM library.

To configure PAM authentication on the server

  1. Edit your PAM configuration settings to support the required modules: auth, account, password, and session. If required modules are not defined, the connection will be refused.

    On Linux systems, the following file is installed with the server:

    /etc/pam.d/ssh

    This file contains the default configuration information. For example, on SLES systems the ssh file includes the following:

    #%PAM-1.0
auth     include        common-auth
auth     required       pam_nologin.so
account  include        common-account
password include        common-password
session  include        common-session

    On other systems, create (or configure) /etc/pam.conf. For example, on HP-UX:

    ssh auth     required  /usr/lib/security/libpam_unix.1
ssh account  required  /usr/lib/security/libpam_unix.1
ssh password required  /usr/lib/security/libpam_unix.1
ssh session  required  /usr/lib/security/libpam_unix.1

  2. Open the server configuration file (/opt/microfocus/rsit/etc/sshd2_config) in a text editor.

  3. Confirm that AllowedAuthentications (or RequiredAuthentications) includes keyboard-interactive as an allowed authentication method (the default).

  4. Configure PamServiceName to identify the name of your PAM service.

    • Use the default (ssh) if your PAM modules are defined in /etc/pam.d/ssh.

    -or-

    • If your PAM modules are defined in pam.conf, the value of PamServiceName must match your service name (ssh in the example shown above). If ssh is not defined in pam.conf, you may be able to use the default service name other.

  5. Configure the server to use PAM.

    To use PAM for In the server configuration file, add
    Authentication and password management AuthKbdInt.Required=pam
    Account management AccountManagement=pam
    Session management UsePamSessions=yes

  6. (Optional) To include the words "PAM authentication" in the prompt that client users see during authentication, include the following:

    AuthKbdInt.Verbose=yes

To configure PAM authentication on the client

  • Confirm that AllowedAuthentications includes keyboard-interactive as an allowed authentication method (the default).

More information