Hello,

I am working on re-vamping our kickstart files so that various config files on a freshly built system are not being flagged as being different from the centrally managed files in Satellite.

One place we're getting flagged is from the following line in the kickstart file:

auth --enablemd5 --enableshadow --enablekrb5 --enableldap --enableldapssl --ldapserver <snip>...

This causes the /etc/ldap.conf file to contain:

pam_password md5

But, our centrally managed file contains:

pam_password ad

Yes, I can just push out the file from Satellite, but I'd rather just have it be correct to begin with. What I don't know is ultimately what will happen if I change the line to "auth --enablead ..."

Not sure if that tries to use SAMBA (which we don't use) or if there would be any unforseen issues.

Can anyone out there help me to better understand these flags?

Thanks in advance!

is that even a kickstart option? where did you see it? I can't find any reference to it apart from here - http://pubs.vmware.com/vsphere-4-esx...art_diffs.html

why haven't you just tried it? I don't understand why you're asking instead of building a test box..?

It's a bit of a drastic step, but you might like to consider puppet over the awful config management stuff satellite uses. So you build a very basic kick start and then add all the fun stuff later with puppet

I'm not familiar with puppet. I'm new to the RHEL world and working with an established platform.

As far as just trying it, I have done so. Built a VM and tried the "--enablead" instead of "--enablemd5" and now the /etc/ldap.conf line is "pam_password crypt" instead of "pam_password ad"

I'm going to keep plugging away at this, but didn't know if maybe someone could help speed me along to a solution.

Thanks!!

well as the link suggests, --enablead looks like it's not a legal kickstart option.

Well, I'm attempting what I think may be a work-around, but I'm not sure it there will be any issues with it that I may not be aware of.

Basically, I added a line at the end of the script:

sed -i "s|md5|ad|g" /etc/ldap.conf

This makes the replacement in the config file and, so far as I can tell, I'm still able to access the system as normal. It seems to me that this is a pretty ugly way to do it, plus I don't know if it could cause problems elsewhere.

Is this a sufficient way to handle this issue or am I setting myself up for some unexpected headaches later?

Thanks!!

Well I've never used that pam option, but I've certainly written a LOT of postscripts. As long as they're written well, they're fine.