pam_time

pbwalker · 10-16-2010, 04:26 PM

Hello,

I'm trying to grasp pam_time.

I understand the time.conf file, the syntax, and how it works. Where my confusion lies is here:

Where do you reference pam_time.so? e.g., I know you can't put it in system-auth...so where does "account required pam_time.so" get placed? In /etc/pam.d/login?

anomie · 10-16-2010, 08:36 PM

What Linux distro / version?

Per pam_time(8), only the account modules is provided - as you noted. I've not used it, but isn't it trivial enough to test your hypothesis (on a test system)?

pbwalker · 10-16-2010, 11:25 PM

sorry 'bout that. RHEL 5.

I've been doing some testing, but wanted to get a better understanding on whether or not what I was doing was right, or a fluke.

anomie · 10-17-2010, 03:26 PM

[ I need to fire up CentOS5 in a VM to tinker around for questions like this... ]

TBH, system-auth seems like exactly the right place for this. What bad (?) behavior were you seeing when you tried it there?

pbwalker · 10-18-2010, 10:20 AM

The file was being regenerated when system-config-authentication was run.

I've found out that, indeed, system-auth is the place to put it. But when authconfig or system-config-authentication is run, the changes are gone.

I'll just be sure to setup NIS and/or LDAP (with sys-config-auth) *before* I mess around with PAM.

anomie · 10-20-2010, 10:31 AM

You can take this advice or leave it (it's mainly just a reflection of my own philosophy when it comes to dealing with RHEL's system-config-* utilities): once you have system-auth configured exactly the way you need it, you might want to:

Code:

# chattr +i /etc/pam.d/system-config

When a utility tries to overwrite it later, it won't be able to.