5.5 Installing and uninstalling AIX PAM client on AIX server

This section contains details about how to install and uninstal AIX PAM client on AIX server.

Prerequisite:

  • It is required to define /bin/false as a shell on AIX machine. Navigate to /etc/security/login.cfg and add /bin/false under shells attribute. During installation, a group or user is created to manage service that is assigned to the specific shell.

  • The following points are relevant only to users recognized by AIX:

    • The AIX machine must be configured to use LDAP based user accounts and user groups from an Active Directory.

    • Users are created with passwords but are restricted from password-based login.

      NOTE:This only applies to the Advanced Authentication 6.5 Service Pack 1.

To install AIX PAM Client on the AIX server, perform the following:

  1. Run the following command to install the Advanced Authentication PAM Client plugin:

    rpm -ivh naaf-aixclient-aix-release-<version>.rpm

  2. Configure the following Advanced Authentication setting:

    1. Edit the /opt/pam_aucore/etc/pam_aucore.conf file to identify the Advacned Authentication server.

    2. Add discovery.host:<AA Server ip/DNS> in pam_aucore.conf.

  3. Execute the following commands to restart the Cache service:

    • stopsrc -s aaacache

    • startsrc -s aaacache

  4. To enable the Advanced Authentication PAM Client plugin, perform the steps detailed in the Enable ssh on AIX to use PAM section in the IBM Support page.

  5. To enable the Advanced Authentication PAM plugin for SSH, perform the following:

    1. Edit the /etc/pam.conf file.

      Comment existing sshd under Authentication section and add the following line to use Advanced Authentication:

      pam_aucore: sshd auth required /opt/pam_aucore/lib/pam_aucore.so

      NOTE:Do not modify sshd under Account Management, Password Management, and Session Management. Retain the default settings of pam_aix.

      For more information, see the Enable ssh on AIX to use PAM section in the IBM Support page.

    2. Edit /etc/ssh/sshd_config and add the following parameters:

      • ChallengeResponseAuthentication yes

      • UsePAM yes

        NOTE:If the parameter UsePAM is existing and set to no then modify the value to yes.

    3. Edit /etc/security/login.cfg and set auth_type = PAM_AUTH instead of STD_AUTH.

    4. Execute the following commands to restart sshd:

      stopsrc -s sshd

      startsrc -s sshd

To uninstall AIX PAM Client on AIX server, run the following command:

rpm -e pam_aucore

NOTE:After you uninstall the AIX PAM Client, it is required to revert the changes that have been made to the following files:

  • /etc/pam.conf

  • /etc/ssh/sshd_config

  • /etc/security/login.cfg