Geekdom, Linux, Technology

Spacewalk, PAM, and Centrify…oh, my!

26 Comments

So, I’ve been spending a good portion of the last six months designing a software distribution system, and looking for a good way to manage user access in an AD environment, where LDAP is fractured, at best. A few months ago, we were approved to procure Centrify as a provider of AD integration, so we could get rid (entirely) of winbind,  and samba related services.

Finally, we are approaching handover, and time to integrate Spacewalk is here.

Spacewalk does NOT integrate directly to Active Directory. Never has, probably never will. It will, however, authenticate to PAM, and PAM does have methods to authenticate to AD- mostly with winbind. Centrify is supposed to be the bridge between them, and much more reliable than using winbind, but as we discovered (quickly), Spacewalk’s documentation does not cover connecting to AD or winbind or anything similar. A quick google finds a few tutorials on how to connect to winbind, but none on Centrify.

Long story short: we did get AD working: and the trick was using system-auth instead of satellite-rhn for the rhn.conf file. Apparently Centrify adds some magic deep in the system-auth file ( /etc/pam.d/system-auth ) that allows PAM to connect.

Long story long:

The tutorials we found on “the Google” were really trying their best to be helpful, but never quite got there.

The default for Spacewalk is to set the contents of /etc/rhn/rhn.conf  to

pam_auth_service = rhn-satellite

The default file is that rhn-satellite – /etc/pam.d/rhn-satellite . If Spacewalk were authenticating to LDAP or NIS or whatever, that file would be correct. Granted, it’s just a short PAM tree, five or so lines of sufficient, requisite, etc.

Further investigation reveals that Centrify needs to add a few lines, and change the others:

Original rhn-satellite :

auth            required         pam_env.so
auth            sufficient       pam_sss.so
auth            required         pam_deny.so
account         sufficient       pam_sss.so
account         required         pam_deny.so

The suggested fix found on a few sites:

auth             required         pam_centrify.so
auth             requisite        pam_centrify.so  deny
account          sufficient       pam_centrify.so
account          requisite        pam_centrify.so  deny
session          required         pam_centrify.so  homedir
password         sufficient       pam_centrify.so  try_first_pass
password         requisite        pam_centrify.so  deny

On the surface, this looks like it’s correct, but we could never get it to work.

However, further searching had located some people who had made it work by just pointing line in rhn.conf to “password-auth” instead of “rhn-satellite”, since Centrify adds several extra lines to integrate with the specific AD domains there (which I won’t share for obvious security reasons). However, newer versions don’t have a “password-auth” file, and use “system-auth” instead. Making /etc/rhn/rhn.conf read:

pam_auth_service = system-auth

…finally did the trick. You’ll need to look at those files your self: password-auth and or system-auth to determine where the settings you need are: you can copy them to rhn-satellite, or simply point the pam_auth_service to it directly. The latter is what I did.

Hopefully this will help a few people out there!

 

Bootnote: this should work both with Spacewalk and Satellite equally.

26 thoughts on “Spacewalk, PAM, and Centrify…oh, my!”

  15. Freee picts off wwwe dvas nudeJuie davies sexVintage
    erotic bookHairry chinede teenAdultt cerebral palseyFrree adlt movvie clips flameJancije dichkinson nakedEnoprmous penijs whikey bardsSeexy animWhoo writes tthe
    comic srip picklesBuyy magtnesium stripPhotos oof my mothsr nakedBoook frrom
    thhe sex annd thhe city movieAsiawn pisno sheert musicIlinois
    state police sexualWhhen is thhe pens fully grownNuude clubs in victorvilleHot sexy secraterisMilf ecstacyYou
    tjbe alternative asianChheap mature uuk escortsWomrn toiket pissingChies
    nde whores photosDran togeter fox nud iin showerBrian pumpe gefs
    asss lickCincinnati redhuead escortPoorn brosDaniielle goordon bonmdage model reviewsI fucked mmy asian boss inn heer hotelMy girlfrind fuucked
    a blacxk cockNailen pailen sexx mokvie tube8Teenn challenhges in thhe unitted statesFrree picturee
    nakked redhead womanFreee seex ideos dailoy interracialBigg titss hrdcore thumbsDennnis lear
    – assholeVintagge coppler broochh flowerGaay bareback conversionsLesbian nue womanGay masturbating 2008 jelsofrt enterprisees ltdVintage eko kitcjen utensiol setMainstream moves hardcore sexAkshhaye khqnna hairyFreee
    oral sexx trajlers woth cummfaced cutiesGrikled split breast chickenAnestthia
    fetishHuunt trannyTranniews video tgpOozy pussy juiceSexx toys iin indiaSexx
    offende rghts iin californiaSuubmissive girlfriends blowjos videosSexyy kimm serafinCanada
    eroticViceo gamme hentai mopvie clipsCimm escort torontoFotgos chicas majta xxxx
    gratisGirlks cummed oon whipe fuckedd compilationGlaam babeds cumshotgs tgp freeCharcoal grillled cnicken breastt recipesFree ude aass ssex thumbnailsAnjelina jolie podn tapesFreee lady body builder seex videosBiig diks
    shaggingLove pain ssex tankTllahassee transvestites andd crossdressersTwijnk blowhob thumbsBurrnett
    teen pussyHoot latina blow jobMossio biini smmit 2006Submitted sopo sexx videosHoot asss ylung
    girlsHenai rpgg online gamesLesbiasn teen inn poolGayy bllack nightclubsPotistions
    for having ajal sexPenjs sixe before and afterHag mdd escor pone listingTinna tuurner
    boobsGayy datin roomRussian wod for stripSigouurney wraver fullky
    nudePoorn video indiaNaked catoonsDefie magna cuum laudeOrgzsm zahraMotown sexYooung teenss grajdpa fuckCausess off coomplex cystic masss
    oof tthe breastSoutth easter confrerence girls nakedCloriis leachman nide annd altternative medicineOrkental nude videosAsian attooed womanAsian islaand communityBoob iis outt https://www.google.com/share.google?q=R3BbfZJvYf05oYlUF R keelly
    teenCojcrete ziip stripGiant miking boobsMassae titsErotc ssex
    storisBakersfueld swinger1000 xxx picture downloadCanadian gay truckerInvisibble woman hentaiLivve hoime adul
    camsTwwo lips sexMature wonan photo galleriesWashington redskins vintsge jacketSerewna wiliams
    gallery nudeHott youjng girrls 3 ppic teenAnime catoon nked pic womanWhyy okk cupjd sucksBiigg dicdk retro pornHanbdy mann fuckSmoiing iin pantyose chineseSexyy souts shaking
    itRemove vafinal odorTwwo girls onn black ouch lesbianFreee adult poprn materiual onlineBigg tiys ffucked h
    ardAbusewd granjny pornWoomen rapinng meen femdomPorrn hub naughty studentLealities miister sexuall misconductSistrer brother sister moom sexPorn hott giel poopingBreast cancer aand melanona
    riskAmateir ssex lessonsAsin resxtaurants iin pinellaws countyFree gayy turkish pornAmutuer milfLesbos squirting 2009 jelsoft enterrprises ltdGayy boyy
    magazinesNatqsha sexyOnhotype testting ffor breas canxer recurrenceFreee constance
    mariee nde picsGuyy oold pkrn wlman youngSomme pepple say
    sexx iis ovedr ratedAfreican nudee ativesFreee gallery gayy malle picturePrety
    lesbian omen ddo each otherNakd you lesbkan girlsVintage rogers
    silverwareMalee dildo tubeCougsrs poorn biig titsNatyrally attractive
    nude womenDiet aidds and sexual healthHoow tto fuck aftewr 50Spence at amateur straight guus picturesVideeos off nude
    teenSexyy womawn ejaculating onn ssex machinesErotic rights off counhtess draculaTrrue milkf storyMatur friend suckig redtubeCiera sppice rire
    dickTitt beatingsAdii romanjia swede porn

    Reply

Leave a Reply to Enriqueavava Cancel reply

Your email address will not be published. Required fields are marked *