UNIX for Advanced & Expert Users

You can define a 'case ignore' in an LDAP schema for group names, for example.
This:
How to Add a Group Mapping Rule (Solaris CIFS Administration Guide)

mentions the fact that because windows group names in AD, LDAP's cousin, are case insensitive you have issues with group names in Solaris which are case sensitive. I never ran into this problem. And I assume that group names are case sensitive in most UNIXes.

How do you deal with this mishmash?

I think that all the groups are really given to us as lower case, but someone had tried to mix-case things to make it more readable. Sadly, we have some groups containing spaces, which messes up various things, like sorting output from ls -l looking for large files etc.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
After more testing, it seems that our CentOS 6 install is ignoring the case of the group. I'm not sure if we have coded to ignore case or it just does. It might cause a problem for some though, I'm sure.

I hope that you are not wanting an expert opinion from me - I'm just muddling through



Robin

So, implementation has gone very well, until someone asked the question "How do we know users are not sharing passwords?" There are controls in place to force regular changing of password, but of course they could be shared too. Is there a way for pam to log (anywhere) the source IP addresses?

I've looked at pages for pam_debug.so but I can't understand it.

What I see in /var/log/secure is something like this:-

Code:

Mar  1 12:13:12 PRX002 ss5: pam_succeed_if(ss5:auth): 'user' resolves to 'donald.trump'
Mar  1 12:13:12 PRX002 ss5: pam_succeed_if(ss5:auth): requirement "user ingroup socksusers" not met by user "donald.trump"
Mar  1 12:13:51 PRX002 ss5: pam_succeed_if(ss5:auth): 'user' resolves to 'rbatte1'
Mar  1 12:13:51 PRX002 ss5: pam_succeed_if(ss5:auth): requirement "user ingroup socksusers" was met by user "rbatte1"

So I get a nice message that I'm allowed through and donald.trump is not. What would be nice is something more like sshd kicks out:-

Code:

Mar  1 13:24:40 PRX002 sshd[4523]: Accepted publickey for rbatte1 from 10.13.13.13 port 46960 ssh2

Is there a way to turn this sort of thing on? There is nothing useful in
I'm sure pam is meant to be helpful, but it's very confusing.



Robin