Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow configuration of "listsep" #163

Closed
doubletwist13 opened this issue May 3, 2017 · 1 comment
Closed

Allow configuration of "listsep" #163

doubletwist13 opened this issue May 3, 2017 · 1 comment

Comments

@doubletwist13
Copy link

Because we use sssd to authenticate against AD and because AD allows groups with spaces in the name, in our environment we have to configure pam to use "listsep=," for "pam_access.so" entries in
fingerprint-auth-ac
password-auth-ac
smartcard-auth-ac
system-auth-ac

For example:
account required pam_access.so listsep=,

And then in access.conf, we configure the list of locations separated with commas:
For example:

  • : (some adgroup): 1.2.3.4, 5.6.7.8, LOCAL

I've "worked around it" via brute force by customizing the templates in my own copy of your module such that it ONLY supports using "listsep=," however it would be great (and likely useful for others) if this module supported doing that properly.

@ghoneycutt
Copy link
Owner

ghoneycutt commented May 3, 2017

You can specify these by using your own *_auth_lines parameters.

The module does not support smartcard and fingerprint, though I'm guessing those are really just symlinked to something else like system-auth.

What platform are you on? Can you confirm if the files above are symlinks or have the same content as system-auth or another -auth-ac file?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants