8

I am trying to allow RHEL to use login accounts that are created on the system, but use the passwords from Active Directory. I have seen someone use:

authconfig \
--enablekrb5 \
--krb5realm=KDCRealm.NET \
--krb5kdc=kcldap.net \
--krb5adminserver=kcldap.net \
--enablekrb5kdcdns \
--enablekrb5realmdns \
--update

although, I'm not sure how or what that command does, or what files it modifies.

6

You can run authconfig-gtk to get an idea of the things authconfig can modify.

screenshots of GUI

                            ss #1

                            ss #2

In general most of the information in these tabs is manipulating information under the directory /etc/sysconfig. There are a number of files there that pertain to the configuration of a RedHat based distro such as Fedora, CentOS, or RHEL.

For example, there's a file called, ironically, authconfig which contains the choices from the dialogs in the screenshots above.

$ more /etc/sysconfig/authconfig
USEMKHOMEDIR=no
USEPAMACCESS=no
CACHECREDENTIALS=yes
USESSSDAUTH=no
USESHADOW=yes
USEWINBIND=no
USEDB=no
FORCELEGACY=no
USEFPRINTD=no
FORCESMARTCARD=no
PASSWDALGORITHM=sha512
USELDAPAUTH=no
USEPASSWDQC=no
USELOCAUTHORIZE=yes
USECRACKLIB=yes
USEWINBINDAUTH=no
USESMARTCARD=no
USELDAP=no
USENIS=no
USEKERBEROS=no
USESYSNETAUTH=no
USESSSD=no
USEHESIOD=no
10

The answer from slm is very good, but I was interested in exactly which files are going to be modified. This can be found in /usr/share/authconfig/authinfo.py. The below excerpt is from CentOS6:

SYSCONFDIR = "/etc"
PASSWORD_AUTH_PAM_SERVICE_AC = "password-auth-ac"
FINGERPRINT_AUTH_PAM_SERVICE_AC = "fingerprint-auth-ac"
SMARTCARD_AUTH_PAM_SERVICE_AC = "smartcard-auth-ac"

all_configs = [
        FileBackup("hesiod.conf", SYSCONFDIR+"/hesiod.conf"),
        FileBackup("yp.conf", SYSCONFDIR+"/yp.conf"),
        FileBackup("ldap.conf", SYSCONFDIR+"/ldap.conf"),
        FileBackup("nss_ldap.conf", SYSCONFDIR+"/nss_ldap.conf"),
        FileBackup("pam_ldap.conf", SYSCONFDIR+"/pam_ldap.conf"),
        FileBackup("nslcd.conf", SYSCONFDIR+"/nslcd.conf"),
        FileBackup("openldap.conf", SYSCONFDIR+"/openldap/ldap.conf"),
        FileBackup("krb5.conf", SYSCONFDIR+"/krb5.conf"),
        FileBackup("krb.conf", SYSCONFDIR+"/krb.conf"),
        FileBackup("pam_pkcs11.conf", SYSCONFDIR+"/pam_pkcs11/pam_pkcs11.conf"),
        FileBackup("smb.conf", SYSCONFDIR+"/samba/smb.conf"),
        FileBackup("nsswitch.conf", SYSCONFDIR+"/nsswitch.conf"),
        CacheBackup("cacheenabled.conf", ""),
        FileBackup("system-auth-ac", SYSCONFDIR+"/pam.d/"+AUTH_PAM_SERVICE_AC),
        FileBackup("password-auth-ac", SYSCONFDIR+"/pam.d/"+PASSWORD_AUTH_PAM_SERVICE_AC),
        FileBackup("fingerprint-auth-ac", SYSCONFDIR+"/pam.d/"+FINGERPRINT_AUTH_PAM_SERVICE_AC),
        FileBackup("smartcard-auth-ac", SYSCONFDIR+"/pam.d/"+SMARTCARD_AUTH_PAM_SERVICE_AC),
        FileBackup("authconfig", SYSCONFDIR+"/sysconfig/authconfig"),
        FileBackup("network", SYSCONFDIR+"/sysconfig/network"),
        FileBackup("libuser.conf", SYSCONFDIR+"/libuser.conf"),
        FileBackup("login.defs", SYSCONFDIR+"/login.defs"),
        FileBackup("sssd.conf", SYSCONFDIR+"/sssd/sssd.conf")]

The code also reveals that backups are being stored in here:

PATH_CONFIG_BACKUPS = "/var/lib/authconfig"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.