Chapter 4. Configuring Authentication Mechanisms Red Hat Enterprise Linux 7

System-Level Authentication Guide
1. Introduction to System Authentication
1. 1.1. Confirming User Identities
2. 1.2. As Part of Planning Single Sign-On
3. 1.3. Available Services
I. System Logins
1. 2. Configuring System Authentication
  1. 2.1. IdentityManagement Tools for System Authentication
  2. 2.2. Using authconfig
    1. 2.2.1. Tips for Using the authconfig CLI
    2. 2.2.2. Installing the authconfig UI
    3. 2.2.3. Launching the authconfig UI
    4. 2.2.4. Testing Authentication Settings
    5. 2.2.5. Saving and Restoring Configuration Using authconfig
2. 3. Selecting the Identity Store for Authentication with authconfig
  1. 3.1. IPAv2
    1. 3.1.1. Configuring IdM from the UI
    2. 3.1.2. Configuring IdM from the Command Line
  2. 3.2. LDAP and IdM
    1. 3.2.1. Configuring LDAP Authentication from the UI
    2. 3.2.2. Configuring LDAP User Stores from the Command Line
  3. 3.3. NIS
    1. 3.3.1. Configuring NIS Authentication from the UI
    2. 3.3.2. Configuring NIS from the Command Line
  4. 3.4. Winbind
    1. 3.4.1. Enabling Winbind in the authconfig GUI
    2. 3.4.2. Enabling Winbind in the Command Line
3. 4. Configuring Authentication Mechanisms
  1. 4.1. Configuring Local Authentication Using authconfig
    1. 4.1.1. Enabling Local Access Control in the UI
    2. 4.1.2. Configuring Local Access Control in the Command Line
  2. 4.2. Configuring System Passwords Using authconfig
    1. 4.2.1. Password Security
      1. 4.2.1.1. Configuring Password Hashing in the UI
      2. 4.2.1.2. Configuring Password Hashing on the Command Line
    2. 4.2.2. Password Complexity
      1. 4.2.2.1. Configuring Password Complexity in the UI
      2. 4.2.2.2. Configuring Password Complexity in the Command Line
  3. 4.3. Configuring Kerberos (with LDAP or NIS) Using authconfig
    1. 4.3.1. Configuring Kerberos Authentication from the UI
    2. 4.3.2. Configuring Kerberos Authentication from the Command Line
  4. 4.4. Smart Cards
    1. 4.4.1. Configuring Smart Cards Using authconfig
      1. 4.4.1.1. Enabling Smart Card Authentication from the UI
      2. 4.4.1.2. Configuring Smart Card Authentication from the Command Line
    2. 4.4.2. Smart Card Authentication in IdentityManagement
  5. 4.5. One-Time Passwords
  6. 4.6. Configuring Fingerprints Using authconfig
    1. 4.6.1. Using Fingerprint Authentication in the UI
    2. 4.6.2. Configuring Fingerprint Authentication in the Command Line
4. 5. Managing Kickstart and Configuration Files Using authconfig
5. 6. Enabling Custom Home Directories Using authconfig
II. Identity and Authentication Stores
1. 7. Configuring SSSD
  1. 7.1. Introduction to SSSD
    1. 7.1.1. How SSSD Works
    2. 7.1.2. Benefits of Using SSSD
  2. 7.2. Using Multiple SSSD Configuration Files on a Per-client Basis
  3. 7.3. Configuring Identity and Authentication Providers for SSSD
    1. 7.3.1. Introduction to Identity and Authentication Providers for SSSD
    2. 7.3.2. Configuring an LDAP Domain for SSSD
    3. 7.3.3. Configuring the Files Provider for SSSD
    4. 7.3.4. Configuring a Proxy Provider for SSSD
    5. 7.3.5. Configuring a Kerberos Authentication Provider
  4. 7.4. Additional Configuration for Identity and Authentication Providers
    1. 7.4.1. Adjusting User Name Formats
      1. 7.4.1.1. Defining the Regular Expression for Parsing Full User Names
      2. 7.4.1.2. Defining How SSSD Prints Full User Names
    2. 7.4.2. Enabling Offline Authentication
    3. 7.4.3. Configuring DNS Service Discovery
    4. 7.4.4. Defining Access Control Using the simple Access Provider
    5. 7.4.5. Defining Access Control Using the LDAP Access Filter
  5. 7.5. Configuring System Services for SSSD
    1. 7.5.1. Configuring Services: NSS
    2. 7.5.2. Configuring Services: PAM
    3. 7.5.3. Configuring Services: autofs
    4. 7.5.4. Configuring Services: sudo
  6. 7.6. SSSD Client-side Views
    1. 7.6.1. Defining a Different Attribute Value for a User Account
    2. 7.6.2. Listing All Overrides on a Host
    3. 7.6.3. Removing a Local Override
    4. 7.6.4. Exporting and Importing Local Views
  7. 7.7. Downgrading SSSD
  8. 7.8. Using NSCD with SSSD
  9. 7.9. Additional Resources
2. 8. Using realmd to Connect to an Identity Domain
3. 9. LDAP Servers
  1. 9.1. RedHat DirectoryServer
  2. 9.2. OpenLDAP
    1. 9.2.1. Introduction to LDAP
      1. 9.2.1.1. LDAP Terminology
      2. 9.2.1.2. OpenLDAP Features
      3. 9.2.1.3. OpenLDAP Server Setup
    2. 9.2.2. Installing the OpenLDAP Suite
      1. 9.2.2.1. Overview of OpenLDAP Server Utilities
      2. 9.2.2.2. Overview of OpenLDAP Client Utilities
      3. 9.2.2.3. Overview of Common LDAP Client Applications
    3. 9.2.3. Configuring an OpenLDAP Server
      1. 9.2.3.1. Changing the Global Configuration
      2. 9.2.3.2. The Front End Configuration
      3. 9.2.3.3. The Monitor Back End
      4. 9.2.3.4. Database-Specific Configuration
      5. 9.2.3.5. Extending Schema
      6. 9.2.3.6. Establishing a Secure Connection
      7. 9.2.3.7. Setting Up Replication
      8. 9.2.3.8. Loading Modules and Back ends
    4. 9.2.4. SELinux Policy for Applications Using LDAP
    5. 9.2.5. Running an OpenLDAP Server
      1. 9.2.5.1. Starting the Service
      2. 9.2.5.2. Stopping the Service
      3. 9.2.5.3. Restarting the Service
      4. 9.2.5.4. Verifying the Service Status
    6. 9.2.6. Configuring a System to Authenticate Using OpenLDAP
      1. 9.2.6.1. Migrating Old Authentication Information to LDAP Format
    7. 9.2.7. Additional Resources
III. Secure Applications
1. 10. Using Pluggable Authentication Modules (PAM)
  1. 10.1. About PAM
    1. 10.1.1. Other PAM Resources
    2. 10.1.2. Custom PAM Modules
  2. 10.2. About PAM Configuration Files
    1. 10.2.1. PAM Configuration File Format
    2. 10.2.2. Annotated PAM Configuration Example
  3. 10.3. PAM and Administrative Credential Caching
    1. 10.3.1. Common pam_timestamp Directives
    2. 10.3.2. Removing the Timestamp File
  4. 10.4. Restricting Domains for PAM services
2. 11. Using Kerberos
  1. 11.1. About Kerberos
    1. 11.1.1. The Basics of How Kerberos Works
    2. 11.1.2. About Kerberos Principal Names
    3. 11.1.3. About the Domain-to-Realm Mapping
    4. 11.1.4. Environmental Requirements
    5. 11.1.5. Considerations for Deploying Kerberos
    6. 11.1.6. Additional Resources for Kerberos
  2. 11.2. Configuring the Kerberos KDC
    1. 11.2.1. Configuring the Master KDC Server
    2. 11.2.2. Setting up Secondary KDCs
    3. 11.2.3. Kerberos Key Distribution Center Proxy
  3. 11.3. Configuring a Kerberos Client
  4. 11.4. Setting up a Kerberos Client for Smart Cards
  5. 11.5. Setting up Cross-Realm Kerberos Trusts
    1. 11.5.1. A Trust Relationship
    2. 11.5.2. Setting up a Realm Trust
3. 12. Working with certmonger
  1. 12.1. certmonger and Certificate Authorities
  2. 12.2. Requesting a Self-signed Certificate with certmonger
  3. 12.3. Requesting a CA-signed Certificate Through SCEP
  4. 12.4. Storing Certificates in NSS Databases
  5. 12.5. Tracking Certificates with certmonger
4. 13. Configuring Applications for Single Sign-On
  1. 13.1. Configuring Firefox to Use Kerberos for Single Sign-On
  2. 13.2. Certificate Management in Firefox
  3. 13.3. Certificate Management in Email Clients
A. Troubleshooting
1. A.1. Troubleshooting SSSD
  1. A.1.1. Setting Debug Logs for SSSD Domains
  2. A.1.2. Checking SSSD Log Files
  3. A.1.3. Problems with SSSD Configuration
  4. A.1.4. A User Cannot Log In After UID or GID Changed
  5. A.1.5. SSSD Control and Status Utility
    1. A.1.5.1. SSSD Configuration Validation
    2. A.1.5.2. Displaying User Data
    3. A.1.5.3. Domain Information
    4. A.1.5.4. Cached Entries Information
    5. A.1.5.5. Truncating the Log Files
    6. A.1.5.6. Removing the SSSD Cache
    7. A.1.5.7. Obtaining Information about an LDAP Group Takes Long
2. A.2. Troubleshooting sudo with SSSD and sudo Debugging Logs
  1. A.2.1. SSSD and sudo Debug Logging
3. A.3. Troubleshooting Firefox Kerberos Configuration
B. Revision History
Legal Notice

Language:
Format:

Language:
Format:

Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

RedHat EnterpriseLinux supports several different authentication methods. They can be configured using the authconfig tool or, in some cases, also using IdentityManagement tools.

4.1.Configuring Local Authentication Using `authconfig`

The Local Authentication Options area defines settings for local system accounts, not the users stored on the back end. These settings define user-based authorization to system services (as defined in /etc/security/access.conf). Otherwise, authorization policies can be defined within the identity provider or the services themselves.

4.1.1.Enabling Local Access Control in the UI

Enable local access control sets the system to check the /etc/security/access.conf file for local user authorization rules. This is PAM authorization.

Figure4.1.Local Accounts Fields

4.1.2.Configuring Local Access Control in the Command Line

There are two options for authconfig to enable local authorization controls. --enablelocauthorize skips network authentication and only checks local files for system users. --enablepamaccess configures the system to look for system authorization policies in /etc/security/access.conf.

[root@server ~]# authconfig --enablelocauthorize --enablepamaccess --update

Chapter 4. Configuring Authentication Mechanisms Red Hat Enterprise Linux 7 | Red Hat Customer Portal (2024)

Red Hat Training

4.1.Configuring Local Authentication Using authconfig

4.1.1.Enabling Local Access Control in the UI

4.1.2.Configuring Local Access Control in the Command Line

4.1.Configuring Local Authentication Using `authconfig`