Originally posted by: SystemAdmin

Hi there,

We have a client that has recently updated their AIX from 5.2 to 5.2 ML 9

This client had set their /etc/security/user file to run a secondary program when users login

This was entered in the /etc/security/user file as:

auth1 = SYSTEM,anyprogram

the "anyprogram" is the name of the program that runs which is defined in /usr/lib/security/methods.cfg

anyprogram:
/usr/proc/anyprogram
OK, well this process was working fine until they upgraded to ML 09 and NOW if the settings are left as described above the user receives the following error when logging in:

3004-007 You entered an invalid login name or password.

however if the auth1 line is changed to not run the additional program as follows:

auth1 = SYSTEM

then the user can login fine, no problems at all.

OK, the question is, the client needs to run this or similar programs as part of their authentication procedure, so WHY is this no longer working since the upgrade.

Does anybody have any suggestions as to what we might try ??


#AIX-Forum

Originally posted by: SystemAdmin

I know that in AIX 5.3 that auth1 is no longer supported. I'm not sure if this also changed in this TL of AIX 5.2, but it is likely since it was considered a security whole if poor programing was done. The replacement is to write a 'loadable authentication module' and place that in /usr/lib/security and then create a stanze in /usr/lib/security/methods.cfg like this example for the NIS module where both a 32-bit and 64-bit module were supplied.

NIS:
program = /usr/lib/security/NIS
program_64 = /usr/lib/security/NIS_64

My replaceing NIS with anyprogram (that matches the LAM module specs) you can get the same features of the auth1 in earlier AIX releases. Once you move to AIX 5.3, then there is an alternative method and that is to use PAM_AUTH, and then write a PAM module and place it in pam.cfg.

I'm sure the next question is where is the sample LAM module and documentation on how to write that. I don't know the answer to that, but someone else may.
#AIX-Forum

Originally posted by: SystemAdmin

Thanks for the quick response, the strange thing is that although it may not be supported in 5.3 it must still work, because this same client has upgraded one of their development boxes to 5.3 and this does still work on that box !!!

Also they have another system with 5.2 ML 09, that also runs this method fine, and despite having spent hours comparing files and permissions etc, trying to get to the root of the problem, I can find no discernible differences.

We have suggested a full re-install, but the client is understandably not too keen on this idea to fix what is really only a minor irritation.

Any other thoughts would be gratefully received, although I will look into your suggestions and put them forward to the client as an alternative solution.
#AIX-Forum