?

?(See also related documents at http://web.singnet.com.sg/~garyttt/ )

?

Last Updated: 26-Aug-2006

?

Purpose:

?

The document is one of the deliverables of the “ OpenLDAP Centralized Authentication Project ”, the reader may also refer to its sister documents titled “ Installing and configuring OpenLDAP for RedHat Enterprise Linux3 ”

?

This document describes the steps involved in installing and configuring an OpenSSH Server, which is also an OpenLDAP Client, with pam_ldap support on RedHat Enterprise Linux3. This is to be accessed by Windows/UNIX/Linux OpenSSH clients.

?

Another related document " Deploying OpenLDAP Client by using automated scripts ", describes the steps involved in building up an infrastructure environment for rapid deployment of OpenLDAP Client.

?

NOTE: All the steps here are also applicable to RedHat Fedora Core1/2 and RedHat Linux9 , as well as RHEL4/RHFC3.

?

Useful URLs:

· ?????? SUN’s “System Administration Guide: Security Services - May 2002” (could be found at http://docs.sun.com)

· ?????? OpenSSH: http://www.openssh.org/

· ?????? OpenSSH LPK (LDAP Public Key) patch: http://www.opendarwin.org/en/projects/openssh-lpk

· ?????? OpenSSL: http://www.openssl.org /

· ?????? PAM: http://www.kernel.org/pub/linux/libs/pam/

· ?????? PAM_LDAP and NSS_LDAP: http://www.padl.com

?

Example used:

· ?????? NSS_LDAP and PAM_LDAP library path: /lib and /lib/security respectively

· ?????? OpenSSL install directory = /usr

· ?????? OpenLDAP? install directory = /usr

?

Observed Issues:

· ?????? PuTTY SSH Protocol 1 Client DOES NOT WORK

· ?????? "su – uid" “incorrect password” despite correct password entry, I have found a fix, see “Tips” under Step 7, this “tips” is not required on RHEL4/RHFC3 Client.

?

Step 1: Install nss_ldap 2.X.X and pam_ldap 1.X.X

?

This step is OPTIONAL and could be skipped if you intend to use the existing nss_ldap and pam_ldap libraries already come with RHEL3.

?

IMPORTANT: It is highly recommended that these configuration steps be carried up at the LOCAL SYSTEM CONSOLE while logging in as root, ON TOP OF THIS, MULTIPLE REMOTE root sessions should be opened. In case of any incorrect configuration that messes up your system, it can be repaired.

?

For RedHat Linux systems, whenever "su – user" or "su – root" issue occurs, and you don't intend to continue troubleshooting, at these LOCAL or REMOTE root sessions, issue the command "authconfig” and restore back the original RedHat Linux Authentication scheme (it will generate the original /etc/pam.d/system-auth file, press Ctrl-C if the screen appears freezed).

?

Log in as ‘root’ at the console of LDAP Client.

?

IMPORTANT NOTE: You must configure/install OpenLDAP prior to nss_ldap, if not the "configure" command shown below will complain about "LDAP Library not found" as the type of LDAP is defined as "openldap".

?

Build nss_ldap from source:

?

# cd /var/tmp

# tar xvf nss_ldap.tar

# cd nss_ldap-2XX

# ./configure --libdir=/lib --with-ldap-lib=openldap --with-ldap-dir=/usr --with-ldap-conf-file=/etc/ldap.conf --with-ldap-secret-file=/etc/ldap.secret

# make clean

# make

# make install

?

IMPORTANT NOTE: You must configure/install nss_ldap prior to pam_ldap as it will populate /usr/local/include with header files that pam_ldap requires, depending on which version of LDAP you are using, example: ldap.h, this file is LDAP version dependant, this will avoid pam_ldap "configure" error "could not locate <ldap.h>".

?

Build pam_ldap from source, use EXACTLY the same configuration options:

?

# cd /var/tmp

# tar xvf pam_ldap.tar

# cd pam_ldap-1XX

# ./configure --libdir=/lib --with-ldap-lib=openldap --with-ldap-dir=/usr --with-ldap-conf-file=/etc/ldap.conf --with-ldap-secret-file=/etc/ldap.secret

# make clean

# make

# make install

?

?

Step 2: Install OpenSSL 0.9.7e

?

Skip this step if it is already installed as shared libraries objects.

?

# cd /var/tmp

# tar xvf openssl-0.9.7e.tar

# cd openssl-0.9.7e

# ./config shared --prefix=/usr

# make clean

# make

# make install

?

Additional steps shown below are required to rename and hide openssl-0.9.7a original files (due to the fact that RedHat stores libssl and libcrypto shared object files at odd location, i.e. /lib).

?

# cd /lib

# mv -f libssl.so.4 libssl.so.4.orig

# ln -s /usr/lib/libssl.so.0.9.7 libssl.so.4

# mv -f libcrypto.so.4 libcrypto.so.4.orig

# ln -s /usr/lib/libcrypto.so.0.9.7 libcrypto.so.4

?

Verify the OpenSSL version

?

# /usr/bin/openssl

OpenSSL> version

OpenSSL 0.9.7e DD MMM YYYY

OpenSSL> exit

?

Step 3: Configure and install OpenSSH Server

?

Prior to doing anything, backup the SUN SSH Server original configuration files and host keys.

?

# mkdir –p /etc/ssh.orig

# cp /etc/ssh/* /etc/ssh.orig

?

Now configure OpenSSH with support for PAM and OpenSSL

?

NOTE: RedHat OpenSSH usually stores host keys in /etc/ssh

?

# cd /var/tmp

# tar xvf openssh-3.X.XpX.tar

# cd openssh-3.X.XpX

# ./configure --prefix=/usr --with-pam --sysconfdir=/etc/ssh --with-ssl-dir= /usr

?

Compile and install it

?

# make clean

# make

# make install

?

(IMPORTANT Note: having --sysconfdir=/etc/ssh will preserve OpenSSH original /etc/ssh/ssh_config and /etc/ssh/sshd_config as well as host keys, but as the original sshd_config file MAY NOT include NEW settings, you MAY overwrite sshd_config with a sample from OpenSSH distribution, with references to original settings)

?

Step 4: Create start/stop scripts

?

Create /etc/init.d/openssh.server, this step is OPTIONAL as you may use RedHat's /etc/init.d/sshd script

?

# touch /etc/init.d/openssh.server; chmod 744 /etc/init.d/openssh.server

?

Content of /etc/init.d/openssh.server

?

#! /bin/sh

case $1 in

'start')

??????? /usr/sbin /sshd

??? ????;;

'stop')

??????? PID=`cat /var/run/sshd.pid`

??????? if [ -n "$PID" ]

??????? then

??????????????? /usr/bin/kill -9 $PID

??????? fi

??????? ;;

*)

??????? echo "usage: /etc/init.d/sshd {start|stop}"

??????? ;;

esac

?

Copy (Overwrite) sample sshd_config and ssh_config from OpenSSH

?

# cp /var/tmp/openssh-3.X.XpX/sshd_config /etc/ssh

# cp /var/tmp/openssh-3.X.XpX/ssh_config /etc/ssh

?

Edit /etc/ssh/sshd_config, enable PasswordAuthentication, enable ChallengeResponseAuthentication, enable PAM and verify path for sftp-server does exist

?

# vi /etc/ssh/sshd_config

?

PasswordAuthentication yes

ChallengeResponseAuthentication yes

UsePAM yes

Subsystem?????? sftp??? /usr/libexec /sftp-server

?

Note: in older version (pre-3.6.1) of OpenSSH Server, instead of? “UsePAM yes”, the parameter is:

# Set this to 'yes' to enable PAM keyboard-interactive authentication
# Warning: enabling this may bypass the setting of 'PasswordAuthentication'
PAMAuthenticationViaKbdInt yes

?

Create privilege separation user id as per OpenSSH requirement

?

# mkdir –p /var/empty; chmod 755 /var/empty

# groupadd -g 999 sshd

# useradd -u 999 -g 999 –c “sshd privilege separation”? -d /var/empty -s /bin/false sshd

?

Optionally, for any reason if there is a need to re-create the host keys for sshd, you may perform:

?

/usr/bin /ssh-keygen -t rsa1 -f /etc/ssh/ssh_host_key -N ""

/usr/bin /ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N ""

/usr/bin /ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ""

?

Optionally, you may want to fine tune OpenSSH server for it to be more secure, i.e. use only Protocol 2, disable default PermitRootLogin, enable X11Forwarding, and so on…below is an example:

?

# sed -e 's/#Protocol 2,1/Protocol 2/' \

?? -e 's/#PermitRootLogin yes/PermitRootLogin no/' \

?? -e 's/#X11Forwarding no/X11Forwarding yes/' \

?? -e 's/#PrintMotd yes/PrintMotd no/' \

?? /etc/ssh/sshd_config > /etc/ssh/sshd_config_new

# mv /etc/ssh/sshd_config_new /etc/ssh/sshd_config

?

That’s all, kill existing SSH Server and re-start OpenSSH Server

?

# /etc/init.d/sshd stop; /etc/init.d/openssh.server start

?

OR use the RedHat's way:

?

# service sshd restart

?

Step 5: Create ldap.conf for BOTH pam_ldap and OpenLDAP

?

There are two ldap.conf files, one for pam_ldap, which is usually named /etc/ldap.conf, another for OpenLDAP client, which is usually named /etc/openldap/ldap.conf:

?

Create these two files.

?

Content of /etc/ldap.conf, those in green are required entries.

?

# List two or more LDAP servers if failover is required

host ldap1.example.com ldap2.example.com

# “host” directive may be deprecated in future releases,

# you may wish to use ‘uri’ directive to replace “host” directive

# uri ldap://ldap1.example.com ldap://ldap2.example.com

base dc=example,dc=com

ldap_version 3

binddn cn=proxyagent,ou=profile,dc=example,dc=com

bindpw password

# The distinguished name to bind to the server with

# if the effective user ID is root. Password is

# stored in /etc/ldap.secret (mode 600)

rootbinddn cn=Manager,dc=example,dc=com

port 389

# The search scope.

#scope sub

#scope one

#scope base

# Search timelimit

#timelimit 30

# Bind timelimit

#bind_timelimit 30

# Idle timelimit; client will close connections

# (nss_ldap only) if the server has not been contacted

# for the number of seconds specified below.

#idle_timelimit 3600

?

# Filter to AND with uid=%s

#pam_filter objectclass=account

pam_filter objectclass=posixAccount

# The user ID attribute (defaults to uid)

pam_login_attribute uid

?

# Search the root DSE for the password policy (works

# with Netscape Directory Server)

#pam_lookup_policy yes

?

# Check the 'host' attribute for access control

# Default is no; if set to yes, and user has no

# value for the host attribute, and pam_ldap is

# configured for account management (authorization)

# then the user will not be allowed to login.

#pam_check_host_attr yes

?

# Group to enforce membership of

#pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com

?

# Group member attribute

#pam_member_attribute uniquemember

pam_member_attribute memberUid

?

# Specify a minium or maximum UID number allowed

#pam_min_uid 0

#pam_max_uid 0

?

# Template login attribute, default template user

# (can be overriden by value of former attribute

# in user's entry)

#pam_login_attribute userPrincipalName

#pam_template_login_attribute uid

#pam_template_login nobody

?

# HEADS UP: the pam_crypt, pam_nds_passwd,

# and pam_ad_passwd options are no

# longer supported.

?

# Do not hash the password at all; presume

# the directory server will do it, if

# necessary. This is the default.

#pam_password clear

?

# Hash password locally; required for University of

# Michigan LDAP server, and works with Netscape

# Directory Server if you're using the UNIX-Crypt

# hash mechanism and not using the NT Synchronization

# service.

pam_password crypt

?

# Remove old password first, then update in

# cleartext. Necessary for use with Novell

# Directory Services (NDS)

#pam_password nds

?

# Update Active Directory password, by

# creating Unicode password and updating

# unicodePwd attribute.

#pam_password ad

?

# Use the OpenLDAP password change

# extended operation to update the password.

#pam_password exop

?

# Redirect users to a URL or somesuch on password

# changes.

#pam_password_prohibit_message Please visit http://internal to change your password.

?

# RFC2307bis naming contexts

# Syntax:

# nss_base_XXX????????? base?scope?filter

# where scope is {base,one,sub}

# and filter is a filter to be &'d with the

# default filter.

# You can omit the suffix eg:

# nss_base_passwd?????? ou=People,

# to append the default base DN but this

# may incur a small performance impact.

nss_base_passwd ou=People,dc=example,dc=com?one

nss_base_shadow ou=People,dc=example,dc=com?one

nss_base_group????????? ou=group,dc=example,dc=com?one

#nss_base_hosts???????? ou=Hosts,dc=example,dc=com?one

#nss_base_services????? ou=Services,dc=example,dc=com?one

#nss_base_networks????? ou=Networks,dc=example,dc=com?one

#nss_base_protocols???? ou=Protocols,dc=example,dc=com?one

#nss_base_rpc?????????? ou=Rpc,dc=example,dc=com?one

#nss_base_ethers??????? ou=Ethers,dc=example,dc=com?one

#nss_base_netmasks????? ou=Networks,dc=example,dc=com?ne

#nss_base_bootparams??? ou=Ethers,dc=example,dc=com?one

#nss_base_aliases?????? ou=Aliases,dc=example,dc=com?one

nss_base_netgroup????? ou=netgroup,dc=example,dc=com?one

?

# attribute/objectclass mapping

# Syntax:

#nss_map_attribute?? ???rfc2307attribute??????? mapped_attribute

#nss_map_objectclass??? rfc2307objectclass????? mapped_objectclass

?

# configure --enable-nds is no longer supported.

# For NDS now do:

#nss_map_attribute uniqueMember member

?

# configure --enable-mssfu-schema is no longer supported.

# For MSSFU now do:

#nss_map_objectclass posixAccount User

#nss_map_attribute uid msSFUName

#nss_map_attribute uniqueMember posixMember

#nss_map_attribute userPassword msSFUPassword

#nss_map_attribute homeDirectory msSFUHomeDirectory

#nss_map_objectclass posixGroup Group

#pam_login_attribute msSFUName

#pam_filter objectclass=User

#pam_password ad

?

# configure --enable-authpassword is no longer supported

# For authPassword support, now do:

#nss_map_attribute userPassword authPassword

#pam_password nds

?

# For IBM SecureWay support, do:

#nss_map_objectclass posixAccount aixAccount

#nss_map_attribute uid userName

#nss_map_attribute gidNumber gid

#nss_map_attribute uidNumber uid

#nss_map_attribute userPassword passwordChar

#nss_map_objectclass posixGroup aixAccessGroup

#nss_map_attribute cn groupName

#nss_map_attribute uniqueMember member

#pam_login_attribute userName

#pam_filter objectclass=aixAccount

#pam_password clear

?

# Netscape SDK LDAPS

#ssl on

?

# Netscape SDK SSL options

#sslpath /etc/ssl/certs/cert7.db

?

# OpenLDAP SSL mechanism

# start_tls mechanism uses the normal LDAP port, LDAPS typically 636

ssl start_tls

#ssl on

?

# OpenLDAP SSL options

# Require and verify server certificate (yes/no)

# Default is "no"

tls_checkpeer yes

?

# CA certificates for server certificate verification

# At least one of these are required if tls_checkpeer is "yes"

#tls_cacertfile /etc/ssl/ca.cert

#tls_cacertdir /etc/ssl/certs

# Un-comment for RedHat

tls_cacertfile /etc/openldap/cacert.pem

# Un-comment for Others

#tls_cacertfile /usr/local/etc/openldap/cacert.pem

?

# Seed the PRNG if /dev/urandom is not provided

#tls_randfile /var/run/egd-pool

?

# SSL cipher suite

# See man ciphers for syntax

#tls_ciphers TLSv1

?

# Client certificate and key

# Use these, if your server requires client authentication.

#tls_cert

#tls_key

?

Content of /etc/openldap/ldap.conf

?

HOST??? ldap1.example.com ldap2.example.com

# URI ldap://ldap1.example.com ldap://ldap2.example.com

BASE??? dc=example,dc=com

?

# Un-comment for RedHat

TLS_CACERT?? ??/etc/openldap/cacert.pem

# Un-comment for others

#TLS_CACERT????? /usr/local/etc/openldap/cacert.pem

?

Note: For RHEL4/RHFC3 Client, running “authconfig” with TLS option selected will always add a line to use CACERTDIR method to the end of? /etc/ldap.conf, so please comment out the CACERTFILE method in /etc/ldap.conf and also /etc/openldap/ldap.conf, as shown:

?

      
        /etc/ldap.conf:
      
    

      
        
          #tls_cacertfile /etc/openldap/cacert.pem
        
      
    

      
        
          tls_cacertdir /etc/openldap/cacerts
        
      
    

      
        /etc/openldap/ldap.conf:
      
    

      
        
          #TLS_CACERT /etc/openldap/cacert.pem
        
      
    

      
        
          TLS_CACERTDIR /etc/openldap/cacerts
        
      
    

?

After that you GOT to generate the X.509 HASH which is a symbolic link to cacert.pem, you may use the following script to help you:

?

      
        # cat get_x509_hash.sh
      
    

      
        
          HASH=`openssl x509 -noout -hash -in /etc/openldap/cacert.pem`
        
      
    

      
        
          echo Please run these commands
        
      
    

      
        
          echo "cd /etc/openldap/cacerts"
        
      
    

      
        
          echo "ln -s ../cacert.pem $HASH.0"
        
      
    

?

Step 6: Prepare /etc/openldap/cacert.pem

?

cacert.pem contains the ONE PER ORGANIZATION Self-Signed Certification Authority Certificate that was generated at the MASTER LDAP Server(s) for all OpenLDAP Clients to talk to OpenLDAP Server in " start_tls " mode (also called SSL_TLS)? at the usual LDAP port 389 .

?

You must generate this file at the OpenLDAP Server, details could be found in " Installing and configuring OpenLDAP for RedHat Enterprise Linux3 ", and copy it over to all LDAP clients into your preferred location referenced by BOTH /etc/ldap.conf and /etc/openldap/ldap.conf.

?

The following is an example of /etc/openldap/cacert.pem.

?

-----BEGIN CERTIFICATE-----

MIIEBjCCA2+gAwIBAgIBADANBgkqhkiG9w0BAQQFADCBuTELMAkGA1UEBhMCVVMx

ETAPBgNVBAgTCE5ldyBZb3JrMRYwFAYDVQQHEw1OZXcgWW9yayBDaXR5MSYwJAYD

VQQKEx1QTEFUVFMsIE1jR3Jhdy1IaWxsIENvbXBhbmllczEPMA0GA1UECxMGUExB

VFRTMSIwIAYDVQQDExluamhwbHBtb24xLnBsYXR0cy5taG0ubWhjMSIwIAYJKoZI

hvcNAQkBFhNnYXJ5X3RheUBwbGF0dHMuY29tMB4XDTA0MDcwNjAyNTExNFoXDTE0

MDcwNDAyNTExNFowgbkxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhOZXcgWW9yazEW

MBQGA1UEBxMNTmV3IFlvcmsgQ2l0eTEmMCQGA1UEChMdUExBVFRTLCBNY0dyYXct

SGlsbCBDb21wYW5pZXMxDzANBgNVBAsTBlBMQVRUUzEiMCAGA1UEAxMZbmpocGxw

bW9uMS5wbGF0dHMubWhtLm1oYzEiMCAGCSqGSIb3DQEJARYTZ2FyeV90YXlAcGxh

dHRzLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0wqm6JKsUMIXRYyn

YRKDUYh//+57SJl+XSES7xz/TRO+rvfmnpZWFqHdMG6K5ruPVjQeusSQfNxuZT8T

aMOXpI0Upv2pvmGJyP88zxSN/kS6btDJHqKOrF3sp8P/BJOgDartHb2/gVcdHXYE

/QISDwMRJncE0kFOxhBJ/1U8I20CAwEAAaOCARowggEWMB0GA1UdDgQWBBQlvKCz

RfHlJXtG5ecwD0XrmLg2NzCB5gYDVR0jBIHeMIHbgBQlvKCzRfHlJXtG5ecwD0Xr

mLg2N6GBv6SBvDCBuTELMAkGA1UEBhMCVVMxETAPBgNVBAgTCE5ldyBZb3JrMRYw

FAYDVQQHEw1OZXcgWW9yayBDaXR5MSYwJAYDVQQKEx1QTEFUVFMsIE1jR3Jhdy1I

aWxsIENvbXBhbmllczEPMA0GA1UECxMGUExBVFRTMSIwIAYDVQQDExluamhwbHBt

b24xLnBsYXR0cy5taG0ubWhjMSIwIAYJKoZIhvcNAQkBFhNnYXJ5X3RheUBwbGF0

dHMuY29tggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAdra0I6Ei

Y+qgJyzBUM2ObxYAv26hDa+Vmk0VjVDxTBpjh1+4VM7ufWitClst3MZJy/ht/8Ui

4hBC6MtOdTnMb7YxJ6dCBHQ01WKs7pTPbYGuxAweSQQ/Jx3opmh55RyqFFs1/S4f

diTGRXhlVYaLsUP6FMCyvjXe3Tg68HBLyio=

-----END CERTIFICATE-----

?

?

Step 7: Backup and Create /etc/pam.d/system-auth

?

Log in as root at the console of LDAP Client ?(SSH Server)

?

Make a backup copy of /etc/pam.d/system-auth

?

# cp /etc/pam.d/system-auth /etc/pam.d/system-auth.orig

?

run " authconfig " to generate /etc/pam.d/system-auth for LDAP Authentication, if there is any issue, run authconfig again to restore back the original system-auth, or just restore from the backup.

?

User Information Configuration:

[*] Use LDAP

[*] Use TLS

Server: ldap1.example.com,ldap2.example.com

Base DN: dc=example,dc=com

?

Authentication Configuration:

[*] Use LDAP Authentication

[*] Use TLS

Server: ldap1.example.com,ldap2.example.com

Base DN: dc=example,dc=com

?

Tips: if the generated system-auth has a bug such that "su – userid" will display "incorrect password" even when correct password is provided, to fix it, replace one of the "account" lines, as shown below:

?

# diff /etc/pam.d/system-auth /etc/pam.d/system-auth.ldapauth

9c9

< account???? required ????? /lib/security/$ISA/pam_unix.so

---

> account???? sufficient ????? /lib/security/$ISA/pam_unix.so

?

Content of /etc/pam.d/system-auth that will fix “su – incorrect password issue”.

?

#%PAM-1.0

# This file is auto-generated.

# User changes will be destroyed the next time authconfig is run.

auth??????? required????? /lib/security/$ISA/pam_env.so

auth??????? sufficient??? /lib/security/$ISA/pam_unix.so likeauth nullok

auth??????? sufficient??? /lib/security/$ISA/pam_ldap.so use_first_pass

auth??????? required????? /lib/security/$ISA/pam_deny.so

?

account???? sufficient ????? /lib/security/$ISA/pam_unix.so

account???? [default=bad success=ok user_unknown=ignore service_err=ignore system_err=ignore] /lib/security/$ISA/pam_ldap.so

?

password??? required????? /lib/security/$ISA/pam_cracklib.so retry=3 type=

password??? sufficient??? /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow

password??? sufficient??? /lib/security/$ISA/pam_ldap.so use_authtok

password??? required??? ??/lib/security/$ISA/pam_deny.so

?

# Un-comment the next line if you want pam_mkhomedir.so to mkdir $HOME on the fly

#session??? sufficient ?? pam_mkhomedir.so skel=/etc/skel/ umask=0022

session???? required????? /lib/security/$ISA/pam_limits.so

session???? required????? /lib/security/$ISA/pam_unix.so

session???? optional????? /lib/security/$ISA/pam_ldap.so

?

NOTE 1: "authconfig" will at the end of the run, stop and restart /etc/init.d/nscd, if it hangs, press CTRL-C and then run "service nscd restart"

?

NOTE 2: if “authconfig” is re-run again, /etc/pam.d/system-auth will be re-generated and overwritten, therefore manual edit of this file is required if there are customizations.

?

NOTE 3: if you are using a latest update of RHEL3 or RHEL4/RHFC3, the above “tips” to replace the “required” keyword for pam_unix.so is not required, as the generated system-auth is good without “su – user” incorrect password issue.

?

Sample content of “system-auth” generated for RHEL3 and RHEL4/RHFC3 that works right out of the box:

?

RHEL3:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth??????? required????? /lib/security/$ISA/pam_env.so
auth??????? sufficient??? /lib/security/$ISA/pam_unix.so likeauth nullok
auth??????? sufficient??? /lib/security/$ISA/pam_ldap.so use_first_pass
auth??????? required????? /lib/security/$ISA/pam_deny.so

account???? required????? /lib/security/$ISA/pam_unix.so
account???? [default=bad success=ok user_unknown=ignore service_err=ignore system_err=ignore] /lib/security/$ISA/pam_ldap.so

password??? required????? /lib/security/$ISA/pam_cracklib.so retry=3 type=
password??? sufficient??? /lib/security/$ISA/pam_unix.so nullok use_authtok shadow
password??? sufficient??? /lib/security/$ISA/pam_ldap.so use_authtok
password??? required????? /lib/security/$ISA/pam_deny.so

session???? required????? /lib/security/$ISA/pam_limits.so
session???? required????? /lib/security/$ISA/pam_unix.so
session???? optional????? /lib/security/$ISA/pam_ldap.so

RHEL4/RHFC3:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth??????? required????? /lib/security/$ISA/pam_env.so
auth??????? sufficient??? /lib/security/$ISA/pam_unix.so likeauth nullok
auth??????? sufficient??? /lib/security/$ISA/pam_ldap.so use_first_pass
auth??????? required????? /lib/security/$ISA/pam_deny.so

account???? required????? /lib/security/$ISA/pam_unix.so broken_shadow
account???? sufficient??? /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account???? [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so
account???? required????? /lib/security/$ISA/pam_permit.so

password??? requisite???? /lib/security/$ISA/pam_cracklib.so retry=3
password??? sufficient??? /lib/security/$ISA/pam_unix.so nullok use_authtok shadow
password??? sufficient??? /lib/security/$ISA/pam_ldap.so use_authtok
password??? required????? /lib/security/$ISA/pam_deny.so

session???? required????? /lib/security/$ISA/pam_limits.so
session???? required????? /lib/security/$ISA/pam_unix.so
session???? optional????? /lib/security/$ISA/pam_ldap.so

That is all, reboot your LDAP Client? (SSH Server), if there is any boot issue, you may boot into RedHat Linux Rescue Mode , and try to fix the issue, if issue persists, you may restore back the original /etc/pam.d/system-auth, or run "authconfig" to generate the original.

# sync;sync;sync

# init 6

?

---End of Doc ---