Authentication Configuration

If you are performing a personal desktop, workstation, or server installation, please skip ahead to the “Package Group Selection” section. You may also skip this section if you will not be setting up network passwords. If you do not know whether you should do this, please ask your system administrator for assistance.

Unless you are setting up NIS authentication, you will notice that only MD5 and shadow passwords are selected (see Figure A-27). We recommend you use both to make your machine as secure as possible. To configure the NIS option, you must be connected to an NIS network. If you are not sure whether you are connected to an NIS network, please ask your system administrator.

Figure A-27: Authentication Configuration

• Enable MD5 passwords — allows a long password to be used (up to 256 characters), instead of the standard eight characters or less.

• Enable shadow passwords — provides a secure method for retaining passwords. The passwords are stored in /etc/shadow, which can be read only by root.

• Enable NIS — allows you to run a group of computers in the same Network Information Service domain with a common password and group file. You can choose from the following options:

  • NIS Domain — allows you to specify the domain or group of computers your system belongs to

  • Use broadcast to find NIS server — allows you to broadcast a message to your local area network to find an available NIS server

  • NIS Server — causes your computer to use a specific NIS server, rather than broadcast a message to the local area network asking for any available server to host your system.

    Note

    If you have selected a medium- or high-level firewall during this installation, network authentication methods (NIS and LDAP) will not work.

• Enable LDAP — tells your computer to use LDAP for some or all authentication. LDAP consolidates certain types of information within your organization. For example, all of the different lists of users within your organization can be merged into one LDAP directory. For more information about LDAP, refer to Chapter 17. You can choose from the following options:

  • LDAP Server — allows you to access a specified server (by providing an IP address) running the LDAP protocol

  • LDAP Base DN — allows you to look up user information by its Distinguished Name (DN)

  • Use TLS (Transport Layer Security) lookups —allows LDAP to send encrypted user names and passwords to an LDAP server before authentication

• Enable Kerberos — Kerberos is a secure system for providing network authentication services. For more information about Kerberos, see Chapter 23. There are three options to choose from here:

  • Realm —allows you to access a network that uses Kerberos, composed of one or a few servers (also known as KDCs) and a potentially large number of clients

  • KDC —allows you access to the Key Distribution Center (KDC), a machine that issues Kerberos tickets (sometimes called a Ticket Granting Server or TGS)

  • Admin Server —allows you to access a server running kadmind

• Enable SMB Authentication — sets up PAM to use an SMB server to authenticate users. You must supply two pieces of information here:

  • SMB Server — indicates which SMB server your workstation will connect to for authentication

  • SMB Workgroup — indicates which workgroup the configured SMB servers are in

    Tip

    To change your authentication configuration after you have completed the installation, use the authconfig command. Type the authconfig command at a shell prompt. If you are not root, it will prompt you for the root password to continue.