Identity Management for UNIX: Password Synchronization

Password Synchronization makes it easy for users to maintain one user name and password for Windows domains and UNIX systems, synchronizing the passwords when one of them changes.

Depending on how Password Synchronization and the UNIX servers are configured, synchronization can be one way or two way.

  • Before you begin using Password Synchronization, see Checklists for Password Synchronization.

  • For information about how to implement Password Synchronization most effectively, see Best practices for Password Synchronization.

  • For help with specific tasks, see How To .....

  • For general background information, see Password Synchronization Concepts.

  • For problem-solving instructions, see Troubleshooting Password Synchronization.

  • For information about the Password Synchronization command-line utility, see Command-line utility.


Checklists for Password Synchronization

Checklists

  • Checklist: Setting up Password Synchronization for use with standalone UNIX hosts

  • Checklist: Setting up Password Synchronization for use with an NIS domain (UNIX master server)

  • Checklist: Setting up Password Synchronization for use with an NIS domain (Server for NIS master server)


Checklist: Setting up Password Synchronization for use with standalone UNIX hosts

Checklist: Setting up Password Synchronization for use with standalone UNIX hosts

Configuring Windows systems

Step | Reference
Read about Password Synchronization. | Password Synchronization Concepts
Log on as a member of the Administrators group. |
Install Password Synchronization on the appropriate Windows-based computers. If the passwords of local accounts on a server are to be synchronized, install Password Synchronization on the server. If Windows domain passwords are to be synchronized, install Password Synchronization on all domain controllers. | Install Password Synchronization
Change the encryption key. | Set the default encryption key
Change other settings, as needed. | Configure Password Synchronization
Add UNIX computers with which passwords will be synchronized. If you want to use nondefault values, specify values for the port number, encryption key, or both. | Add and remove computers for synchronization
Ensure that the Password Synchronization configurations on all domain controllers in the domain are identical. |

Configuring UNIX systems

Step | Reference
Install and configure the Password Synchronization single sign-on daemon (SSOD) on all UNIX computers with which passwords will be synchronized. Be sure to change the default encryption key in the sso.conf file to match the Password Synchronization encryption key set in previous steps before copying it to the UNIX computers. | Install the Password Synchronization daemon
Specify which users will and will not be allowed to synchronize passwords. | Controlling password synchronization for user accounts
Start the Password Synchronization daemon. | Start the Password Synchronization daemon
Install and configure the Password Synchronization pluggable authentication module (PAM) on all UNIX computers from which password changes are to be synchronized with Windows passwords. | Configure UNIX Computers for UNIX-to-Windows Synchronization


Checklist: Setting up Password Synchronization for use with an NIS domain (UNIX master server)

Checklist: Setting up Password Synchronization for use with an NIS domain (UNIX master server)

Configuring Windows systems

Step | Reference
Read about Password Synchronization. | Password Synchronization Concepts
Log on as a member of both the Schema Administrators and Enterprise Administrators groups. |
Install Password Synchronization on the appropriate Windows-based computers. If the passwords of local accounts on a server are to be synchronized, install Password Synchronization on the server. If Windows domain passwords are to be synchronized, install Password Synchronization on all domain controllers. | Install Password Synchronization
Change the encryption key. | Set the default encryption key
Change other settings, as needed. Be sure to select the Synchronize password changes from computers that run UNIX to computers that run Windows check box. | Configure Password Synchronization
Add the Network Information Service (NIS) master server to the list of computers with which the Windows-based computer will synchronize passwords. Select the NIS master server in the list, click Configure, select both the Synchronize password changes to and Synchronize password changes from check boxes, and then click OK. | Add and remove computers for synchronization
Add UNIX computers with which passwords will be synchronized. For each computer, select the computer in the list, click Configure, clear the Synchronize password changes to check box, select the Synchronize password changes from check box, and then click OK. If you want to use nondefault values, specify values for the port number, encryption key, or both. | Add and remove computers for synchronization
Specify which users will and will not be allowed to synchronize passwords. | Controlling password synchronization for user accounts
Ensure that the Password Synchronization configurations on all domain controllers in the domain are identical. |

Configuring UNIX systems

Step Reference

Install and configure the Password Synchronization single sign-on daemon (SSOD) on the NIS master server. Be sure to change the default encryption key in the sso.conf file to match the Password Synchronization encryption key set in previous steps before copying it to the server, and edit it to specify the following:

  • USE_NIS=1

  • NIS_UPDATE_PATH= Makefile_path, where Makefile_path is the path and name of the NIS makefile, such as /var/yp/Makefile

Install and configure the Password Synchronization pluggable authentication module (PAM) on all UNIX computers from which password changes are to be synchronized with Windows passwords. Typically, this would be any computer on which users would run yppasswd and any standalone computers (computers that do not belong to the domain).

Configure UNIX Computers for UNIX-to-Windows Synchronization

Copy the sso.conf file from the NIS master server to the /etc directory of each computer on which the Password Synchronization PAM module is installed.

On each NIS client on which you installed the Password Synchronization PAM module, replace the yppasswd binary file with a link to the passwd binary file, and then edit the /etc/nsswitch.conf file to change the passwd and shadow lines, as shown:

passwd:  files [NOTFOUND=continue] nis
shadow:  files [NOTFOUND=continue] nis

Start the Password Synchronization daemon on the NIS master server.

Start the Password Synchronization daemon


Checklist: Setting up Password Synchronization for use with an NIS domain (Server for NIS master server)

Checklist: Setting up Password Synchronization for use with an NIS domain (Server for NIS master server)

Configuring Windows systems

Step | Reference
Read about Password Synchronization. | Password Synchronization Concepts
Log on as a member of both the Schema Administrators and Enterprise Administrators groups. |
Install Password Synchronization on all domain controllers. | Install Password Synchronization
Change the encryption key. | Set the default encryption key
Change other settings, as needed. Be sure to select the Synchronize password changes from computers that run UNIX to computers that run Windows check box. | Configure Password Synchronization
Add UNIX computers with which passwords will be synchronized if they are not members of the Network Information Service (NIS) domain. For each computer, select the computer in the list, click Configure, clear the Synchronize password changes to check box, select the Synchronize password changes from check box, and then click OK. If you want to use nondefault values, you can also specify values for the port number, encryption key, or both. | Add and remove computers for synchronization
Ensure that the Password Synchronization configurations on all domain controllers in the domain are identical. |
Specify which users will and will not be allowed to synchronize passwords. | Controlling password synchronization for user accounts

Configuring UNIX systems

Step Reference

Install and configure the Password Synchronization pluggable authentication module (PAM) on all UNIX computers from which password changes are to be synchronized with Windows passwords. Typically, this would be any computer on which users would run yppasswd and any computers that do not belong to the NIS domain.

Configure UNIX Computers for UNIX-to-Windows Synchronization

Using a binary file-copy method such as File Transfer Protocol (FTP) to avoid corrupting CR/LF (carriage-return/line-feed) pairs, copy Sso.cfg from IDMU\Unix\Bins on the Windows Server 2003 R2 CD to the /etc directory of each computer on which the Password Synchronization PAM module is installed, and change its name to sso.conf. Open the file with a text editor, and then perform the following steps:

  1. Edit the following line to specify the encryption key. This value must match the default key specified on all domain controllers with which this computer will synchronize passwords:

    ENCRYPT_KEY= encryptionKey

  2. If you have changed the default port, edit the following line to specify the new port. This value must match the port number specified on all domain controllers with which this computer will synchronize passwords.

    PORT_NUMBER= portNumber

  3. Edit the following line to specify the computer running Server for NIS. If you have specified a nondefault port number or encryption key for the UNIX computer when configuring Password Synchronization on the Windows domain controller, specify that value where indicated; otherwise, leave the value blank:

    SYNC_HOSTS=( domainController[, portNumber [, encryptionKey]])

On each NIS client on which you installed the Password Synchronization PAM module, replace the yppasswd binary file with a link to the passwd binary file, and then edit the /etc/nsswitch.conf file to change the passwd and shadow lines, as shown:

passwd:  files [NOTFOUND=continue] nis
shadow:  files [NOTFOUND=continue] nis


Best practices for Password Synchronization

Best practices

  • Install Password Synchronization on appropriate domain controllers To ensure consistent synchronization of domain passwords with UNIX passwords, Password Synchronization must be installed on the primary domain controller and, in the case of a Windows 2000 domain, all domain controllers in a domain.

    • If you add a domain controller to a domain, you should install Password Synchronization on the new domain controller as soon as possible and configure it to match the other domain controllers.

    • If you need to remove Password Synchronization from any domain controller, you should demote the server to a member server before uninstalling Password Synchronization.

  • Ensure consistent password policies If you are providing only for one-way password synchronization, make sure that the password policy on the computer from which passwords will be synchronized is at least as restrictive in all areas as the policy on the computer to which passwords will by synchronized. For example, if you configure Windows-to-UNIX synchronization, the Windows password policy must be at least as restrictive as the policy of the UNIX computers with which it will synchronize passwords. If you are supporting two-way synchronization, the password policies must be equally restrictive on both systems. Failure to ensure that password policies are consistent can result in synchronization failure when a user changes a password on the less restrictive system, or the password might be changed on the more restrictive system even though it does not conform to the system's policies.

    Also make sure that Windows users are aware of any special password restrictions on the UNIX systems with which their passwords will be synchronized. For example, some versions of UNIX support a maximum password length of eight characters. For maximum compatibility with the default Windows password policy and these UNIX limitations, passwords should be seven or eight characters long unless you are sure that all UNIX systems can support longer passwords.

  • Configure Password Synchronization to provide the maximum protection for your users' passwords

    Follow these recommendations to maintain optimal security:

    • Explicitly list the users whose passwords are to be synchronized To provide maximum control over which users can synchronize passwords, do not use the ALL keyword with the SYNC_USERS list in sso.conf on the UNIX host. Instead, you should explicitly list each user for whom password synchronization is allowed or blocked. On the Windows-based computer running Password Synchronization, create the PasswordPropAllow group and add the accounts of users whose passwords you want to synchronize. For more information, see Controlling password synchronization for user accounts.

    • Do not synchronize passwords for disabled UNIX accounts On some versions of UNIX, changing the password of a disabled user account activates that account. Consequently, if a user has a disabled account on a UNIX computer that is configured to synchronize passwords with a Windows-based computer, the user or an administrator can activate the UNIX account by changing the user's Windows password. To prevent this, use the PasswordPropDeny group to block synchronization for disabled UNIX accounts.

      Also, when an administrator disables a UNIX account, the administrator should use the SYNC_USERS entry in sso.conf to block password synchronization for the account.

    • Avoid synchronizing administrator passwords Do not synchronize passwords for members of the Windows Administrators groups or the passwords of UNIX superuser or root accounts.

    • Perform the Windows Server 2003 Service Pack 1 (SP1) compatibility check when selecting Enable Windows to NIS (AD) Password Sync in the Password Synchronization Properties dialog box, Configuration tab. To protect the security of user account passwords in your enterprise, it is strongly recommended that you allow Password Synchronization to identify all domain controllers in the forest that are not running Windows Server 2003 SP1 or later releases.

      Password Synchronization prompts you to allow the compatibility check when you select the Enable Windows to NIS (AD) Password Sync option. With Windows Server 2003 SP1, or a later release installed on all the domain controllers in a forest, the risk of exposing user password hashes to unauthorized viewers is greatly reduced. When Windows Server 2003 SP1 is not the minimum functional level of all the domain controllers in a forest, it is possible for any authenticated user on the domain to view the password hash for any UNIX user whose account has been migrated to Active Directory.

      In the event an unauthorized user breaks the password hash for a UNIX-based user account in Active Directory, the Windows-based password for the account is no longer secure.

    Also, when an administrator disables a UNIX account, the administrator should use the SYNC_USERS entry in sso.conf to block password synchronization for the account.

    Password Synchronization prompts you to allow the compatibility check when you select the Enable Windows to NIS (AD) Password Sync option. With Windows Server 2003 SP1, or a later release installed on all the domain controllers in a forest, the risk of exposing user password hashes to unauthorized viewers is greatly reduced. When Windows Server 2003 SP1 is not the minimum functional level of all the domain controllers in a forest, it is possible for any authenticated user on the domain to view the password hash for any UNIX user whose account has been migrated to Active Directory.

    In the event an unauthorized user breaks the password hash for a UNIX-based user account in Active Directory, the Windows-based password for the account is no longer secure.

When Password Synchronization is installed, members of the local Administrators group and the Domain Admins group are added to the PasswordPropDeny group, which prevents their passwords from being synchronized. If you add a user to either the Administrators or Domain Admins group, be sure to add the user to the PasswordPropDeny group as well.

Use the SYNC_USERS statement in the sso.conf file on all UNIX systems to prevent the passwords of superusers from being synchronized.

  • Do not use the default port number and encryption key If you use the default port number and encryption key, you make it possible for an attacker to set up an impostor UNIX host to capture passwords. You should protect the port number and encryption keys used to synchronize passwords as carefully as the passwords themselves.

  • Secure the sso.conf file The sso.conf file on each UNIX host contains important configuration information that could be used to compromise security. It is recommended that you set the mode bit mask of the file to 600.

  • Ensure that the directory identified by TEMP_FILE_PATH is properly protected The temporary files created on UNIX hosts by Password Synchronization contain information that could be used by an attacker to compromise system security. For this reason, you should ensure that any directory referenced by TEMP_FILE_PATH in sso.conf has read access only for the root account and cannot be accessed by any other users.

  • Ensure log files are appropriately protected On the UNIX host, Password Synchronization uses the syslogd daemon to log messages that result from synchronization operations. The resulting logs contain such information as the names of users whose passwords are being synchronized and with which computers, propagation errors, and so on. These log files should be protected to ensure that only administrators can read them.

  • Restart the Password Synchronization daemon after changing its configuration When you make changes to the Password Synchronization daemon configuration file (sso.conf), you must stop and restart the daemon to make sure that the configuration changes take effect.

  • Configure systems to handle user name case sensitivity correctly Unless you rigorously enforce a policy to ensure that Windows and UNIX user names match in both spelling and case, make sure that the CASE_IGNORE_NAME option in the sso.conf file is set to 1 (the default). UNIX user names are case sensitive; therefore, passwords might not synchronize properly if the user names do not match exactly because the Password Synchronization daemon is unable to associate the Windows user name with the corresponding UNIX user name.

  • Make sure that password file type and name are consistent When you configure the Password Synchronization daemon, make sure that the password file type (specified by USE_SHADOW) and path name (set by FILE_PATH) are appropriate for each other. For example, on most systems, if USE_SHADOW is set to 0 (to indicate that the passwd file is used for synchronization), then the FILE_PATH option should be set to /etc/passwd. However, if USE_SHADOW is set to 1 (to indicate that the shadow file is used instead), then the FILE_PATH option should be set to /etc/shadow. (On AIX systems, the path and name of the shadow file is /etc/security/passwd.)


This content might have been updated. For the most recent version, see the Windows Server 2003 R2 TechCenter Web site

How To ....

  • Use UNIX Components

  • Use Windows Components


Use UNIX Components

Use UNIX Components

  • Install the Password Synchronization daemon

  • Start the Password Synchronization daemon

  • Stop the Password Synchronization daemon

  • Configure UNIX Computers for UNIX-to-Windows Synchronization


Install the Password Synchronization daemon

To install the Password Synchronization daemon

  1. Copy the appropriate source binary file from IDMU\Unix\Bins on the Windows Server 2003 R2 CD to /usr/bin or /usr/local/bin on the UNIX computer, and change its name to ssod. The name of the source binary file depends on the version of UNIX you are using.

    • If the computer is running Hewlett-Packard HP-UX, the source binary file name is ssod.hpx.

    • If the computer is running Red Hat Linux, the source binary file name is ssod.rhl.

    • If the computer is running Sun Microsystems Solaris, the source binary file name is ssod.sol.

    • If the computer is running IBM AIX, the source binary file name is ssod.aix.

  2. Using a binary file-copy method such as File Transfer Protocol (FTP) to avoid corrupting CR/LF (carriage-return/line-feed) pairs, copy Sso.cfg from \Unix\Bins on the Windows Server 2003 R2 CD to /etc on the UNIX computer, and change its name to sso.conf.

  3. Open sso.conf with a text editor.

  4. If you have changed the default encryption key, edit the following line to specify the new default key. This value must match the default key specified on all domain controllers with which this computer will synchronize passwords:

    ENCRYPT_KEY= encryptionKey

  5. If you have changed the default port, edit the following line to specify the new port. This value must match the port number specified on all domain controllers with which this computer will synchronize passwords.

    PORT_NUMBER= portNumber

  6. Edit the following line to specify one domain controller in each Windows domain with which the computer is to synchronize passwords. If you have specified a nondefault port number or encryption key for the UNIX computer when configuring Password Synchronization on the Windows domain controllers, specify that value where indicated; otherwise, leave the value blank:

    SYNC_HOSTS=( domainController[, portNumber [, encryptionKey]]) ...

    Each entry in the list must be enclosed by parentheses (the "(" and ")" characters) and separated from the next entry by a blank space.

  7. If the computer is a Network Information Service (NIS) master server, and if you want passwords to be synchronized throughout the NIS domain, edit the following line as shown to enable NIS synchronization:

    USE_NIS=1

    Also, if required, edit the following line to specify the location of the NIS makefile:

    NIS_UPDATE_PATH= makefilePath

  8. Set the file permissions of sso.conf to read/write for the root user only, and deny access to all other users.

  9. If the computer is running Linux, copy /etc/pam.d/system-auth to /etc/pam.d/ssod.

Important

The sso.conf file contains encryption keys and other sensitive information. For this reason, it must be accessible only by system administrators.

Notes
  • This daemon program must be installed on the computer running UNIX to enable Password Synchronization to change users' passwords on that computer.
  • Password Synchronization supports synchronization with UNIX computers running any of the following operating systems:
  • Hewlett-Packard HP-UX version 11i

  • IBM AIX version 5L 5.2

  • Red Hat Linux versions 8 and 9

  • Sun Solaris version 8 running on x86-based computers and Scalable Processor Architecture (SPARC)–based computers, and Solaris version 9 running on SPARC–based computers

See Also

  • Understanding Password Synchronization
  • Using sso.conf to configure Password Synchronization on the UNIX computer
  • Start the Password Synchronization daemon
  • Install the pluggable authentication module (PAM) on AIX
  • Install the pluggable authentication module (PAM) on HP-UX
  • Install the pluggable authentication module (PAM) on Linux
  • Install the pluggable authentication module (PAM) on Solaris


Start the Password Synchronization daemon

  • Run the single sign-on daemon (SSOD).

Notes
  • There is no other method for this procedure.
  • The sso.conf file must be in the /etc/ directory.
  • If you see no errors, the daemon is running. If anything goes wrong during the initialization of the daemon, an error message is displayed on the console. Some errors might also be logged to the Syslog file.
  • If you want your service to start automatically, add the single sign-on daemon (SSOD) to your system startup files (typically Rc.local). This will start SSOD as root.

See Also

  • Install the Password Synchronization daemon
  • Understanding Password Synchronization


Stop the Password Synchronization daemon

  • Send the process a TERM signal as follows:

    kill –term pid

    where pid is the process identifier of the Password Synchronization single sign-on daemon (SSOD).

See Also

  • Understanding Password Synchronization


Configure UNIX Computers for UNIX-to-Windows Synchronization

Configure UNIX computers for UNIX-to-Windows synchronization

  • Install the pluggable authentication module (PAM) on AIX

  • Install the pluggable authentication module (PAM) on HP-UX

  • Install the pluggable authentication module (PAM) on Linux

  • Install the pluggable authentication module (PAM) on Solaris


Install the pluggable authentication module (PAM) on AIX

To install the pluggable authentication module (PAM) on AIX

  1. Copy pam_sso.aix from IDMU\Unix\Bins on the Windows Server 2003 R2 CD to /usr/lib/ on the UNIX computer, and change its name to pam_sso.aix.1.

  2. On the UNIX computer, log on as root, and then enter the following commands:

    chown root /usr/lib/pam_sso.aix.1 chmod 555 /usr/lib/pam_sso.aix.1

  3. If necessary, create the /etc/pam.conf file according to your network requirements, setting the owner to root and the base permissions to 644. For more information about creating the pam.conf file, see "Pluggable Authentication Modules" in System Management Guides: Security Guide in your AIX documentation.

    Sample pam.conf file

    #
# Authentication management
#
OTHER   auth     required       /usr/lib/security/pam_aix

#
# Account management
#
OTHER   account  required       /usr/lib/security/pam_aix

#
# Session management
#
OTHER   session  required       /usr/lib/security/pam_aix
  4. Open /etc/pam.conf with a text editor.

  5. In the Password management section, add the following line:

    passwd password required /usr/lib/security/pam_sso.aix.1

    Sample pam.conf file with this line added

    #
# Authentication management
#
OTHER   auth     required       /usr/lib/security/pam_aix

#
# Account management
#
OTHER   account  required       /usr/lib/security/pam_aix

#
# Session management
#
OTHER   session  required       /usr/lib/security/pam_aix

#
# Password management
#
passwd   password required       /usr/lib/security/pam_sso.aix.1
  6. Open /usr/lib/security/methods.cfg with a text editor and add the following lines at the end of the file:

    PAM: program = /usr/lib/security/PAM

    PAMfiles: options = auth=PAM,db=BUILTIN

  7. Open /etc/security/user with a text editor and add authentication information for the specific users whose passwords you want to synchronize. For example:

    user1: admin = false SYSTEM = PAMfiles[*] AND "compat" registry = PAMfiles

Notes
  • You can choose to change the default section of /etc/security/user to allow all users to synchronize their passwords. In this case, to restrict access to Password Synchronization, you can use the SYNC_USERS attribute in the /etc/sso.conf file to restrict access. For more information, see Using sso.conf to configure Password Synchronization on the UNIX computer.
  • To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.conf that you added in step 5.

See Also

  • Understanding Password Synchronization
  • Implementing Password Synchronization


Install the pluggable authentication module (PAM) on HP-UX

To install the pluggable authentication module (PAM) on HP-UX

  1. Copy pam_sso.hpx from IDMU\Unix\Bins on the Windows Server 2003 R2 CD to /usr/lib/security on the UNIX computer, change its name to pam_sso.hp.1, and then set its file-mode bits to 544.

  2. On the UNIX computer, open /etc/pam.conf with a text editor.

  3. In the Password management section, locate the following line:

    other password required /usr/lib/security/libpam_unix.1

  4. Immediately following the line located in the previous step, add the following line:

    other password required /usr/lib/security/pam_sso.hp.1

Notes
  • To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.conf that you added in step 4.
  • Before installing the pam_sso module, make sure that PAM support is properly installed and configured on the UNIX computer. The following file samples show a typical configuration. Actual contents of these files may differ, depending on your system configuration.
  • Sample HP-UX PAM configuration file
#
# PAM configuration
#
# Authentication management
#
login    auth required  /usr/lib/security/libpam_unix.1
su       auth required  /usr/lib/security/libpam_unix.1
dtlogin  auth required  /usr/lib/security/libpam_unix.1
dtaction auth required  /usr/lib/security/libpam_unix.1
ftp      auth required  /usr/lib/security/libpam_unix.1
OTHER    auth required  /usr/lib/security/libpam_unix.1
#
# Account management
#
login    account required       /usr/lib/security/libpam_unix.1
su       account required       /usr/lib/security/libpam_unix.1
dtlogin  account required       /usr/lib/security/libpam_unix.1
dtaction account required       /usr/lib/security/libpam_unix.1
ftp      account required       /usr/lib/security/libpam_unix.1
#
OTHER    account required       /usr/lib/security/libpam_unix.1
#
# Session management
#
login    session required       /usr/lib/security/libpam_unix.1
dtlogin  session required       /usr/lib/security/libpam_unix.1
dtaction session required       /usr/lib/security/libpam_unix.1
OTHER    session required       /usr/lib/security/libpam_unix.1
#
# Password management
#
login    password required      /usr/lib/security/libpam_unix.1
dtlogin  password required      /usr/lib/security/libpam_unix.1
dtaction password required      /usr/lib/security/libpam_unix.1
other    password required      /usr/lib/security/libpam_unix.1
other    password required      /usr/lib/security/pam_sso.hp.1

See Also

  • Understanding Password Synchronization
  • Implementing Password Synchronization


Install the pluggable authentication module (PAM) on Linux

To install the pluggable authentication module (PAM) on Linux

  1. Copy pam_sso.rhl from IDMU\Unix\Bins on the Windows Server 2003 R2 CD to /lib/security on the UNIX computer, and change its name to pam_sso.so.1.

  2. On the UNIX computer, copy /etc/pam.d/system-auth to /etc/pam.d/ssod.

  3. Open /etc/pam.d/system-auth with a text editor, and locate the following line:

    passwordrequired/lib/security/pam_cracklib.soretry=3

  4. After the line in the previous step, add the following line:

    password required /lib/security/pam_sso.so.1

  5. Locate and delete the following line:

    passwordrequired/lib/security/pam_deny.so

  6. Save the modified file.

Notes
  • These instructions apply to the typical Linux configuration. If you have configured PAM support differently, you might have to adjust these instructions to your specific configuration.
  • To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.d/system-auth that you added in step 4.
  • Before installing the pam_sso module, make sure that PAM support is properly installed and configured on the UNIX computer. The following file samples show a typical configuration. Actual contents of these files may differ, depending on your system configuration.
  • Sample Linux PAM configuration file:
/etc/pam.d/passwd

#%PAM-1.0
auth       required     /lib/security/pam_stack.so service=system-auth
account    required     /lib/security/pam_stack.so service=system-auth
password   required     /lib/security/pam_stack.so service=system-auth

/etc/pam.d/ssod

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth nullok
auth        required      /lib/security/pam_deny.so

account     required      /lib/security/pam_unix.so

password    required      /lib/security/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/pam_unix.so nullok use_authtok shadow
password    required      /lib/security/pam_deny.so

session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so

/etc/pam.d/system-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth nullok
auth        required      /lib/security/pam_deny.so

account     required      /lib/security/pam_unix.so

password    required      /lib/security/pam_cracklib.so retry=3 type=
password    required      /lib/security/pam_sso.so.1
password    sufficient    /lib/security/pam_unix.so nullok use_authtok shadow
password    required      /lib/security/pam_deny.so

session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so

See Also

  • Understanding Password Synchronization
  • Implementing Password Synchronization


Install the pluggable authentication module (PAM) on Solaris

To install the pluggable authentication module (PAM) on Solaris

  1. Copy pam_sso.sol from the IDMU\Unix\Bins folder on the Windows Server 2003 R2 CD to the /usr/lib/security directory on the UNIX computer, and change its name to pam_sso.so.1.

  2. On the UNIX computer, open /etc/pam.conf with a text editor.

  3. In the Password management section, locate the following line:

    other password required /usr/lib/security/$ISA/pam_unix.so.1

  4. Immediately following the line located in the previous step, add the following line:

    other password required /usr/lib/security/$ISA/pam_sso.so.1

Notes
  • To disable UNIX-to-Windows password synchronization, remove the entry in /etc/pam.conf that you added in step 4.
  • Before installing the pam_sso module, make sure that PAM support is properly installed and configured on the UNIX computer. The following file samples show a typical configuration. Actual contents of these files may differ, depending on your system configuration.
  • Sample Solaris PAM configuration file
#
#ident  "@(#)pam.conf   1.14    99/09/16 SMI"
#
# Copyright (c) 1996-1999, Sun Microsystems, Inc.
# All Rights Reserved.
#
# PAM configuration
#
# Authentication management
#
login   auth required   /usr/lib/security/$ISA/pam_unix.so.1
login   auth required   /usr/lib/security/$ISA/pam_dial_auth.so.1
#
rlogin  auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
rlogin  auth required   /usr/lib/security/$ISA/pam_unix.so.1
#
dtlogin auth required   /usr/lib/security/$ISA/pam_unix.so.1
#
rsh     auth required   /usr/lib/security/$ISA/pam_rhosts_auth.so.1
other   auth required   /usr/lib/security/$ISA/pam_unix.so.1
#
# Account management
#
login   account requisite       /usr/lib/security/$ISA/pam_roles.so.1
login   account required        /usr/lib/security/$ISA/pam_unix.so.1
#
dtlogin account requisite       /usr/lib/security/$ISA/pam_roles.so.1
dtlogin account required        /usr/lib/security/$ISA/pam_unix.so.1
#
other   account requisite       /usr/lib/security/$ISA/pam_roles.so.1
other   account required        /usr/lib/security/$ISA/pam_unix.so.1
#
# Session management
#
other   session required        /usr/lib/security/$ISA/pam_unix.so.1
#
# Password management
#

other   password required       /usr/lib/security/$ISA/pam_unix.so.1
other  password required        /usr/lib/security/$ISA/pam_sso.so.1
dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1

#
# Support for Kerberos V5 authentication (uncomment to use Kerberos)
#
#rlogin auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#login  auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin        auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#other  auth optional   /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
#dtlogin        account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other  account optional /usr/lib/security/$ISA/pam_krb5.so.1
#other  session optional /usr/lib/security/$ISA/pam_krb5.so.1
#other  password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass

See Also

  • Understanding Password Synchronization
  • Implementing Password Synchronization


Use Windows Components

Use Windows components

  • Install Password Synchronization

  • Configure Password Synchronization


Install Password Synchronization

To install Password Synchronization

  1. Click Start, click Control Panel, and then click Add or Remove Programs.

  2. Click Add/Remove Windows Components.

  3. When the Windows Components Wizard opens, fill the Active Directory Services check box.

  4. With Active Directory Services highlighted, click Details.

  5. When the Active Directory Services dialog box opens, fill the Identity Management for UNIX check box.

  6. With Identity Management for UNIX highlighted, click Details.

  7. When the Identity Management for UNIX dialog box opens, fill the Password Synchronization check box.

  8. Click OK.

    The Windows Components Wizard begins installing the Identity Management for UNIX components you selected.

  9. If you are prompted to locate files required for Password Synchronization installation, insert the Windows Server 2003 R2 product CD, or browse to the network location of your Windows Server 2003 R2 installation files.

Notes
  • To open Add or Remove Programs, click Start, point to Control Panel, and then click Add or Remove Programs.
  • Password Synchronization cannot be run from a network server. All files must be installed on the local computer.
  • You must be logged on to the computer as a member of both the Schema Administrators and Enterprise Administrators groups to install Password Synchronization. The Password Synchronization installation process verifies that users have both Schema Administrator and Enterprise Administrator access permissions before installation can progress.

See Also

  • Install the Password Synchronization daemon


Configure Password Synchronization

Configure Password Synchronization

  • Set default synchronization

  • Set the default encryption key

  • Set the default port

  • Add and remove computers for synchronization

  • Set computer-specific synchronization properties

  • Set auditing options


Set default synchronization

To set default synchronization

  1. Open Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Click Password Synchronization, and then click the Default tab.

  4. To allow password synchronization from UNIX-based computers to Windows-based computers, click Synchronize password changes from computers that run UNIX to computers that run Windows.

  5. To allow password synchronization from Windows-based computers to UNIX-based computers, click Synchronize password changes from computers that run Windows to computers that run UNIX.

  6. To save the new settings, click Apply.

Notes
  • To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.
  • To perform this task in the command line environment, see psadmin.
  • These settings affect the default synchronization for UNIX hosts when they are added for synchronization. It does not affect computers that have already been added for synchronization.

See Also

  • Add and remove computers for synchronization
  • Password Synchronization administration
  • Connect to a computer you want to manage


Set the default encryption key

To set the default encryption key

  1. Open Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Click Password Synchronization, and then click the Default tab.

  4. In the Encryption key text box, type the key you want to use, or, to have the program produce a key for you, click New Key.

  5. To save the new settings, click Apply.

Notes
  • To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.
  • To perform this task in the command line environment, see psadmin.
  • This setting affects the default encryption key for UNIX hosts when they are added for synchronization as well as the port used for UNIX-to-Windows synchronization. If you change this setting, you must edit the /etc/sso.conf file to specify the same encryption key on UNIX hosts that are configured for UNIX-to-Windows password synchronization with this computer.
  • For maximum security, you should use a key that is the maximum 21 characters in length.

See Also

  • Encryption key requirements
  • Add and remove computers for synchronization
  • Password encryption
  • Password Synchronization administration
  • Using sso.conf to configure Password Synchronization on the UNIX computer


Set the default port

To set the default port

  1. Open Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Click Password Synchronization, and then click the Default tab.

  4. To use a port other than 6677, in the Port number box, type the port number you want.

  5. To save the new settings, click Apply.

Notes
  • To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.
  • This setting affects the default port number for UNIX hosts when they are added for synchronization as well as the port used for UNIX-to-Windows synchronization. If you change this setting, you must edit the /etc/sso.conf file to specify the same port on UNIX hosts that are configured for UNIX-to-Windows password synchronization with this computer.
  • For maximum security, use a port number other than the default (6677).
  • To perform this task in the command line environment, see psadmin.

See Also

  • Add and remove computers for synchronization
  • Password Synchronization administration
  • Using sso.conf to configure Password Synchronization on the UNIX computer
  • Connect to a computer you want to manage


Add and remove computers for synchronization

To add and remove computers for synchronization

  1. Open Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Click Password Synchronization.

  4. Click the Advanced tab, and then do one of the following:

    • To add a computer to the list of participating computers, in Computer name, type the name of the UNIX-based computer you want to add, and then click Add.

    • To remove a computer, in the Current computers list, click the UNIX-based computer you want to remove, and then click Remove.

  5. To save the new settings, click Apply.

Notes
  • To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.
  • To perform this task in the command line environment, see psadmin.
  • In addition to adding a UNIX-based computer to the list, if you want to change the user's password on the UNIX computer when the corresponding Windows user's password is changed, you must install the Password Synchronization single sign-on daemon (SSOD) on the UNIX-based computer . If you want to change the Windows user's password when the corresponding UNIX-based computer user's password is changed, you must install the pluggable authentication module (PAM) on the UNIX-based computer.

See Also

  • Set computer-specific synchronization properties
  • Install the Password Synchronization daemon
  • Configure UNIX Computers for UNIX-to-Windows Synchronization
  • Password Synchronization administration
  • Connect to a computer you want to manage


Set computer-specific synchronization properties

To set computer-specific synchronization properties

  1. Open Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Click Password Synchronization, and then click the Advanced tab.

  4. In the Current computers list, click the one for which you want to set properties, and then click Configure.

  5. Set the properties you want to apply to the selected computer.

  6. To save the new settings, click Apply.

Notes
  • To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.
  • To perform this task in the command line environment, see psadmin.
  • Before setting computer-specific synchronization properties in Password Synchronization, edit the sso.conf file on the UNIX-based computer to specify the same settings. For information about assigning computer-specific settings in the sso.conf file, see Install the Password Synchronization daemon.

See Also

  • Set default synchronization
  • Set the default encryption key
  • Set the default port
  • Password Synchronization administration
  • Connect to a computer you want to manage


Set auditing options

To set auditing options

  1. Open Identity Management for UNIX.

  2. If necessary, connect to the computer you want to manage.

  3. Click Password Synchronization, and then click the Default tab.

  4. To have information events as well as warnings and errors logged to Event Viewer, click Enable extensive logging.

  5. To save the new settings, click Apply.

Notes
  • To open Identity Management for UNIX, click Start, point to All Programs, point to Identity Management for UNIX, and then click Identity Management for UNIX.
  • To perform this task in the command line environment, see psadmin.
  • When the log file reaches the limit you set, logging stops and a note is entered in Event Viewer.

See Also

  • Password Synchronization administration
  • Connect to a computer you want to manage


Password Synchronization Concepts

This section provides background information about:

  • Understanding Password Synchronization

  • Administering Password Synchronization


Understanding Password Synchronization

Understanding Password Synchronization

Password Synchronization helps integrate Windows and UNIX networks by simplifying the process of maintaining secure passwords in both environments. Users are freed of the difficulty of maintaining separate passwords for their Windows and UNIX accounts or having to remember to change the password wherever it is used. With Password Synchronization, whenever a user's password is changed on a Windows-based computer or domain, the password can also be automatically changed on every UNIX host for which the user has an account. Password Synchronization can also be configured to change the user's Windows password when the user's UNIX password is changed.

This makes it possible to administer passwords from a single computer, which simplifies things for administrators as well as individual users. Password Synchronization is also flexible: administrators can exclude specific users and systems from being synchronized. Password Synchronization can synchronize passwords on stand-alone Windows-based computers (such as computers running Windows 2000 Server that do not belong to a domain) or for an entire Windows domain. Similarly, Password Synchronization can be used to manage passwords on individual UNIX hosts or on all computers in a Network Information Service (NIS) domain.

Password Synchronization propagates passwords securely by transmitting only encrypted passwords over TCP/IP sockets. This eliminates the need to use nonsecure methods (such as scripts) to administer passwords remotely. Passwords are also synchronized immediately. This means that, unlike methods such as rdist, which batches the password propagation, there is no appreciable delay between the time that a password is changed on one system and when it is changed on all other affected systems. This eliminates confusion and frustration for active users. Even more important, perhaps, it eliminates a potential security risk if a password needs to be changed to block a user's access to the network. To enhance network security even further, different encryption keys can be used for each Windows-based computer/UNIX host pair.

Password Synchronization is a combination of three software components:

  • The Password Synchronization service running on one or more Windows-based computers

  • The Password Synchronization daemon running on one or more UNIX computers

  • The Password Synchronization pluggable authentication module (PAM) installed on one or more UNIX computers.

When Password Synchronization is configured for Windows-to-UNIX synchronization and a password is changed on a Windows-based computer running Password Synchronization, the Password Synchronization service determines whether the user's password is to be synchronized on UNIX computers. If it is, the service encrypts the password and sends it to the Password Synchronization daemon on each computer with which the Windows-based computer is configured to be synchronized. The daemon then decrypts the password and changes the password on the UNIX host. If the UNIX host is an NIS master server and it is configured to do so, the daemon also runs make to propagate the password change throughout the NIS domain.

When Password Synchronization is configured for UNIX-to-WINDOWS synchronization, passwords that are changed on UNIX hosts are synchronized on Windows-based computers and domains. The Password Synchronization PAM module makes this possible by intercepting the password change request on the UNIX host, encrypting the password, and then sending the password change request to the Password Synchronization service running on the Windows-based computers with which it is configured to be synchronized.

For information about implementing Password Synchronization, see Implementing Password Synchronization.


Administering Password Synchronization

Administering Password Synchronization

This section contains information about:

  • Implementing Password Synchronization

  • Synchronizing passwords with an NIS domain

  • Password Synchronization administration

  • Password encryption

  • Encryption key requirements

  • Controlling password synchronization for user accounts

  • Using sso.conf to configure Password Synchronization on the UNIX computer


Implementing Password Synchronization

Implementing Password Synchronization

Password Synchronization changes a user's UNIX password whenever the user's password is changed on a Windows-based computer or domain. In addition, Password Synchronization and the affected UNIX hosts can be configured to change the user's Windows password whenever the UNIX password is changed.

Two-way password synchronization is supported on UNIX computers running any of the following operating systems:

  • Hewlett-Packard HP-UX version 11i, 32-bit environment

  • IBM AIX version 5L 5.2, 32-bit environment

  • Red Hat Linux versions 8 and 9, 32-bit environment

  • Sun Solaris version 8 running on x86-based computers and Scalable Processor Architecture (SPARC)–based computers, and Solaris version 9 running on SPARC–based computers. The 32-bit environment has been tested on SPARC-based computers.

For more information about how Password Synchronization works on Windows and UNIX computers, see Understanding Password Synchronization.

The remainder of this topic provides information about how to implement password synchronization on Windows and UNIX computers.

Installing Password Synchronization in Windows
You can use Password Synchronization to synchronize passwords between a Windows domain and one or more UNIX hosts, or you can use it to synchronize passwords between a stand-alone computer running Windows and one or more UNIX hosts. To synchronize local account passwords on a Windows-based computer, install Password Synchronization on that computer only. To synchronize Windows domain passwords, you must install Password Synchronization on all domain controllers for that domain. This will ensure that when a domain controller processes a password change request, the Password Synchronization service on that domain controller will be able to synchronize the new password with the appropriate UNIX hosts. For this reason, before you remove Password Synchronization from a domain controller, you should demote the domain controller to a member server to prevent password discrepancies between the Windows domain and the UNIX hosts. For information about installing Password Synchronization on Windows-based computers, see Install Password Synchronization.
Installing the Password Synchronization daemon on UNIX hosts
To allow synchronization of Windows passwords with UNIX hosts, you must install the Password Synchronization daemon on each UNIX host on which passwords are to be synchronized. For information about installing the daemon, see Install the Password Synchronization daemon. When Password Synchronization receives a request for a password change, it encrypts the password and sends it to all UNIX hosts that are to be synchronized with the Windows-based computer or domain. To process the password change request, the UNIX host must be running the Password Synchronization daemon. This daemon receives the request and changes the password on the UNIX host. In addition, if the UNIX host is a master Network Information Service (NIS) server, the Password Synchronization daemon runs make to rebuild the NIS passwd map so it can be replicated to subordinate (slave) servers in the NIS domain. The Password Synchronization daemon performs event logging through the syslogd daemon running on the UNIX host.
Installing the pluggable authentication module on UNIX hosts
Pluggable authentication modules (PAMs) allow a UNIX computer to support multiple authentication technologies. Password Synchronization uses this facility to provide UNIX-to-Windows password synchronization. To allow passwords on Windows-based computers or domains to be changed when users change their UNIX password, the Password Synchronization PAM module (pam_sso) must be installed on each UNIX host where users can change their passwords. Much like Password Synchronization running on a Windows-based computer, the Password Synchronization PAM module on a UNIX computer intercepts the password change request, encrypts the password, and then transmits the request to the appropriate Windows-based computers running Password Synchronization. Like the Password Synchronization daemon, the Password Synchronization PAM module performs event logging through the syslogd daemon running on the UNIX host. For information about configuring UNIX computers for UNIX-to-Windows synchronization, see Configure UNIX Computers for UNIX-to-Windows Synchronization.
Synchronizing passwords between Windows and NIS domains
In addition to synchronizing passwords between Windows-based computers and standalone UNIX hosts, you can also use Password Synchronization to provide one-way (Windows-to-UNIX) synchronization as well as two-way synchronization. For more information, see Synchronizing passwords with an NIS domain. For security reasons, it is recommended that you perform the Windows Server 2003 Service Pack 1 (SP1) compatibility check when selecting Enable Windows to NIS (AD) Password Sync in the Password Synchronization Properties dialog box, Configuration tab. For more information about the compatibility check, see Best practices for Password Synchronization.
Coordinating account names and password policies
The password policies on both systems must be similar. If the policy on one system is stronger (more restrictive) than the policy on the other system, Password Synchronization might fail to synchronize passwords, and the failure might not be reported. In addition, Password Synchronization can only synchronize the passwords of accounts with identical user names. Windows and UNIX administrators must ensure that the user names for the Windows and UNIX accounts of a given user match exactly (including case). If you are configuring Password Synchronization for one-way (Windows-to-UNIX) synchronization, you should consider disabling the ability of users to change passwords on the UNIX hosts that are to be synchronized with the Windows-based computers. Otherwise, if users change their UNIX passwords, their passwords will no longer be synchronized.


Synchronizing passwords with an NIS domain

Synchronizing passwords with an NIS domain

Using Password Synchronization, you can provide one-way (Windows-to-UNIX) and two-way password synchronization between Windows domains and Network Information Service (NIS) domains. You can do this regardless of whether the master server of the NIS domain is running on UNIX or on Windows (Server for NIS).

If the NIS master server is running UNIX, all that is required to provide one-way synchronization is to install Password Synchronization on all Windows-based computers (for example, on the domain controllers) from which you want to synchronize passwords, and then install the single sign-on daemon (SSOD) on the NIS master server. You then edit the sso.conf file on the NIS master server to do the following:

  • Set USE_NIS to 1

  • Set NIS_UPDATE_PATH to specify the location of the NIS makefile

This instructs the SSOD to run the makefile and push the changed maps whenever a password change request is received from the Windows domain. For more information and additional instructions, see Install the Password Synchronization daemon.

If Server for NIS is acting as the master server for the NIS domain, no action is required to provide one-way password synchronization because whenever a Windows user's password is changed, Server for NIS automatically updates the UNIX password for NIS clients. If you also need to synchronize passwords with UNIX computers that are not part of the NIS domain, you can install Password Synchronization on the Windows domain controllers and configure the UNIX computers as described earlier in this topic.

Providing UNIX-to-Windows synchronization is similar for both types of NIS domains, and is accomplished by performing the following operations:

  • If the NIS master server is running UNIX, set it up for one-way synchronization as described earlier in this topic.

  • Install Password Synchronization on all domain controllers. If the NIS master server is a UNIX computer, configure Password Synchronization on Windows for two-way synchronization with the master server. Finally, add each NIS client to the list of computers that Password Synchronization will synchronize with, being sure to enable UNIX-to-Windows synchronization and disabling Windows-to-UNIX synchronization. Windows-to-UNIX synchronization should be enabled only for the NIS master server. For more information about adding and configuring computers, see Add and remove computers for synchronization and Set computer-specific synchronization properties.

  • Install the Password Synchronization pluggable authentication module (PAM) on each NIS client, and then copy the sso.conf file from the master server to the /etc directory of those clients.

  • If the NIS master server is a Windows-based computer running Server for NIS, copy Sso.cfg to one of the NIS clients, set SYNC_HOSTS to specify the computer running Server for NIS as the Windows-based computer to synchronize passwords with, and then copy that file to the other UNIX clients. See Using sso.conf to configure Password Synchronization on the UNIX computer to learn more about settings in this file.

  • Configure each UNIX computer to allow users to use the yppasswd command to change their passwords. To do this, replace the yppasswd binary file on the UNIX computer with a link to the passwd binary file, and then edit the /etc/nsswitch.conf file to replace the passwd and shadow lines with the following:

    passwd:  files [NOTFOUND=continue] nis
shadow:  files [NOTFOUND=continue] nis
    After you do this, when a user runs the yppasswd command to change the user's password, it is actually the passwd binary file that is run to change the password. If the user's passwd entry is not found in the local passwd and shadow files, the NIS password is changed instead.


Password Synchronization administration

Password Synchronization administration

When you have installed Password Synchronization on the appropriate Windows–based computer, you can administer it with Password Synchronization administration (part of Identity Management for UNIX). You must have administrator privileges on the computer you want to administer.

You can use Password Synchronization administration to:

  • Select the server to be administered.

  • Set the default settings that apply to the entire configuration of UNIX-based computers defined for the Windows–based computer or domain. The settings determine what the Event Log displays, the maximum number of times to resend the failed password update, and the time the service waits before resending a password update that has failed.

  • Add or remove a UNIX-based computer from the list of computers designated to receive password updates.

  • Create or modify the configuration for the UNIX-based computer, including the custom settings (the default settings applied to that single computer) and the encryption settings for secure communication. The order in which the names of the UNIX hosts appear in the list determines their order in the registry and the order in which they are processed for password synchronization.


Password encryption

Password encryption

A Windows-based computer can send and receive updated passwords to and from a UNIX-based computer as encrypted text only. The Password Synchronization single sign-on daemon (SSOD) receives the encrypted password and decrypts it before requesting the password change on the UNIX host. Similarly, if Password Synchronization is configured to support UNIX-to-Windows synchronization, the pluggable authentication module (PAM) encrypts the password before sending it to Password Synchronization on the Windows-based computer, which then decrypts the password before requesting the password change on the Windows-based computer.

The password can be successfully decrypted only if Password Synchronization and the SSOD or PAM module use the same encryption key to encrypt and decrypt the password. Before installing the SSOD on any UNIX computer, you must first set the default encryption key. You must then specify the same key in the sso.conf file when you install the SSOD on each UNIX host. This will ensure that Password Synchronization and the SSOD on the UNIX hosts will use the same encryption key. For more information about setting the default encryption key, see Set the default encryption key. For information about installing and configuring the SSOD, see Install the Password Synchronization daemon.

For added security, you can specify an encryption key that is used only between a particular Windows-based computer and a UNIX host. For information about configuring Password Synchronization to use a computer-specific encryption key, see Set computer-specific synchronization properties. For information about setting the computer-specific encryption key on the UNIX computer, see Install the Password Synchronization daemon.


Encryption key requirements

Encryption key requirements

The encryption key must meet the following requirements:

  • It must be 16 to 21 characters long (21 is recommended).

  • It must contain characters from at least three of the following four groups:

    • Uppercase English letters (A–Z)

    • Lowercase English letters (a–z)

    • Westernized Arabic numerals (0–9)

    • Punctuation symbols ` ~ ! @ # $ % ^ & * _ – + = | \ { } [ ] : ; \ " ' < > . ?

  • It must not contain a left or right parentheses (that is a "(" or ")" character), a comma (,), or a blank space ( ).


Controlling password synchronization for user accounts

Controlling password synchronization for user accounts

You can control which users' passwords are synchronized by creating two local user groups: PasswordPropAllow and PasswordPropDeny. (Use the Windows User Manager to create these groups.)

In the PasswordPropAllow group, add the user names for which passwords should be synchronized. In the PasswordPropDeny group, add the user names for which passwords should not be synchronized.

Passwords are synchronized for users who are in PasswordPropAllow and are not in PasswordPropDeny.

If PasswordPropAllow does not exist, the effect is the same as if it did exist with all user names in it. If PasswordPropDeny does not exist, the effect is the same as if it did exist with no user names in it.

These rules apply to synchronization from Windows to UNIX and from UNIX to Windows. If a user's password cannot be synchronized from Windows to UNIX, it cannot be synchronized from UNIX to Windows.

The UNIX administrator can ensure that the passwords for certain users are never synchronized, even if synchronization is allowed by the Password Synchronization server. To ensure that a UNIX user account will never have its password synchronized with the Windows password, edit the sso.conf file to place the user name of the account, preceded by a minus sign (–), after SYNC_USERS=. For example, to ensure that the password of the root account is never synchronized with a Windows account by that name, make sure that the following line appears in sso.conf:

SYNC_USERS=–root


Using sso.conf to configure Password Synchronization on the UNIX computer

Using sso.conf to configure Password Synchronization on the UNIX computer

To change settings and customize how Password Synchronization works on a UNIX-based computer, you change settings in the sso.conf file. For information about installing the sso.conf file, see Install the Password Synchronization daemon.

The following table describes the values you can set in the sso.conf file.

Value Description

CASE_IGNORE_NAME

Specifies whether Password Synchronization will ignore differences in uppercase and lowercase letters in user names when it compares Windows and UNIX user names. To allow case-insensitive comparisons, set this entry to 1 (the default). To force Password Synchronization to use case-sensitive comparisons, set this entry to 0.

ENCRYPT_KEY

Specifies the default key used to encrypt passwords exchanged with Windows servers. You can use settings in the SYNC_HOSTS value to specify a different encryption key for a specific Windows server. For information about valid encryption keys, see Encryption key requirements.

FILE_PATH

Specifies the full path and name of the passwd or shadow file (such as /etc/passwd). This file must contain the encrypted passwords for users, and the type of file (passwd or shadow) must be the same as specified by USE_SHADOW. On AIX systems, the path and name of the shadow file is /etc/security/passwd.

IGNORE_PROPAGATION_ERRORS

When set to 1, specifies that the Password Synchronization PAM module is to ignore any error that occurs when a Windows password is being changed and to continue synchronization with other hosts specified in SYNC_HOSTS.

NIS_UPDATE_PATH

Specifies the full path to the NIS makefile. This value is ignored unless USE_NIS is set to 1.

PORT_NUMBER

Specifies the default number of the port on which the Password Synchronization daemon will listen for password changes from Windows servers. You can use settings in the SYNC_HOSTS value to specify a different port number for a specific Windows server.

SYNC_DELAY

Specifies the number of seconds the Password Synchronization PAM module will wait between synchronization attempts.

SYNC_HOSTS

Specifies the Windows servers or domain controllers with which passwords are to be synchronized. In addition, you can specify a port number or encryption key (or both) for a specific server. Enclose each entry in parentheses and separate items with a blank space. You can have multiple entries on separate lines, each of which cannot exceed 269 characters. The total list of servers or domain controllers is generated by concatenating all entries. For example:

SYNC_HOSTS=(Marketing)
SYNC_HOSTS=(Sales,ASDFhjkl4321ZyXw) (Accounting,6678)
SYNC_HOSTS=(Shipping,6678,ASDFhjkl4321ZyXw)

synchronizes passwords with the Marketing server using the default port and encryption key, with the Sales server using ASDFhjkl4321ZyXw as the encryption key, with the Accounting server using 6678 as the port number, and with the Shipping server using 6678 as the port number and ASDFhjkl4321ZyXw as the encryption key.

If you use server-specific port number or encryption key settings, you must use the same values to configure Password Synchronization on the Windows server, or the passwords will not be synchronized. For information about configuring Password Synchronization on the Windows server, see Configure Password Synchronization.

SYNC_RETRIES

Specifies the number of times that the Password Synchronization PAM module will attempt to synchronize a password change with a Windows server or domain controller.

SYNC_USERS

Specifies UNIX users whose passwords are to be synchronized. You can specify ALL to synchronize passwords for all users or NONE to disable password synchronization for users. You can also specify particular users. If you specify one or more users preceded by plus signs (+), only those users will have their passwords synchronized. If you specify one or more users preceded by minus signs (–), all users except the specified users will have their passwords synchronized. For example, to allow only users bobg and kimr to synchronize their passwords, specify:

SYNC_USERS=+bobg +kimr

To prevent only root and bobg from having their passwords synchronized, specify:

SYNC_USERS=–root –bobg

The minus sign always takes precedence, regardless of the order in which entries appear. For example, the following specifies that the password for user chrisa will not be synchronized:

SYNC_USERS=+chrisa –chrisa +chrisa

TEMP_FILE_PATH

Specifies the full path of the directory to be used to hold a temporary file while the passwd or shadow file is updated. This should be the same directory in which the passwd or shadow file is located. For security reasons, only the administrator should have access to this directory.

USE_NIS

Set to 0 if Password Synchronization is not synchronizing with an Network Information Service (NIS) domain; set to 1 if Password Synchronization is synchronizing with an NIS domain. If USE_NIS is set to 1, specify a valid path for NIS_UPDATE_PATH.

USE_SHADOW

Set to 0 if the passwd file is to be used for synchronization; set to 1 if the shadow file is to be used.


Troubleshooting Password Synchronization

Troubleshooting

What trouble are you having?

  • User cannot log on to UNIX system after changing Windows password

  • Passwords fail to synchronize in a Windows domain, seemingly at random

  • User's password is changed on some, but not all, computers

  • Error ID 4104 is recorded in the event log for a system account, which usually has a name ending with a dollar sign ($)

  • I cannot stop the single sign-on daemon (SSOD) using kill -TERM on Linux

User cannot log on to UNIX system after changing Windows password

Cause: Windows does not report a problem if an attempt to synchronize a UNIX password with a new Windows password fails.

Solution: Check the Windows event log to determine why the attempt to change the password on the UNIX system failed.

Passwords fail to synchronize in a Windows domain, seemingly at random

Cause: Password Synchronization is not configured identically on all domain controllers in the domain. As a result, if a nonconforming domain controller accepts a user's password change, it might not be able to change the password on UNIX computers.

Solution: Ensure that Password Synchronization is configured identically on all domain controllers, particularly host settings and default settings for encryption keys and ports.

User's password is changed on some, but not all, computers

Cause: Password policies are more restrictive on some computers, user names do not match between Windows and UNIX computers, or the user changed the password on a UNIX computer when two-way synchronization is not set up.

Solution: Ensure that password policies on Windows and UNIX computers that synchronize passwords are similar. Otherwise, if the user changes the password on the less restrictive computer, the more restrictive system might not accept the new password. Password policies that govern minimum and maximum length, character case and alphanumeric mix, expiration, and reuse must be as close as possible between Windows and UNIX computers that synchronize passwords. Also, Windows and UNIX system administrators must ensure that that user names, including case, are identical on the Windows and UNIX computers.

Error ID 4104 is recorded in the event log for a system account, which usually has a name ending with a dollar sign ($)

Cause: This error does not indicate a problem. It is logged when a backup domain controller or domain member server resets its secure channel with the domain. When this happens, the server password is also reset. Password Synchronization intercepts these password change requests; because they are for computer accounts rather than for user or group accounts, Password Synchronization logs error number 4104.

Solution: No corrective measures are necessary.

I cannot stop the single sign-on daemon (SSOD) using kill -TERM on Linux

Cause: This is a known limitation.

Solution: Use kill 9 SSOD_PID instead.


Command-line utility

Command-line Utility

The following command-line utility is available to administer Password Synchronization:

psadmin


psadmin

psadmin

NAME

psadmin - Windows command-line utility to manage Password Synchronization

SYNOPSIS

psadmin [computername] [common_option] [add | delete | list]
psadmin [computername] [common_option] config [config_option]

DESCRIPTION

The psadmin Windows command-line utility manages the Password Synchronization component of Identity Management for UNIX, either on a specified computer, or globally. The specific action that psadmin performs depends on the command argument you specify.

In addition to specific command arguments, psadmin accepts the following common options and arguments, represented by common_option in the command synopsis:

Term | Definition
-u username | The account name of the user whose password synchronization behavior you want to modify or view.
-p password | The password for the user account whose password synchronization behavior you want to modify or view.
-? | Displays usage information for the command.

The following configuration options are accepted by psadmin:

Term Definition

-comp name

Computer to which configuration options are applied. If -comp is unspecified, Password Synchronization modifies the default configuration settings. If -comp is the only option specified, then Password Synchronization configuration of the specified computer is displayed.

-enable direction

Specifies the direction of password synchronization. The variable direction can contain one of the following values:

WintoUnix: Synchronize password changes from computers that run Windows operating systems to computers that run UNIX operating systems.

UnixToWin: Synchronize password changes from computers that run UNIX operating systems to computers that run Windows operating systems.

BothDir: Enable two-way password synchronization.

-key keyvalue

Sets the encryption and decryption key for the computer specified by -comp. If keyvalue is random, Password Synchronization uses a random encryption key.

-port number

Sets the port number for the specified computer.

-retry number

Specifies the number of retries allowed. Because this option is a global setting, it can be used only when -comp is not used.

-interval secs

Specifies the elapsed time period, in seconds, between retries. Because this option is a global setting, it can be used only when -comp is not used.

-log [yes | no]

Enables or disables logging. Because this option is a global setting, it can be used only when -comp is not used.

-?

Displays psadmin usage and arguments.

The following command arguments are accepted by psadmin:

Term | Definition
add computername | Adds the specified computer to the list of computers participating in password synchronization.
delete computername | Deletes the specified computer from the list of computers participating in password synchronization.
list | Displays the list of computers participating in Password Synchronization.

See Also

  • Configure Password Synchronization