部署环境: CentOS 5.1 x64 MySQL3.23.58 + GCC
在这里下载pam_mysql的源代码包
下载之后
#>tar zxf pam_mysql-version.tar.gz
#>cd pam_mysql-version
#>./configure --with-mysql=/path/to/mysql --with-openssl=/usr
#>make
#>make install
以下按照实际情况修改斜体字段
在MySQL服务器上执行创建
sysauth数据库
create database if not exists `sysauth`;
USE `sysauth`;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*Table structure for table `logs` */
DROP TABLE IF EXISTS `logs`;
CREATE TABLE `logs` (
`messages` varchar(500) NOT NULL,
`pid` varchar(50) NOT NULL,
`user` varchar(20) NOT NULL,
`host` varchar(50) NOT NULL,
`rhost` varchar(50) NOT NULL,
`time` varchar(50) NOT NULL,
`id` int(11) NOT NULL auto_increment,
UNIQUE KEY `id` (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;
/*Table structure for table `users` */
DROP TABLE IF EXISTS `users`;
CREATE TABLE `users` (
`username` varchar(50) NOT NULL default '',
`password` varchar(50) NOT NULL default '',
`id` int(11) NOT NULL auto_increment,
`state` bit(1) NOT NULL,
`active` tinyint(1) NOT NULL,
`temperory` tinyint(1) NOT NULL,
UNIQUE KEY `id` (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;
/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
在/etc/security/下创建
sshd_pam_mysql.conf
users.host=MySQLDataBaseHost
users.database=sysauth
users.db_user=MySQLDBUser
users.db_passwd=MySQLDBPassword
users.table=users
users.user_column=username
users.password_column=password
users.status_column=state
users.password_crypt=3
users.where_clause=users.active=1
verbose=0
log.enabled=true
log.table=logs
log.message_column=messages
log.pid_column=pid
log.user_column=user
log.host_column=host
log.rhost_column=rhost
log.time_column=time
以上users.password_crypt是选择用户密码加密方式
0 ->明文密码
1 -> MySQL的crypt加密
2 -> MySQL的password加密
3 -> md5加密
4 -> sha1加密(0.61和0.71pre2及以后)
其他参数可以参见pam_mysql的
FAQ和README
在向MySQL数据库的users表添加用户(
示例,
注意)之后, 可以去修改/etc/security/sshd
sshd默认内容为:
#%PAM-1.0
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
应该修改为:
#%PAM-1.0
auth required /lib/security/pam_mysql.so config_file=/etc/security/sshd_pam_mysql.conf
account required /lib/security/pam_mysql.so config_file=/etc/security.sshd_pam_mysql.conf
account required pam_nologin.so
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
最后/etc/init.d/sshd reload, 开启新的
终端进行测试即可
添加用户示例: insert into `users`(`username`,`password`,`state`,`active`,`temperory`) values ('root',md5('123456'),'\0',1,0),('suchasplus',md5('654321'),'\0',1,0);添加用户的注意事项:用户名一定要是系统中真实存在的用户, 即/etc/passwd必须存在用户, useradd
username即可
pam_mysql只是更换验证方式, 并不是
LDAP采用MD5加密验证出错的可能原因:很多版本的Linux都会出现采用0/1/2加密方式可以通过,但是MD5加密后会报错的情况,RH9上经测试不会报错, 但是CentOS 51. x64会报错.
设置verbose = 1
tail -F /var/log/secure可以看到
non-crypt()ish MD5 hash is not supported in this build.
解决方法是
ln -s /usr/include/openssl/md5.h /usr/include/md5.h然后重新编译就好, 虽然编译的时候还是会报死都找不到md5.h -_-#!
