UCS 2.4 - Univention

10.3.5 Testing Univention Firewall settings
10.4 Authentication / PAM
Package filter settings should always be thoroughly tested. The network scanner nmap, which is integrated
in Univention Corporate Server as a standard feature, can be used for testing the status of individual ports:
Since Nmap requires elevated privileges in the network stack, it should be started as root user. A TCP
port can be tested with the following command:
nmap HOSTNAME -p PORT(s)
A UDP port can be tested with the following command:
nmap HOSTNAME -sU -p PORT(s)
Examples:
• nmap 192.168.1.100 -p 400
• nmap 192.168.1.110 -sU -p 400-500
10.4 Authentication / PAM
Authentication services in Univention Corporate Server are realised via Pluggable Authentication Mod-
ules (PAM). To this end different log-in procedures are displayed on a common interface so that a new
log-in method does not require adaptation for existing applications.
In the UCS PAM configuration, different methods can be used for the authentication of user accounts.
unix verifies the hashed password using the /etc/shadow file, ldap performs a bind attempt on the
LDAP server and krb5 verifies the password using a Kerberos key, which is also stored in LDAP. There
are also other methods, e.g., the secure shell (ssh) uses a key pair for verification of whether the user is
really the user he claims to be.
In UCS it is normally sufficient if the identity can be verified using one of these methods. Which
method should be used can be configured using the Univention Configuration Registry variable
auth/admin/methods for the administrator and the Univention Configuration Registry variable
auth/user/methods for all other users. The default setting is krb5 ldap unix, which allows all three
methods.
Alongside this verification, certain services also require a valid user account: This assigns a user his
home directory, his numerical user identification (UID) and his group memberships. This information is
required among other things for logins on GDM, on the text console or via SSH. Samba also requires
this information to store information saved by the user onto the UNIX file system or to verify whether the
access to files and directories is allowed. In addition, the account data also includes additional information
such as the age of the password, whether the account is deactivated or whether the account should only
be valid on certain hosts.
Here too different methods are used via PAM, which can sometimes be expanded and restricted: unix
uses the information from /etc/passwd, /etc/group, /etc/shadow and /etc/nsswitch.conf,
which can be used to mount further information sources. The latter is used to mount all the users
225