HP OpenView Operations Administrator's Reference - filibeto.org

About OVO Security
About Security in OVO Operations
500
About PAM Authentication
You can use PAM (pluggable authentication modules) to retrieve and
check user and password information. The user information is saved into
a central repository and is accessed by a PAM module. To use PAM for
authentication, use the command-line tool ovconfchg on the OVO
management server. For more information, refer to the ovconfchg man
page.
Setting up PAM User Authentication
The OVO user model requires users (humans or programs) to log on to
the OVO management server before being able to use any further
functionality. This mainly applies to the graphical user interfaces (Motif
and Java based) but also to some of the OVO management server APIs
and command line tools.
The log-in procedure is necessary for the following checks:
❏ Authenticate the user and verify access permission.
❏ Determine the user's capabilities.
OVO provides the possibility to use PAM alternatively to the built-in
authentication.
Using PAM has the following major advantages:
❏ Use of a common user database shared with the operating system
and other applications. User accounts and passwords have to be set
up and maintained only in one place.
❏ Higher security measures like stronger encryption, password aging,
account expiration etc. are available and can be enforced.
NOTE This only applies to the user authentication itself; the OVO user
accounts must still exist to determine the user's capabilities.
Chapter 12