AIX and Linux Interoperability - IBM Redbooks

Loadable authentication modules are configured in /usr/lib/security/methods.cfg.
For example, the following stanzas describe one identification and authentication
method:
LDAP:
program = /usr/lib/security/LDAP
KRB5:
program = /usr/lib/security/KRB5
options = authonly
KERBEROS:
options = auth=KRB5,db=LDAP
The KERBEROS method specifies that the user and group information is
available through LDAP and the authentication mechanism is Kerberos. Use the
BUILTIN reserved keyword for the db option to refer to /etc/passwd and the
/etc/security files.
The SYSTEM attribute in /etc/security/user specifies which way the user is
authenticated by referencing stanzas from /usr/lib/security/methods.cfg. This
implies that authentication can be controlled on a per user basis, which is a
rather rare feature. To set the authentication on the host level, you should just
change the SYSTEM attribute of the default stanza. Furthermore, it is possible to
make quite complex authentication configurations using the SYSTEM grammar:
joe:
SYSTEM = ”LDAP or LDAP[unavail] and compat”
This example says that joe should be authenticated using the LDAP
authentication method, but in case the LDAP service is not available, he can
authenticate against the local files just as well. A complete description of the
SYSTEM grammar is in the /etc/security/user file reference.
Another related attribute in /etc/security/user is registry, which specifies where
the user’s information is administered. Thus, a complete stanza for user joe in
/etc/security/user may look like this:
joe:
SYSTEM = KERBEROS
registry = KERBEROS
Note that the user administration chuser, mkuser, and rmuser commands may not
be well suited to some user registries, depending on the site’s security policy.
This is because these commands assume superuser privileges that may not be
appropriate if users are administered on a site level.
Chapter 1. Identification and authentication 3