<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 07/19/2012 11:59 AM, Stephen Gallagher wrote: <blockquote cite="mid:1342713585.2492.147.camel@sgallagh520.sgallagh.bos.redhat.com" type="cite"> <pre wrap="">On Thu, 2012-07-19 at 16:44 +0100, Innes, Duncan wrote: </pre> <blockquote type="cite"> <pre wrap="">Does this mean that it's impossible to have IPA authenticate the oracle user or any other user that is normally below 500? Our security team is asking that we manage the passwords of oracle and other users centrally. Can IPA do this for me? </pre> </blockquote> <pre wrap=""> It's not impossible, but it requires some mangling of your PAM stacks in /etc/pam.d/* </pre> </blockquote> I think Stephen meant to say that it is in fact possible but not recommended and would require changes to PAM configuration to allow logins for centrally managed users with low UIDs. In IPA you can change UID of the user manually if you really know what you are doing but approach below is much more secure, compliant and elegant. <blockquote cite="mid:1342713585.2492.147.camel@sgallagh520.sgallagh.bos.redhat.com" type="cite"> <pre wrap="">That said, it's generally a bad idea to have passwords on users < 500. It should not be possible to log into them at all, and instead you should rely on granting (restricted) sudo privileges to real users allowing them to impersonate the service user instead. So instead of allowing people to log into the box as 'oracle', they should log in as 'myusername' and then run 'sudo -u oracle <command>'. This provides better auditing support as well, since you will always know which real user modified your database configuration (rather than trying to piece together who logged in as 'oracle' directly). </pre> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>