Information Server DataStage Information Server DataStage Configuring Information Server DataStage to use PAM authentication This presentation describes how to configure Information Server DataStage® to use Pluggable Authentication Module, referred to as PAM throughout this presentation. Objectives Objectives What is PAM authentication What platforms is PAM supported on Enabling DataStage with PAM PAM configuration file The objectives of this presentation are to describe what PAM authentication is and what the different platforms that DataStage with PAM are supported on. This presentation also explains how to enable DataStage to authenticate using PAM and how to add to or create the required DataStage entries in the PAM configuration file. What is PAM? What is PAM? Pluggable Authentication Module Authenticate against LDAP and Active Directory user registries Must be configured on DataStage engine tier PAM allows DataStage to authenticate against LDAP and Active Directory user registries. PAM must already be configured on the DataStage server before you can configure DataStage to use PAM for authentication. Be sure that your LDAP or Active Directory users can login to the DataStage server using their LDAP credentials. Supported platforms Supported platforms Linux® and UNIX® IBM AIX® HP-UX Sun Solaris Linux Windows® DataStage will authenticate against Active Directory PAM is not required No configuration required Configuring DataStage to authenticate using PAM is supported for all UNIX and Linux platforms. DataStage on Windows will authenticate against Active Directory as well. Windows platforms do not use PAM so no additional configuration is needed. Enabling DataStage with PAM (1 of 2) Enabling DataStage with PAM (1 of 2) Edit the $DSHOME/uvconfig file and set: AUTHENTICATION 1 Example uvconfig entry: # AUTHENTICATION - Specifies the method by which UNIX user # authentication is done. Currently, the following methods # are supported: # # 0) Standard O/S Authentication (default) # 1) Pluggable Authentication Module (PAM) # # This value should only be changed with a full understanding # of the implications, as improper setting of this value can # lead to the environment being unusable. AUTHENTICATION 1 To enable DataStage with PAM, login to the DataStage server as root or as the DataStage Administrator and change your working directory to the DSEngine directory. Edit the uvconfig file and set the Authentication parameter to 1. The authentication parameter’s default is 0. Enabling DataStage with PAM (2 of 2) Enabling DataStage with PAM (2 of 2) Set DataStage environment . ./dsenv Stop DataStage Engine bin/uv –admin –stop Regen uvconfig file bin/uv –admin –regen Start DataStage Engine bin/uv –admin -start You now need to properly set your environment for DataStage by sourcing the dsenv file. From the DSEngine directory, type: . ./dsenv The next step is to stop the DataStage Engine. Be sure you are still in the DSEngine directory and as root or the DataStage administrator user run:bin/uv –admin –stop After the DataStage engine has stopped, you will need to regen the uvconfig file to re-create the .uvconfig file. To do this, from the DSEngine directory run: bin/uv –admin –regen Next, restart the DataStage Engine by running: bin/uv –admin –start Adding to or creating PAM configuration file Check bitness of DataStage: $ file $DSHOME/bin/uvsh /opt/is801/InformationServer/Server/DSEngine/bin/uvsh: ELF 32-bit LSB executable, Intel® 80386, version 1 (SYSV), for GNU/Linux 2.2.5, dynamically linked (uses shared libs), not stripped Check bitness of PAM libraries $ cd /lib/security $ file pam_stack.so pam_stack.so: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), stripped Adding to or creating PAM configuration file Before adding to or creating the PAM configuration file, it is important to determine the bitness of your DataStage installation and the bitness of the PAM libraries. To check the bitness of the DataStage install, run: file $DSHOME/bin/uvsh where $DSHOME is set to your DSEngine directory. In this example, the DataStage Engine is 32 bit. Next, compare this to the bitness of the PAM library that you are using in the configuration file to be sure they are the same. In this example you are in the /lib/security directory and ran: file pam_stack.so You can see that the PAM library is 32 bit as well. The next step is to edit or create the PAM configuration file. Adding to or creating PAM configuration file for Linux Adding to or creating PAM configuration file for Linux Create file named dsepam in /etc/pam.d directory Redhat Linux with 32 bit DataStage #%PAM-1.0 auth required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth account required /lib/security/pam_stack.so service=system-auth Redhat Linux with 64 bit DataStage #%PAM-1.0 auth required /lib64/security/pam_stack.so service=system-auth password required /lib64/security/pam_stack.so service=system-auth account required /lib64/security/pam_stack.so service=system-auth On all Linux systems, you must create a file named dsepam in the /etc/pam.d directory. This slide displays examples of dsepam configuration files for Redhat Linux. Your entries may be different depending on the level of security that you want. Refer to your PAM documentation if you require more information. Put the full path to the PAM library that you are using with your dsepam entries. Some systems have both the 32 and 64 bit libraries installed and you want to make sure that the correct libraries are being referenced. Configuration file examples Configuration file examples SUSE Linux 9 with 32 bit DataStage #%PAM-1.0 auth required /lib/security/pam_unix2.so nullok #set_secrpc password required /lib/security/pam_unix2.so nullok #set_secrpc account required /lib/security/pam_unix2.so nullok #set_secrpc SUSE Linux 10 with 32 bit DataStage #%PAM-1.0 auth required /lib/security/pam_securetty.so password required /lib/security/pam_securetty.so account required /lib/security/pam_securetty.so SUSE Linux 10 with 64 bit DataStage #%PAM-1.0 auth required /lib64/security/pam_securetty.so password required /lib64/security/pam_securetty.so account required /lib64/security/pam_securetty.so This slide displays examples of PAM configuration files for SUSE Linux. Adding to or creating PAM configuration file for AIX Adding to or creating PAM configuration file for AIX Edit the /etc/pam.conf file IBM AIX with 32 bit DataStage dsepam    auth      required      /usr/lib/security/pam_aix dsepam    account      required      /usr/lib/security/pam_aix dsepam    session      required      /usr/lib/security/pam_aix dsepam    password      required      /usr/lib/security/pam_aix IBM AIX with 64 bit DataStage dsepam    auth      required      /usr/lib/security/64/pam_aix dsepam    account      required      /usr/lib/security/64/pam_aix dsepam    session      required      /usr/lib/security/64/pam_aix dsepam    password      required      /usr/lib/security/64/pam_aix For IBM AIX you will need to edit the /etc/pam.conf file as the root user and add the appropriate dsepam entries. This slide displays the correct entries for both 32 and 64 bit DataStage on AIX. Adding to or creating PAM configuration file for Solaris Adding to or creating PAM configuration file for Solaris HPUX and Sun Solaris 32 and 64 bit No dsepam entries required On an HPUX and Solaris system, you do not need to make any changes to PAM. All you need to do is make the required changes to uvconfig as described earlier in this presentation. 64 bit DataStage and Kerberos 64 bit DataStage and Kerberos IBM AIX with 64 bit DataStage and Kerberos Same changes to uvconfig and pam.config as shown in previous slides Edit /usr/lib/security/methods.cfg Under the section KRB5A_64 add a new line: program_64 = /usr/lib/security/KRB5A_64 If you are on an AIX system with 64 bit DataStage and you are using Kerberos for authentication, you will need to make the same changes to the uvconfig and pam.conf file as shown in the previous slides. In addition, you will need to edit the methods.cfg file under /usr/lib/security and add a new line under the section KRB5A_64. The new line will be: program_64 = /usr/lib/security/KRB5A_64 Fix Pack 1 for 8.1 no installed – UNIX and Linux Fix Pack 1 for 8.1 no installed – UNIX and Linux At 8.1 Solaris, HPUX and Linux will require JR31215 JR31215 included in 8.1 FP1 There is an issue for Information Server 8.1 on all UNIX and Linux platforms except AIX where the wrong PAM library is being called. This will cause the DataStage PAM authentication to fail with an 80011 error even if everything is configured correctly. You will need to either install Fix Pack 1 to correct the problem or install the patch for JR31215 if you do not want to install Fix Pack 1. Error 80011 – Username or password or both are incorrect Error 80011 – Username or password or both are incorrect Connection error 80011 IBM Education Assistant http://publib.boulder.ibm.com/infocenter/ieduasst/imv1r0/index.jsp?topic=/com.ibm.iea.datastage/datastage/8.1/ProblemDetermination.html If you receive an 80011 error when attempting to login to the DataStage Client after you have completed the configuration of Information Server DataStage for PAM, see the IBM Education Assistant module called “Connection Error 80011” for troubleshooting techniques. Feedback Feedback Your feedback is valuable You can help improve the quality of IBM Education Assistant content to better meet your needs by providing feedback. Did you find this module useful? Did it help you solve a problem or answer a question? Do you have suggestions for improvements? Click to send email feedback: mailto:iea@us.ibm.com?subject=Feedback_about_Configuring_with_PAM.ppt This module is also available in PDF format at: ../Configuring_with_PAM.pdf You can help improve the quality of IBM Education Assistant content by providing feedback. Trademarks