Hello,

OS: OpenSuSE 11.0

I'm looking at PAM for the first time and it's clear that I could really screw something up badly if I make a bad change so I am hoping for some guidance here (to save a lot of heartache).

I want to authenticate users in a MySQL database as well as the normal SSH authentication. The DB contains users that will run SFTP.

Unless I got it wrong this will mean adding to the configuration file /etc/pam.d/ssh and below is the file unchanged. Below that are the changes I imagine are needed.

Could someone please let me know if this is on the right track before I change anything? - my understanding is that I could lock myself out of shelling into the system if I do this wrong.

Unchanged:

Code:
#%PAM-1.0                                                                                                          
auth     requisite      pam_nologin.so
auth     include        common-auth
account  include        common-account
password include        common-password
session  required       pam_loginuid.so
session  include        common-session
What I would like to do with these changes is allow SSH to do its normal authentication through PAM and if it doesn't find a match then try authenticating through PAM to the MySQL DB.

Code:
#%PAM-1.0
auth     requisite      pam_nologin.so
auth     include        common-auth
auth     required       pam_mysql.so (options added here)

account  include        common-account
account  required       pam_mysql.so (options added here)

password include        common-password
password required       pam_mysql.so (options added here)

session  required       pam_loginuid.so
session  include        common-session
session  required       pam_mysql.so (options added here)
The files included have "required" on their lines. I'm not sure if this is okay or if I need to make adjustments so that I the logic of:
"If the first type of authentication fails the try the second and if the second type fails then return fail."

Or perhaps better that I do the MySQL authentication first as optional and leave the included files alone which I guess would be like this:

Code:
#%PAM-1.0
auth     sufficient     pam_mysql.so (options added here)
auth     requisite      pam_nologin.so
auth     include        common-auth

account  sufficient     pam_mysql.so (options added here)
account  include        common-account

password sufficient     pam_mysql.so (options added here)
password include        common-password

session  sufficient     pam_mysql.so (options added here)
session  required       pam_loginuid.so
session  include        common-session
But I was hoping not to hit the MySQL DB first which is why I was favoring the first way... although now thinking about it this second way seems more practical since I probably won't have to change include files which I imagine are called from multiple places.

Please, any help towards enlightenment would be very much appreciated.

Cheers!
Reggie.