Return
-
Title
How to define exclusion in the defender pam_radius_acl.conf file ? -
Description
How to define exclusion in the defender pam_radius_acl.conf file ? We want to configure so that all users requires 2FA except for root account. -
Cause
Enhancement Request. -
Resolution
The following is an example pam_radius_acl.conf file:upm:*telnet::john*:sallylogin:davidIn this example, all users accessing the service upm or telnet must authenticate via Defender. Users john and sally must authenticate via Defender for every service. User david must authenticate via Defender for the login service only. Any servicename:username combination not listed in the file does not require users to authenticate via Defender.
At this time, it is not possible to define an exclusion for an account in the conf file. The option available is to manually specify all the username that requires 2FA in the conf file.
Enhancement Request 772013 for PAM Defender has been submitted to Development for consideration in a future release of Defender. -
Change Request
772013 -
Additional Information
Also Enhancement Request # 794511 was submitted to add the option to support AD groups in the acl file for example: <servicename>:<AD Gorup>