This interaction includes services such as counting active users and validating available user licenses as well as, on HP-UX and Linux, coordinating the TASKID values of active programs. An optional HTTP interface is available to query server status information with a web browser.

In addition, the eloqsd may be used to start background programs, using various clients such as Eloquence JDLG, Eloquence WebDLG, the Eloquence IDE or the eqstart utility.

Also, the Eloquence IDE may use the eloqsd file sharing functionality which may help to overcome network file system limitations such as wide-area network incapability.

Starting with Eloquence B.08.20, the eloqsd server provides a new server-side application configuration, improves access control for applications and shares, allows to store user passwords in encrypted form and adds PAM authentication on HP-UX and Linux.

• User configuration
  • GroupList config item
  • eloqsd.user file

• Application configuration
  • Defining environment variables
  • Passing client environment variables
  • StartDir config item
  • TTY config item (HP-UX and Linux)
  • Token resolving
  • UserList config item
  • GroupList config item
  • Restricting access by IP address
  • Specifying the executable
  • Backward compatibility
  • eloqsd.app file

• Share configuration
  • UserList config item
  • GroupList config item
  • Restricting access by IP address
  • eloqsd.share file

• Store user passwords in encrypted form
  • The eqpasswd utility
  • PassKey config item

• PAM authentication on HP-UX and Linux
  • Globally enabling PAM authentication
  • User-specific PAM authentication
  • PAM configuration on Linux
  • PAM configuration on HP-UX

The PassKey item is explained below in the section titled "Store user passwords in encrypted form".

The UsePAM item (HP-UX and Linux) is explained below in the section titled "PAM authentication on HP-UX and Linux".

GroupList config item

These group names, or categories, may then be used in the Application and Share configuration files to restrict access to specific users.

GroupList accepts a comma-separated list of group names. Multiple GroupList entries are recognized and combined.

The example below defines a user named "joe" in the eloqsd.user file that belongs to the groups "users", "admins" and "local_users":

[joe]
GroupList = users, admins
GroupList = local_users
...

eloqsd.user file

HP-UX, Linux:

/etc/opt/eloquence/8.2/eloqsd.user
template file: /opt/eloquence/8.2/newconfig/config/eloqsd.user

Windows:

C:\Program Files\Eloquence\8.2\etc\eloqsd.user
template file: C:\Program Files\Eloquence\8.2\etc\eloqsd.user.sam
(the location of the Eloquence base directory may be installation dependent)

Below is the default eloqsd.user file content, as found in the template file:

# eloqsd.user
# @(#) $Revision: 27.5 $
#
# The purpose of this file is to define all users which are known to
# Eloquence.
#
# HP-UX and Linux: /etc/opt/eloquence/8.2/eloqsd.user
# Windows: C:\Program Files\Eloquence\8.2\etc\eloqsd.user
#
# This file is read at the startup time of the eloqsd process.
# Changes are automatically detected and honored.
#
# This makes it possible to define Eloquence users without the
# need to have a system account for each individual user.
#
# Note on HP-UX and Linux:
# If clear text passwords are configured in this file we consider
# it good practice to make this file unreadable for regular users.
# You should chown it to the administrator (usually root) and
# chmod it to 400.
#
# Format:
#
# The section names are not case sensitive. String values can be
# enclosed in double quotes to protect leading or trailing spaces.
# Everything after a hash (#) character is considered a comment.
#
# Each user definition is a different section.
#
# The following configuration items are recognized for each section:
#
# [user_id]
#
# Name       The full user name (currently unused)
#
# Password   The user password (clear text)
#
# PassKey    Refers to a password key defined in the eloqsd.pswd file.
#            This is an alternative to using the Password item above.
#            The eloqsd.pswd file stores passwords in encrypted form
#            and is maintained by the eqpasswd utility.
#
# UID        System account to execute client processes
#
# GID        System group to execute client processes
#
# GroupList  Comma-separated list of group names to specify the user
#            group membership. Defined group names may be used in the
#            GroupList item of the eloqsd.app and eloqsd.share files.
#            Multiple GroupList entries are recognized and combined.
#
# UsePAM     If nonzero, PAM (Pluggable Authentication Modules) is
#            used to verify the password (Password/PassKey items
#            are not used). Also, PAM is used to set UID/GID/GroupList
#            unless UID/GID/GroupList are explicitly configured.
#
# Profile    Template user entry. User defaults will be taken from
#            this section.
#
# There are two predefined sections:
#
# [public] is used if a client does not provide a user id. This can
# only happen if an eloqcore process has been started locally and
# requests a remote operation. (currently unused)
#
# [default] is used as the default user profile.

[public]
Name = Anonymous

[default]
Name = Default user profile

#[demo]
#Name = Demo User
#Password = secret

Previously, a client, for example Eloquence JDLG, was required to specify the command line as well as the necessary environment variables to start an application on the server. This behavior is still supported if the [default] section is configured in the eloqsd.app file (see below).

Beyond that, the new eloqsd application configuration allows for a server-side definition of applications a specific user or client is permitted to start, including the command line and environment variables and specifying which environment variables are allowed to pass from the client.

A JDLG application configuration like below was typically used to start a program through the specified eloqsd server. The example below configures the "ADMIN,APP" program, using the eloqcore -log and -t command line options and defining the HOME and EQPATH environment variables:

[ADMIN_TRACE]
name        = ADMIN program with trace file
server      = 192.168.1.11
protocol    = rdlg
command     = -log /tmp/eq-trace.log -t ADMIN,APP
environment = HOME=/home/$login
environment = EQPATH=/data/app/admin/prog:/data/app/common/prog

Please note that in the example above the eloqcore -log command line option as well as the HOME and EQPATH environment variable definitions refer to directories located on the server. Consequently, these definitions should take place on the server side, not on the client.

To configure this application on the server side, the following section could be added to the eloqsd.app configuration file:

[ADMIN,APP]
Env = HOME=/home/$user_name
Env = EQPATH=/data/app/admin/prog:/data/app/common/prog
EnvPass =
#Command = -log /tmp/eq-trace.log -t
Command = ADMIN,APP

Please note:

• The [ADMIN,APP] section name is matched against the last component of the command line passed from the client, which is typically the Eloquence program name. The section name is not case sensitive.

• The Env items define the environment variables (see below). The $user_name token is replaced with the name of the connecting user when the application is started.

• An empty EnvPass item is configured so that all environment variables the client might pass are dropped.

• The Command items define the command line. If configured, the client command line is no longer used. In this example, the -log and -t options are put into a separate Command item which may then be enabled as needed.

Having this [ADMIN,APP] section configured in the eloqsd.app file, the corresponding JDLG application configuration could be reduced to:

[ADMIN]
name     = ADMIN program
server   = 192.168.1.11
protocol = rdlg
command  = ADMIN,APP

Here, the client configuration is reduced to the necessary options to address the eloqsd server and to specify the program name, while the server-side details, including whether or not to create a trace file, are configured on the server.

Defining environment variables

The example below defines the HOME and EQPATH environment variables for an application named "ADMIN,APP" in the eloqsd.app file. The HOME variable uses the $user_name token:

[ADMIN,APP]
Env = HOME=/home/$user_name
Env = EQPATH=/data/app/admin/prog:/data/app/common/prog
...

Passing client environment variables

If EnvPass is configured, any variable a client passes must be listed, otherwise it is not passed to the application. If EnvPass is configured but empty, all variables a client might pass are dropped.

EnvPass accepts a comma-separated list of environment variable names. Multiple EnvPass entries are recognized and combined.

Please note: Variables passed from the client take precedence over variables having the same name that are specified with the Env item. This allows to configure a fallback for variables a client might or might not pass.

For example, if a JDLG client is configured to use a nonstandard DLG port, it might be required to pass the $host:$port connection argument to the program if the RDLG protocol cannot be used. In this case, the JDLG application configuration typically specifies a command line using the -dlg $host:$port option.

However, the eloqsd.app Command item overrides the client command line, so that specifying the -dlg $host:$port command line option on the client would have no effect. Instead, the $host:$port connection argument should be assigned to an environment variable on the JDLG client, as shown in the JDLG application configuration example below:

[ADMIN]
name        = ADMIN program
server      = 192.168.1.11
command     = ADMIN,APP
environment = DLG=$host:$port

The corresponding eloqsd.app configuration would then allow the DLG variable to be passed from the client, so that it can be used in the command line, for example:

[ADMIN,APP]
Env = DLG=$peer_addr
EnvPass = DLG
Command = -dlg $(DLG) ADMIN,APP
...

In the example above, the eloqsd.app configuration includes a fallback definition for the DLG variable in case it is not passed by the client, where it would be set to the address of the PC running the JDLG client ($peer_addr), assuming the standard DLG port.

StartDir config item

Please note: If the Command item is configured, the start directory a client may have passed is never used, because it is assumed that if an application defines a server-side command line it would be inappropriate to accept a client-side start directory.

TTY config item (HP-UX and Linux)

Token resolving

$peer_addr

client IP address

$peer_name

client host name

$user_name

user name

$(VARIABLENAME)

value of an environment variable, including any variable passed from the client (depending on the EnvPass configuration) or specified with the Env item.

The example below defines an application named "ADMIN,APP" in the eloqsd.app file that uses the $(DLG) token in the command line and the $peer_addr and $user_name tokens in the specified environment variables:

[ADMIN,APP]
Env = DLG=$peer_addr
Env = HOME=/home/$user_name
Command = -dlg $(DLG) ADMIN,APP
...

UserList config item

If UserList is configured, the connecting user must be listed, otherwise the user is not allowed to start an application. The user names refer to the configured users in the eloqsd.user file or, if PAM authentication is used on HP-UX or Linux, to (selected) operating system users.

UserList accepts a comma-separated list of user names. Multiple UserList entries are recognized and combined.

The example below defines an application named "ADMIN,APP" in the eloqsd.app file that restricts access to the users "bob", "joe" and "teresa":

[ADMIN,APP]
UserList = bob
UserList = joe, teresa
...

GroupList config item

If GroupList is configured, the connecting user must be a member of a group that is listed, otherwise the user is not allowed to start an application. The group names refer to GroupList entries of the configured users in the eloqsd.user file or, if PAM authentication is used on HP-UX or Linux, to operating system groups associated with the connecting user.

GroupList accepts a comma-separated list of group names. Multiple GroupList entries are recognized and combined.

The example below defines an application named "ADMIN,APP" in the eloqsd.app file that restricts access to those users that belong to the groups "admins", "operators", "local_admins", or "local_operators":

[ADMIN,APP]
GroupList = admins, operators
GroupList = local_admins,local_operators
...

Restricting access by IP address

Multiple AllowFrom and/or DenyFrom entries are recognized, using the syntax below:

AllowFrom = {All | ip-address [/ {netmask | addrbits}]}
DenyFrom  = {All | ip-address [/ {netmask | addrbits}]}

ip-address

IP v4 address, such as 127.0.0.1

netmask

IP v4 network mask, such as 255.255.255.0

addrbits

number of significant leading IP v4 address bits

If neither netmask nor addrbits is specified, an entry defaults to a host address.

If neither AllowFrom nor DenyFrom are configured, access to an application is enabled from all IP addresses (implied AllowFrom=All).

If AllowFrom and/or DenyFrom are configured, access to an application is denied unless specifically allowed (implied DenyFrom=All).

The example below defines an application named "ADMIN,APP" in the eloqsd.app file that restricts access to the local system (127.0.0.1) as well as to the local network (192.168.1.1 to 192.168.1.254) except the 192.168.1.22 and 192.168.1.44 addresses:

[ADMIN,APP]
AllowFrom = 127.0.0.1
AllowFrom = 192.168.1.0/255.255.255.0
DenyFrom  = 192.168.1.22
DenyFrom  = 192.168.1.44
...

Using the addrbits notation, the AllowFrom rules in the example above could also be specified like:

AllowFrom = 127.0.0.0/8
AllowFrom = 192.168.1.0/24

(The 255.255.255.0 netmask is equivalent to the leading 24 bits in an IP v4 address. Also, the local system might use any address ranging from 127.0.0.1 to 127.255.255.254, hence the 127.0.0.0/8 entry.)

Specifying the executable

The Execute item, if configured, allows to specify a different executable. This could be used, for example, to start the Eloquence dbutil program or to invoke a shell script that wraps the eloqcore executable.

The eloqsd.app configuration below could be used to start the Eloquence dbutil program from a JDLG client located on the local system (127.0.0.1 to 127.255.255.254) or in the local network (192.168.1.1 to 192.168.1.254):

[dbutil]
Execute = /opt/eloquence/8.2/bin/dbutil
Env = DLG=$peer_addr
EnvPass = DLG
Command = -D $(DLG)
AllowFrom = 127.0.0.0/8
AllowFrom = 192.168.1.0/24

The corresponding JDLG application configuration could be like:

[dbutil]
name = Eloquence dbutil
server = 192.168.1.11
command = dbutil
environment = DLG=$host:$port

Note that the DLG environment variable is allowed to pass from the client. The JDLG client configuration above sets it to $host:$port. If the client does not pass the DLG variable, the server sets it to the address of the system running the JDLG client ($peer_addr), assuming the standard DLG port. The DLG variable is then used with the dbutil -D command line option.

Backward compatibility

The eloqsd.app configuration template file defines an empty [default] section to provide full backward compatibility for existing applications:

[default]
#UserList =
#GroupList =
#AllowFrom =
#DenyFrom =

Because no Command or EnvPass items are defined, the client command line and environment variables are passed to the application.

As shown above, the [default] section contains UserList, GroupList, AllowFrom and DenyFrom items which are commented out but may be enabled as needed to restrict backward compatibility to specific users or groups or client IP addresses.

For security reasons, it is recommended to add a specific configuration for each application and then to remove or comment out the [default] section.

eloqsd.app file

HP-UX, Linux:

/etc/opt/eloquence/8.2/eloqsd.app
template file: /opt/eloquence/8.2/newconfig/config/eloqsd.app

Windows:

C:\Program Files\Eloquence\8.2\etc\eloqsd.app
template file: C:\Program Files\Eloquence\8.2\etc\eloqsd.app.sam
(the location of the Eloquence base directory may be installation dependent)

Below is the default eloqsd.app file content, as found in the template file:

# eloqsd.app
# @(#) $Revision: 27.4 $
#
# The purpose of this file is to configure the applications
# a client is permitted to start through the eloqsd server.
#
# HP-UX and Linux: /etc/opt/eloquence/8.2/eloqsd.app
# Windows: C:\Program Files\Eloquence\8.2\etc\eloqsd.app
#
# This file is read at the startup time of the eloqsd process.
# Changes are automatically detected and honored.
#
# Format:
#
# The section names are not case sensitive. String values can be
# enclosed in double quotes to protect leading or trailing spaces.
# Everything after a hash (#) character is considered a comment.
#
# Each application definition is a different section.
#
# The app_id matches the last component of the command line that
# a client submits. Typically, this is an Eloquence program name.
#
# The following configuration items are recognized for each section:
#
# [app_id]
#
# Command   Specifies the command line to start the application.
#           If configured, it replaces the command line that a
#           client submits.
#
#           Command line arguments are separated with spaces. If an
#           argument contains space characters it should be enclosed
#           in single or double quotes.
#
#           Token resolving:
#
#           $peer_addr - client IP address
#           $peer_name - client host name
#           $user_name - user name
#
#           $(VARIABLENAME) - value of an environment variable,
#           including any variable passed from the client (depending
#           on the EnvPass configuration, see below) or specified
#           with the Env configuration (see below).
#
#           Multiple Command entries are recognized. The command
#           line is formed by concatenating the Command entries
#           in the specified order.
#
# Env       Specifies an environment variable to be passed to the
#           application. Token resolving is applied as explained
#           in the Command section above.
#           Note: Variables passed from the client take precedence,
#           as explained in the EnvPass section below.
#           Multiple Env entries are recognized and combined.
#
# EnvPass   Comma-separated list of environment variable names.
#           The corresponding variables are allowed to be passed
#           from the client. If configured, any variable a client
#           passes must be listed, otherwise it is not passed to
#           the application. If configured but empty, no variables
#           are allowed to pass from the client.
#
#           Note: Variables passed from the client take precedence
#           over variables having the same name that are specified
#           with the Env configuration (see above). This allows to
#           configure a fallback for variables a client might pass.
#
#           Multiple EnvPass entries are recognized and combined.
#
# StartDir  Used to set the current directory where an application
#           is started. Overrides the startdir a client may have
#           passed. Token resolving is applied as explained in the
#           Command section above.
#           Note: If Command is configured, the startdir a client
#           may have passed is never used.
#
# TTY       Supports character mode application debugging, redirects
#           an application's stdin, stdout and stderr to the specified
#           TTY device. Overrides the TTY setting a client may have
#           passed. Token resolving is applied as explained in the
#           Command section above.
#
# UserList  Comma-separated list of user names. If configured, the
#           connecting user must be listed, otherwise the user is
#           not allowed to start an application.
#           Multiple UserList entries are recognized and combined.
#
# GroupList Comma-separated list of group names. If configured, the
#           connecting user must be member of a group that is listed,
#           otherwise the user is not allowed to start an application.
#           Multiple GroupList entries are recognized and combined.
#
# AllowFrom Used to enable or reject access to an application based
# DenyFrom  on the client IP address.
#
#           AllowFrom = {All | ip-address [/ {netmask | addrbits}]}
#           DenyFrom  = {All | ip-address [/ {netmask | addrbits}]}
#           Multiple AllowFrom/DenyFrom entries are recognized and
#           combined.
#
#           ip-address: IP v4 address, such as 127.0.0.1
#           netmask: IP v4 network mask, such as 255.255.255.0
#           addrbits: number of significant leading IP v4 address bits
#           If neither netmask nor addrbits is specified, an entry
#           defaults to a host address.
#
#           If neither AllowFrom nor DenyFrom are configured, access
#           to an application is enabled from all IP addresses
#           (implied AllowFrom=All).
#           If AllowFrom and/or DenyFrom are configured, access to an
#           application is denied unless specifically allowed
#           (implied DenyFrom=All).
#
# Execute   If configured, specifies the executable to start the
#           application. By default, this is the eloqcore executable
#           located in the Eloquence bin directory.
#
# The predefined [default] section, if configured, is used whenever
# an application is not explicitly configured.
#
# The [default] section below is configured for backward compatibility
# to retain the previous eloqsd behavior, where any client may start
# any application. The UserList/GroupList/AllowFrom/DenyFrom items may
# be configured to restrict this to specific users or groups or client
# IP addresses.
#
# For security reasons, it is recommended to add a specific configuration
# for each application and then to remove or comment out the [default]
# section below.

[default]
#UserList =
#GroupList =
#AllowFrom =
#DenyFrom =

# The example configuration below matches a program named EXAMPLE
# located in the APP volume (client command line: EXAMPLE,APP)
#
# It allows the DLG environment variable to be passed from the client.
# On a JDLG client, DLG would typically be set to $host:$port. If DLG
# is not set by the client, an Env configuration makes sure it is set
# to the peer address. The DLG variable is then used with the -dlg
# command line option when starting the EXAMPLE,APP program.

#[EXAMPLE,APP]
#Env = DLG=$peer_addr
#Env = HOME=/home/$user_name
#EnvPass = DLG
#Command = -dlg $(DLG) EXAMPLE,APP

# The [dbutil] configuration below could be used to start the Eloquence
# dbutil program from a JDLG client located on the local machine or in
# the local network (assuming 192.168.1.0/24).
#
# Corresponding JDLG application configuration:
# [dbutil]
# name = Eloquence dbutil
# server = 192.168.1.11
# command = dbutil
# environment = DLG=$host:$port

#[dbutil]
#Execute = /opt/eloquence/8.2/bin/dbutil
#Env = DLG=$peer_addr
#EnvPass = DLG
#Command = -D $(DLG)
#AllowFrom = 127.0.0.0/8
#AllowFrom = 192.168.1.0/24

UserList config item

If UserList is configured, the connecting user must be listed, otherwise access to a share is denied. The user names refer to the configured users in the eloqsd.user file or, if PAM authentication is used on HP-UX or Linux, to (selected) operating system users.

UserList accepts a comma-separated list of user names. Multiple UserList entries are recognized.

The example below defines a share named "projects" in the eloqsd.share file that restricts access to the users "adam", "joe" and "mary":

[projects]
UserList = adam
UserList = joe, mary
...

GroupList config item

If GroupList is configured, the connecting user must be a member of a group that is listed, otherwise access to a share is denied. The group names refer to GroupList entries of the configured users in the eloqsd.user file or, if PAM authentication is used on HP-UX or Linux, to operating system groups associated with the connecting user.

GroupList accepts a comma-separated list of group names. Multiple GroupList entries are recognized.

The example below defines a share named "projects" in the eloqsd.share file that restricts access to those users that belong to the groups "users", "local_users" or "local_admins":

[projects]
GroupList = users, local_users
GroupList = local_admins
...

Restricting access by IP address

Multiple AllowFrom and/or DenyFrom entries are recognized, using the syntax below:

AllowFrom = {All | ip-address [/ {netmask | addrbits}]}
DenyFrom  = {All | ip-address [/ {netmask | addrbits}]}

ip-address

IP v4 address, such as 127.0.0.1

netmask

IP v4 network mask, such as 255.255.255.0

addrbits

number of significant leading IP v4 address bits

If neither netmask nor addrbits is specified, an entry defaults to a host address.

If neither AllowFrom nor DenyFrom are configured, access to a share is enabled from all IP addresses (implied AllowFrom=All).

If AllowFrom and/or DenyFrom are configured, access to a share is denied unless specifically allowed (implied DenyFrom=All).

The example below defines a share named "projects" in the eloqsd.share file that restricts access to the local system (127.0.0.1) as well as to the local network (192.168.1.1 to 192.168.1.254) except the 192.168.1.22 and 192.168.1.44 addresses:

[projects]
AllowFrom = 127.0.0.1
AllowFrom = 192.168.1.0/255.255.255.0
DenyFrom  = 192.168.1.22
DenyFrom  = 192.168.1.44
...

Using the addrbits notation, the AllowFrom rules in the example above could also be specified like:

AllowFrom = 127.0.0.0/8
AllowFrom = 192.168.1.0/24

(The 255.255.255.0 netmask is equivalent to the leading 24 bits in an IP v4 address. Also, the local system might use any address ranging from 127.0.0.1 to 127.255.255.254, hence the 127.0.0.0/8 entry.)

eloqsd.share file

HP-UX, Linux:

/etc/opt/eloquence/8.2/eloqsd.share
template file: /opt/eloquence/8.2/newconfig/config/eloqsd.share

Windows:

C:\Program Files\Eloquence\8.2\etc\eloqsd.share
template file: C:\Program Files\Eloquence\8.2\etc\eloqsd.share.sam
(the location of the Eloquence base directory may be installation dependent)

Below is the default eloqsd.share file content, as found in the template file:

# eloqsd.share
# @(#) $Revision: 27.4 $
#
# The purpose of this file is to define all disk resources which are
# known to Eloquence.
#
# HP-UX and Linux: /etc/opt/eloquence/8.2/eloqsd.share
# Windows: C:\Program Files\Eloquence\8.2\etc\eloqsd.share
#
# This file is read at the startup time of the eloqsd process.
# Changes are automatically detected and honored.
#
# Eloquence provides its own file sharing capabilities.
# This will make you independent of the availability of specific
# network file systems (NFS/SMB) and overcomes possible file system
# limitations.
#
# Format:
#
# The section names are not case sensitive. String values can be
# enclosed in double quotes to protect leading or trailing spaces.
# Everything after a hash (#) character is considered a comment.
#
# Each share definition is a different section.
#
# The following configuration items are recognized for each section:
#
# [share_id]
#
# Path      Absolute path
#
# Comment   Share description. This is displayed by the client.
#
# UserList  Comma-separated list of user names. If configured, the
#           connecting user must be listed, otherwise access to a
#           share is denied.
#           Multiple UserList entries are recognized and combined.
#
# GroupList Comma-separated list of group names. If configured, the
#           connecting user must be member of a group that is listed,
#           otherwise access to a share is denied.
#           Multiple GroupList entries are recognized and combined.
#
# AllowFrom Used to enable or reject access to a share based on the
# DenyFrom  client IP address.
#
#           AllowFrom = {All | ip-address [/ {netmask | addrbits}]}
#           DenyFrom  = {All | ip-address [/ {netmask | addrbits}]}
#           Multiple AllowFrom/DenyFrom entries are recognized and
#           combined.
#
#           ip-address: IP v4 address, such as 127.0.0.1
#           netmask: IP v4 network mask, such as 255.255.255.0
#           addrbits: number of significant leading IP v4 address bits
#           If neither netmask nor addrbits is specified, an entry
#           defaults to a host address.
#
#           If neither AllowFrom nor DenyFrom are configured, access
#           to a share is enabled from all IP addresses
#           (implied AllowFrom=All).
#           If AllowFrom and/or DenyFrom are configured, access to a
#           share is denied unless specifically allowed
#           (implied DenyFrom=All).

#[example]
#Path = /opt/eloquence/8.2/share
#Comment = Eloquence shared files

Encrypted passwords are maintained with the eqpasswd utility and kept in the eloqsd.pswd configuration file.

The PassKey user configuration item is used to refer to encrypted passwords stored in the eloqsd.pswd file.

Please note: While passwords in the eloqsd.pswd file are encrypted with the 256-bit AES encryption algorithm so they are protected against accidential disclosure, a fixed internal encryption key is currently used which cannot be changed by the user.

The eqpasswd utility

usage: /opt/eloquence/8.2/bin/eqpasswd [options] passkey

options:
 -help        - show usage (this list)
 -a           - add new passkey entry
 -d           - delete passkey entry
 -f pswdfile  - encrypted passwords file name
                (default is configured in eloqsd.cfg file)

The -a option is used to add a new passkey/password combination. The passkey is specified on the command line. The eqpasswd utility then prompts for the associated password.

The -d option is used to delete a passkey.

When neither the -a nor the -d option is present, the password for the specified passkey is updated. The eqpasswd utility then prompts for the associated password.

Encrypted passwords are maintained in a file specified in the eloqsd.cfg config file (by default eloqsd.pswd). To add a passkey, change a password or delete a passkey, write access to the password file is required. At runtime, the password file is also read by the eloqsd process.

The -f option instructs eqpasswd to use the specified password file instead of the default eloqsd.pswd file.

For example:

$ /opt/eloquence/8.2/bin/eqpasswd -a joe
Adding new password entry for 'joe'.
New password:
Reenter new password:
Password entry added.

This adds the encrypted password to the password file, associated with the specified passkey "joe".

$ /opt/eloquence/8.2/bin/eqpasswd joe
Changing password entry for 'joe'.
New password:
Reenter new password:
Password entry changed.

This changes the password associated with the passkey "joe".

PassKey config item

The PassKey item specifies an entry in the password file so that the associated password is used to authorize a user.

The example below defines a user named "joe" in the eloqsd.user file that uses a PassKey to define the user password.

[joe]
PassKey = joe
...

PAM authentication may be globally enabled in the eloqsd.cfg config file so that the eloqsd.user configuration is no longer used. The PAM subsystem may be configured to restrict which users are allowed to logon to the eloqsd, for example only those users belonging to a specific group (see below).

Alternatively, the UsePAM item in the eloqsd.user configuration may be used for specific users, so that these users authenticate against PAM.

Globally enabling PAM authentication

AuthPolicy = pam

If PAM authentication is globally enabled, the eloqsd.user configuration is no longer used. Instead, PAM is used to verify a user's password and to obtain the user's UID, GID and GroupList properties.

To use this, it is typically required to configure the PAM subsystem for the eloqsd service and optionally to restrict which users are allowed to logon to the eloqsd (see below).

User-specific PAM authentication

To use this, the AuthPolicy item in the eloqsd.cfg config file must be set to "server" (the default) and the UsePAM item in the eloqsd.user config file must be set to 1 for those users where PAM authentication should be used. Also, it is typically required to configure the PAM subsystem for the eloqsd service (see below).

The example below defines a user named "joe" in the eloqsd.user file that uses PAM authentication:

[joe]
UsePAM = 1

If the user "joe" tries to logon to the eloqsd, the PAM subsystem is queried for a user named "joe". If this user exists and the user's account is valid and the password matches, the user is logged on.

Please note: If PAM authentication is used, the Password and PassKey items are ignored. Furthermore, the UID, GID and GroupList items are not required. If present, they are used as specified. If not, PAM is used to obtain the user's UID, GID and GroupList properties.

PAM configuration on Linux

A typical content of the /etc/pam.d/eloqsd PAM configuration file could be like:

#%PAM-1.0
auth    required pam_unix.so
account required pam_unix.so
session required pam_limits.so
session required pam_unix.so

This configuration instructs the PAM subsystem to verify that the user exists and is allowed to logon, e.g., that the account is active and does not violate any configured limits, and that the user's password is not expired and matches the password that was submitted to the eloqsd.

Based on that, additional rules may be implemented, preferably using the pam_succeed_if module (see also: man pam_succeed_if).

For example, the line below, appended to the /etc/pam.d/eloqsd configuration file, would require that the users belong to the group named "eloqsd_allow":

account required pam_succeed_if.so quiet user ingroup eloqsd_allow

As shown in the example above, it is recommended to use the pam_succeed_if "quiet" option to avoid that each eloqsd logon attempt is logged to the Linux syslog.

Please note that on older Linux installations the /etc/pam.d directory might not exist, in which case the /etc/pam.conf configuration file is used.

The above examples, adapted to the /etc/pam.conf configuration, would look like:

# Eloquence eloqsd
eloqsd auth    required pam_unix.so
eloqsd account required pam_unix.so
eloqsd account required pam_succeed_if.so quiet user ingroup eloqsd_allow
eloqsd session required pam_limits.so
eloqsd session required pam_unix.so

PAM configuration on HP-UX

The eloqsd PAM authentication uses the "eloqsd" service name. By default, the /etc/pam.conf does not contain a configuration for the eloqsd service, therefore the eloqsd service falls into the "other" category which by default is sufficiently configured so that any user allowed to logon to the system would be as well allowed to logon to the eloqsd.

However, if additional rules are desired, for example to require that the eloqsd users belong to a specific group, it is necessary to use a specific eloqsd configuration in the /etc/pam.conf file, like below:

# Eloquence eloqsd
eloqsd auth    required libpam_hpsec.so.1
eloqsd auth    required libpam_unix.so.1
eloqsd account required libpam_hpsec.so.1
eloqsd account required libpam_authz.so.1
eloqsd account required libpam_unix.so.1
eloqsd session required libpam_hpsec.so.1
eloqsd session required libpam_unix.so.1

This example uses the pam_hpsec and pam_unix modules to instruct the PAM subsystem to verify that the user exists and is allowed to logon, e.g., that the account is active and does not violate any configured limits, and that the user's password is not expired and matches the password that was submitted to the eloqsd.

In addition, it configures the pam_authz module for the PAM account management group, which allows to implement additional rules in the /etc/opt/ldapux/pam_authz.policy file (see also: man pam_authz).

Example /etc/opt/ldapux/pam_authz.policy file:

# /etc/opt/ldapux/pam_authz.policy
# Eloquence eloqsd logon restrictions
# Note: Use the pam_authz module for the eloqsd service only!
allow:unix_group:eloqsd_allow
deny:unix_group:eloqsd_deny

This specifies two groups, "eloqsd_allow" and "eloqsd_deny". Users belonging to the eloqsd_allow group are allowed to logon to the eloqsd. To explicitly deny eloqsd logon for specific users, those users could be added to the eloqsd_deny group.

Please note: It is not possible to configure the pam_authz module so that it uses a configuration specific to a particular PAM service. Therefore, if the /etc/opt/ldapux/pam_authz.policy file is configured for the eloqsd service, usually the pam_authz module should not be used for any service other than eloqsd in the /etc/pam.conf file.