Q:

Automated configuration of ldap authentication for RHEL5 servers

I use puppet for managing our production servers. Under rhel5 the standard way of enabling ldap is to use the authconfig tool. Which works successfully, but isn't really capable with the puppet way of doing things. If I were to have puppet make the relevant edits to the authentication config files, which ones should I change ? Off the top of my head the files I know that need editing to enable ldap authentication are
/etc/ldap.conf
/etc/nsswitch.conf

But there may also be pam config files which I am not suer about

A:

I typically edit:
/etc/ldap.conf
/etc/nsswitch.conf
/etc/openldap/ldap.conf (check for certs if necessary)
/etc/pam.d/system-auth

I think that covers the necessary evils. Might need /etc/sudoers as well.

A:

My preference is to manage /etc/sysconfig/authconfig (which contains a list of vars) then use authconfig --updateall, this lets me drop 1 file that controls everything.

