8.3. NIS+, keylogin, login and PAM

When the user logs in, he need to set his secretkey to keyserv. This is done by calling "keylogin". The login from the shadow package will do this for the user, if it was compiled against glibc 2.1. For a PAM aware login, you have to change the /etc/pam.d/login file to use pam_unix2, not pwdb, which doesn't support NIS+. An example:

#%PAM-1.0
auth       required     /lib/security/pam_securetty.so
auth       required     /lib/security/pam_unix2.so       set_secrpc
auth       required     /lib/security/pam_nologin.so
account    required     /lib/security/pam_unix2.so
password   required     /lib/security/pam_unix2.so
session    required     /lib/security/pam_unix2.so