david golden johoukekucxunisonie sunday 11 november 2007 timothy murphy wrote nightmare experience yesterday running authconfiggtk following advice ancient redhat9 manual guess program suggesting dunno could ancestor frontend still _using_ rh9 file nsswitchconf seems like appendix nothing useful causes endless problems historical relic fact id say nss slightly useful pam without nss could still authenticate user password hashs ldap pam use pam plug kerberos hardware tokens whatever couldnt actually tell system users existed except still local passwd files usernames entirely useless set users doesnt change rapidly since still allows central password management hardware based auth nss anyway name service switch allows system database data come places flat files etc places someones written nss module commonly muddled pam especially since commonly encountered addon pamnss modules ldap distributed one source package padl typically need reconfigure sometimes resolverresolvconf note since nss eg supply etchosts data possible use ldap host name resolution instead dns hesiod possible use dns usernames instead ldap anyone use nowadays yes virtually anyone using ldap user accounts info linux allows system database data come ldap wish never heard ldap nightmare configure openldap worstdocumented program linux dont think personally one thing bear mind though ldap user accounts particularly used way linux lately windows active directory lot ldap protocol accessing hierarchical databases expcted mostlyread sometimeswrite matter dns lo days yore system called hesiod using dns user data databases store pretty much anything directory services wonks sometimes get bit peeved endless streams linux users dumb questions assume ldap linux auth alternatives openldap though netscape directory server sold redhat open sourced fedora directory server httpdirectoryfedoraprojectorgwikifaq authentication linux seems complete shambles pam possibly bit chaotic misunderstood really theres lot freedom choice legacy crap hanging people free choose use probably shouldnt like windows microsoft lump bunch stuff together mangling enough irritatingly incompatible normal microsoft lockin fashion declare active directory one true way innumerable rival systems sasl ssl tls etc misunderstood youve possibly misunderstood heh dont forget kerberos fun integration various misbegotten microsoft windows systems alphabet soup works together eg sasltls normal pam fit pam pluggable authentication ie way configuring addon authentication implementations used applications except bunch stuff tacked isnt exactly authentication authorization session management accounting cant substitute nss though nss tells system things exist pam regarded baroque misdesigned messy note bsds avoid hey least exists ever easy criticize dont come working alternatives clear simple document authentication linux anywhere dunno samba docs wikipedia might good starting points surfing think fair bit linuxspecific documentation assumes familiarity general security principles remember lot stuff way linuxspecific even pam though linux pam elaborated mutated docs linux varies implements assumedunderstood practices thu 07 aug 2008 212154 0000 fwd ilug pam ldap filesystem permissions