Okay, new problem with regard to netgroups, NIS, and Pam:

Given the following situation:

* I want to be able to have su work normally in the event of an NIS disconnect, since I will likely need to su to fix said disconnect.

* The wheel group needs to stay local

* I want su to still use group ownership as a check

I recently could not get an admin account (defined in NIS) to su to root. Even though "groups username" showed he was in wheel (and the wheel group has been propagated into NIS), pam_group and pw groupshow show him as not.) This is probably because the local wheel group overrode the NIS wheel group. (I'm not that thrilled by having the wheel group in NIS anyway).

Since pam_group is "requisite", there's no easy way to call it multiple times, and no easy pam syntax to say "one of these two must pass". Required won't help, Otherwise I'd simply define an extra group, call it NISwheel or something, and configure access accordingly.

What I instead would propose is for pam_group to take an optional argument list instead of a single group (or possibly, multiple group= requirements).

Doing something with pam_exec is an option here as well, but I feel this functionality should be fairly elementary to add, moving forward.



"You're a daddy.  I'm a mommy.  She's our baby.  Deal with it."

-Cali, 11/7/02, about 1:35 AM

--------Dan Mahoney--------
Techie,  Sysadmin,  WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144   AIM: LarpGM
Site:  http://www.gushi.org

freebsd-questions@freebsd.org mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to