> > Now, I have read a lot, and seems to have lost the complete overview > > of how it all works together. Can someone explain to me, just in a > > superficial way, how it fits together or point me to a link? > > There's nothing special really. NSS is used to get user metadata > (username, id, gid, homedir, shell, etc..), and PAM is used to perform > the actual verification of user credentials (login allowed or not). > And nscd is there just to cache NSS results so that the remote lookup > is not performed all the time.
Okey, this means it's something like this: 1. User login 2. PAM authenticates the user using info in /etc/pam.d/common-auth, which tells it to use info from the local workstation and kerberos, because of: auth sufficient pam_unix.so nullok_secure auth sufficient pam_krb5.so use_first_pass auth required pam_deny.so In this step PAM is also using /etc/pam.d/common-password to find out how to evaluate passwords. Again both local passwords and passwords in Kerberos will do. password sufficient pam_unix.so nullok obscure md5 password required pam_krb5.so use_first_pass Question: Am I missing a password required pam_deny.so here? 3. If the user authentication is successful, PAM uses /etc/pam.d/common-account to grant privileges to the user; the ressources that the user may have access to. Again local information is okey, as well as information from LDAP and Kerberos (Why Kerberos? It only authenticates.) account sufficient pam_unix.so account required pam_ldap.so account required pam_krb5.so In the steps above, PAM is using NSS (/etc/nsswitch.conf) to get information about username, privileges etc. NSS bridges the information from LDAP and/or local information to PAM. /etc/nsswitch.conf passwd: ldap files group: ldap files shadow: ldap files hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4 networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis Is that correct ? - Ronni ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
