Re: [HEADS UP]: OpenLDAP+nss_ldap+nss_modules separated patch and more (SoC)

On Wed, Aug 23, 2006 at 01:33:01PM -0700, Doug Barton wrote:
Michael Bushkov wrote:
Hi,
First, thanks to all FreeBSD people and to Google for the great summer!
As the SoC deadline has almost arrived, I'm glad to post most of this
summer's work results.

Congratulations on your success with this project!

OpenLDAP + rewritten-from-scratch nss_ldap + nsswitch with separate
shared nss-modules patch.
To have
it in the tree, OpenLDAP was also needed to be placed in the tree.

Here is where (once again) we have a difference of opinion. I still believe
strongly that the nss_ldap part of your work should be a port, with a
dependency on the openldap in ports. I've stated my reasoning on this in the
previous thread, so I won't rehash it here unless someone asks. I would like
to point out though that I feel the numerous problems raised in this thread
give even more weight to the request that I, and others made not to have it
incorporated into the base.

This in no way is meant to indicate that your work has no value, or is
somehow "less valuable" than work that is actually in the base. It is simply
a realistic reflection of the fact that this facility will be needed by a
small percentage of FreeBSD users, and the difficulties (costs) outweigh the
corresponding benefit.

I disagree. Having authentication functions outside the base makes them
more vulnerable to configuration problems and general library cross
threading. It also means they can't work out of the box. I think the
costs are likely fairly small (no worse than those associated with
OpenSSL) and the benefits are substantial. I suspect you are correct
that a large portion of FreeBSD users don't need LDAP authentication,
but I believe our long-term future depends in part on attracting the
types of institutional users who do need it. I think we need to get to
the point where we can authenticate against LDAPish systems such as
Active Directory without substantially more configuration then is
currently required for nis. Currently joining the NIS/NFS cluster in
our department requires adding the following lines to /etc/rc.conf and
copying over our standard amd.conf:

nisdomainname="XXX"
nis_client_enable="YES"
amd_enable="YES"
amd_flags=""
nfs_client_enable="YES"

That's it and that's where we need to be with regard to modern LDAP
based directory services if we want people with central authentication
and authorization system to take us seriously.

Personally, I'd like to see at least some of the command line client
tools imported as well and the ldap libraries.

-- Brooks

Attachment: pgpQzdLspCgyY.pgp
Description: PGP signature

Relevant Pages

  • Re: PAM & LDAP - Pointer anyone?
    ... We tried PAM LDAP and ditched it. ... If you are worried about security, I would not recommend running NIS. ... instead by the FreeBSD ypbind and ypldapd. ... can be tightened so as to ensure password authentication only ever happens ...
    (FreeBSD-Security)
  • Re: LDAP authentication problems
    ... I have problems to get LDAP authentiction working and after two days of struggle I'm almost giving up... ... I've tried few howtos like that one from samba.idealx.org but without success. ... First I wanted to run Samba PDC on FreeBSD, but I've stuck with pam_ldap authentication. ... Does someone have working setup of LDAP authentication on FreeBSD 6.0 and would be so kind to sent me some quick howto or give an advice? ...
    (freebsd-questions)
  • RE: Acceptable LDAP solutions
    ... Sorry about that, we are trying to setup a massive network of boxes, and FreeBSD ... will be a go for those if I can get LDAP to work properly for authentication. ...
    (freebsd-current)
  • FreeBSD Security Advisory FreeBSD-SA-03:15.openssh
    ... For general information regarding FreeBSD Security Advisories, ... OpenSSH is a free version of the SSH protocol suite of network ... The ssh2 protocol supports a wide range of authentication ... Its challenge / response mechanisms, ...
    (Bugtraq)
  • [Full-Disclosure] FreeBSD Security Advisory FreeBSD-SA-03:15.openssh
    ... For general information regarding FreeBSD Security Advisories, ... OpenSSH is a free version of the SSH protocol suite of network ... The ssh2 protocol supports a wide range of authentication ... Its challenge / response mechanisms, ...
    (Full-Disclosure)