LDAP password authentication/modification schemes
From: splin (splin.sp_RemoveThisLotToReply_lin_at_ntlworld.com)
Date: 06/18/04
- Next message: wfchair: "vgchgid failed on hp-ux"
- Previous message: Steve Sayler: "ldap?? ...with my trusted HPUX too?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Fri, 18 Jun 2004 00:44:11 +0100
We are considering using LDAP to replace NIS+. It seems though that there
are a lot of different options. I believe that PAM_LDAP is the recommended
option, though we would likely use OpenLDAP (V3) servers and probably use
SSL to encrypt the client to LDAP server transactions.
Clients would be HP-UX 11i; authentication would be required for login,
rlogin, telnet, ftp, rexec and su as a minimum. We don't currently use NIS.
However we may need to implement some custom password/login rules, rather
like those of Trusted Mode. These would include password history to prevent
reuse of recent passwords, lockouts after a number of failed logins.
Passwords including the user name (or its reverse), palindromes repetative
passwords etc. would be rejected. Forced password change after first login
and after a specified duration would also be required.
I'm not sure though, exactly where this would be implemented. If it were to
be done in the server (which would have the advantage of simplifying
maintenance of this code) would we have to implement our own PAM_LDAP to
understand the servers responses and/or provide the appropriate responses to
the user when logging in? Eg. when forcing the user to change password after
first login. If we were to display the time and date of the user's last
login, again presumably this would have to be done in a custom PAM_LDAP?
If we also need to provide similar password management for local users then
presumably we again would have to provide our own PAM_LDAP implementation.
Are there any interfaces in the UX LDAP client services to allow us to
provide our own password management without providing a complete PAM_LDAP
implementation?
Would a custom PAM_LDAP implementation be a major and difficult task to
undertake? I guess that starting from the open
I'm sure that many others must have similar problems, so are there any
standards/implementations which address some if not all of these
requirements already? Would PADL's open source PAM_LDAP be the only sensible
place to start?
I notice there are several RFCs that relate to this issue. Which are the
current recommended ones that I should be looking at? Where do I start
looking? ;~)
Thanks in advance for any guidance or references that anyone can offer,
Splin.
- Next message: wfchair: "vgchgid failed on hp-ux"
- Previous message: Steve Sayler: "ldap?? ...with my trusted HPUX too?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
