Re: pam_ldap and password management and rsh/ssh without password

From: Polly Squires (psquires_at_kewlhair.com)
Date: 06/28/05 

Date: 27 Jun 2005 20:41:15 -0700

Jason King wrote:
> Polly Squires wrote:
> > The System Administration Guide: Naming and Directory Services (DNS,
> > NIS, and LDAP) says that if you enable pam_ldap that rsh/ssh and
> > authentication that doesn't require a password will fail. So it seems
> > my choices are to fall back to pam_unix_account which ignores the fact
> > that accounts may be expired (via ldap). This doesn't make sense to
> > me. (Why isn't there a pam_ldap_account ?)
> >
> > I am not hiding expiry information from my proxy...why is this a
> > problem?
> >
> > At any rate, I'm sure that there are people out there who are using
> > ldap for password management that have a working solution with
> > ldap/rsh/ssh and password aging. What are people doing?
> >
>
> Funny you should mention that, I just mentioned something about this on
> the opensolaris-rfe list -- basically what's happening is that it's
> using an LDAP control that's returned as part of an ldap bind operation
> to obtain password expiration information, which means of course that
> pam_ldap has to actually be able to bind to the ldap server as the user
> (which it cannot do when using public key auth or rhosts since it never
> actually gets the password), so it returns a failure.
>
> You might be able to get away with manually maintaining the
> shadowAccount attributes (though I haven't tried this). The
> disadvantage to this is that then the clients are managing the password
> policy instead of letting the ldap server do it (i.e. each client would
> have to check the shadowLastChange, etc. attributes and enforce action
> appropriately). If you're doing only UNIX authentication, this might
> work, if you also want to have other things authenticate against the
> same ldap server to authenticate users, then you might start to run into
> issues (as they would also have to know to check those attributes to
> make sure an account isn't expired, or if they need to change their
> password).

I kind of figured it did a bind for account management , although I was
hoping that it only used the bind for authentication verification.

I can't believe there isn't anyone else with a working solution
already. Especially with audits pushing for password aging and
increased security(while still having some automated processes to make
your business run).

I don't have a problem falling back to pam_unix but what's really the
most effective way of updating the shadow entries? A custom passwd
command?

Does anyone know if PADL pam_ldap handles this more gracefully?

I'm really drawing for straws here.

--Polly

Relevant Pages

  • Re: How do I bind to LDAP with a username/password
    ... authenticating against an LDAP server with a username and password. ... Authentication against LDAP normally works by attempting to bind with the ...
    (comp.lang.java.programmer)
  • Re: Sun Java System Directory Server Authentication
    ... "Webserver" to handle asp or asp.net requests. ... The same goes for LDAP, at the core each LDAP server handles the LDAP protocol, but that doesn't mean each is handling all possible *service* requests, for instance don't expect Solaris LDAP to handle NTLM authentication. ... But, LDAP is more than a session layer protocol, it's also an application layer protocol, that is, it exposes well defined set of application services and here is where the analogy with HTTP stops, and authentication is not one of them. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: pam_ldap and password management and rsh/ssh without password
    ... >> authentication that doesn't require a password will fail. ... > using an LDAP control that's returned as part of an ldap bind operation ... > pam_ldap has to actually be able to bind to the ldap server as the user ... > shadowAccount attributes. ...
    (comp.security.unix)
  • Re: Can non-windows platform application use Active Directory of W2003?
    ... > current proxy server, users will be authenticated in LDAP server, which ... > caters for authentication for proxy and qmail users. ... Apparently, the sound was, "uh oh". ...
    (microsoft.public.security)
  • Re: Fedora Core 5 LDAP client authentication problem with Solaris 9 iPlanet LDAP Server
    ... The normal way that authentication is validated is for pam_ldap to attempt to bind to the LDAP server as the user in question, ... # User changes will be destroyed the next time authconfig is run. ... Nigel Wade, System Administrator, Space Plasma Physics Group, ...
    (Fedora)