This is a discussion on Re: Kerberos and LDAP - Kerberos ; > > Now, I have read a lot, and seems to have lost the complete overview > > of how it all works together. Can someone explain to me, just in a > > superficial way, how it fits together ...
> > Now, I have read a lot, and seems to have lost the complete overview
> > of how it all works together. Can someone explain to me, just in a
> > superficial way, how it fits together or point me to a link?
> There's nothing special really. NSS is used to get user metadata
> (username, id, gid, homedir, shell, etc..), and PAM is used to perform
> the actual verification of user credentials (login allowed or not).
> And nscd is there just to cache NSS results so that the remote lookup
> is not performed all the time.
Okey, this means it's something like this:
1. User login
2. PAM authenticates the user using info in /etc/pam.d/common-auth,
which tells it to use info from the local workstation and kerberos,
auth sufficient pam_unix.so nullok_secure
auth sufficient pam_krb5.so use_first_pass
auth required pam_deny.so
In this step PAM is also using /etc/pam.d/common-password to find out
how to evaluate passwords. Again both local passwords and passwords in
Kerberos will do.
password sufficient pam_unix.so nullok obscure md5
password required pam_krb5.so use_first_pass
Question: Am I missing a password required pam_deny.so here?
3. If the user authentication is successful, PAM
uses /etc/pam.d/common-account to grant privileges to the user; the
ressources that the user may have access to. Again local information is
okey, as well as information from LDAP and Kerberos (Why Kerberos? It
account sufficient pam_unix.so
account required pam_ldap.so
account required pam_krb5.so
In the steps above, PAM is using NSS (/etc/nsswitch.conf) to get
information about username, privileges etc. NSS bridges the information
from LDAP and/or local information to PAM.
passwd: ldap files
group: ldap files
shadow: ldap files
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
protocols: db files
services: db files
ethers: db files
rpc: db files
Is that correct ?