Hello Mike,

On Tue, 4 Sep 2001, Mike Turek wrote:

> We have PAM running using Kerberos to store the passwords and have run
> into a problem. Seems that PAM will only authenticate a user if that user
> has an account on the machine PAM is running on, even if it can find the
> name & password. Is there any way to point PAM in another direction, or
> stop it doing this check altogether?

This is not a limitation of PAM; PAM does not care if the user is local to the
Unix system or not.

However, many applications and some PAM modules (some of which are buggy in
this regard) do require that the user have a local account. For instance,
it's not meaningful to authenticate a user to the 'login' service or the
'ssh' service if they don't have a local unix account.

If you're looking for ways to scalably manage network-wide account databases,
I suggest looking into NSS (Name Service Switch), the libc plugin API for
getxx() function calls.

Cheers,
Steve Langasek
postmodern programmer

_______________________________________________
Pam-list mailing list
Pam-listredhat.com
https://listman.redhat.com/mailman/listinfo/pam-list

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]