Re: openldap, pam_ldap, accounts

[David J N Begley <david@avarice.nepean.uws.edu.au>]

On Sun, 5 Dec 1999, Ben Collins wrote:

> > C'mon, you knew I was asking about the behaviour of checking a separate
> > file.  Looks like this is "the suggested patch", only recently added
> > (November 20, nss_ldap v88).
> 
> Even still, how would that be a "Linux-specific hack"? :)

If it wasn't in the mainline code (which it turns out, it is) but added by a
Linux distribution vendor, then it could be said to be a "Linux-specific
hack".  ;-)  I hadn't seen this ability in nss_ldap, only some discussion of
something similar on one of the PADL mailing lists - ergo, my question.

> > As of nss_ldap v98 it looks like the bind DN still comes from the original
> > "/etc/ldap.conf" file and the new "/etc/ldap.secret" just contains the
> > password (no keywords, no comments, nothing else).
> 
> Correct, I was mistaken on this point. Having the secret seperate though
> makes it a more secure and usable system none-the-less.

Absolutely!  Still only handles reads (naming/lookup) from the directory
though...


dave