Dear Tony,
Thanks for your prompt response..
http://www.linux.com/articles/113567 describes the "sufficient" modifier as follows:
If a sufficient module succeeds, it is enough to satisfy the requirements of sufficient modules in that realm for use of the service, and modules below it that are also listed as 'sufficient' are not invoked.
given the following /etc/pam.d/system.auth
file:
auth
required
/lib/security/$ISA/pam_env.so
auth
sufficient
/lib/security/$ISA/pam_unix.so
likeauth
nullok
auth
sufficient
/lib/security/$ISA/pam_ldap.so
use_first_pass
auth
required
/lib/security/$ISA/pam_deny.so
I think LDAP is used ONLY if the unix authentication fails?? right??? am I missing something???
----- Original Message ----
From: Tony Earnshaw <tonni@hetnet.nl>
To: openldap-technical@openldap.org
Sent: Thursday, February 21, 2008 9:58:57 PM
Subject: Re: using LDAP as central authentication unit
Hamidreza
Hamedtoolloei
skrev,
on
22-02-2008
03:21:
>
I've
followed
one
of
the
online
instructions
on
how
to
configure
my
>
system
to
use
ldap
as
the
user
authentication
mechanism.
below
is
>
partial
content
of
my
/etc/pam.d/system.auth
file:
>
#%PAM-1.0
>
#
This
file
is
auto-generated.
>
#
User
changes
will
be
destroyed
the
next
time
authconfig
is
run.
>
auth
required
/lib/security/$ISA/pam_env.so
>
auth
sufficient
/lib/security/$ISA/pam_unix.so
likeauth
nullok
>
auth
sufficient
/lib/security/$ISA/pam_ldap.so
use_first_pass
>
auth
required
/lib/security/$ISA/pam_deny.so
>
>
looking
at
some
online
resources
about
how
pam
works,
it
seems
that
unix
>
authentication
is
being
applied
first,
and
only
if
it
fails,
ldap
>
authentication
is
applied.
Am
I
correct
here?
In
other
words
if
all
the
>
users
are
still
in
/etc/shadow
and
/etc/passd
files....
ldap
is
NOT
>
being
used
for
authentication.
If
I
delete
the
users
from
/etc/passwd...
>
then
LDAP
is
used....
right>?
No,
all
the
modules
will
be
used,
but
the
way
they
are
treated
depends
on
the
modifiers
{sufficient,required,requisite}
and
{use_first_pass,try_first_pass,null}
(unless
you're
using
Solaris
>=
10
where
they've
been
obsoleted).
Best,
--Tonni
--
Tony
Earnshaw
Email:
tonni
at
hetnet
dot
nl