/dev/chat

3:44 PM

Does no one know about PAM?

Kartik

I don't know what is PAM.

@Kartik how authentication is done on Linux systems

terdon

@derobert wow, thanks, I did not know that

(the sudo thing)

PAM has similar things on other Unix systems too, I believe.

e.g., FreeBSD has one.

I know some stuff about PAM

3:58 PM

nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn

oops, sorry about that. Kid likes 'n'.

Hah

PAM is used to customize the authentication on unix systems

(Wikipedia informs me that Pam originates from Sun. So it's available in a lot of places.)

PAM is pretty wide spread as far as I know.

pluggable authentication modules

4:01 PM

It does more than authentication though.

Not a hugely descriptive name for the scope it covers, but meh.

Yeah. I keep wondering if no one knows about it, when I see answers about authentication questions that completely ignore it. And get 6 upvotes...

I dont normally visit U&L so i'm unfamiliar with he question.

Q: Set sudo password differently from login one

With a priviledge account, Im trying to config the sudo password differs from the login one I have done some research but havent found an answer, does sudo support that kind of configuration? Edit: The problem is, if you ever lose your password, you lose everything. Someone can log in and prom...

sudo

Heh.

Well people actually upvote stuff that sounds right you know. Or if the answer sounds as though the submitter knows what they are talking about.

There was a serverfault question about SELinux that had 3 upvotes because the person that answered it had 50k rep. Albeit it was wrong and misleading.

And who knows what'll happen if Skeet decides to troll SO someday, and post an answer that is complete BS.

Will probably cause a black hole to engulf the site.

4:10 PM

Ultimately the way it works is if an answer sounds marginally plausible its 'good enough to upvote'. Remember most people dont know if the answer actually works or have bothered to test it.

Kartik

Why does sudo ask a password when we are already logged in?

Because being logged as the normal user in but away from the keyboard versus being logged in as root and away from the keyboard may end up being two different things.

And also, asking for a password prevents a random program running as that user from becoming root.

Personally, I think that's a bigger deal in most environments.

Thats true.

4:31 PM

@derobert - most ppl are oblivious to pam's existence let alone how it works. We developed a custom pam module at my prior employer so I'm somewhat familiar with it, but by no means and am expert.

I'm only familiar with it at all from implementing LDAP accounts...

So, yeah, I guess its not too surprising that no one has heard of it.

yeah I've been meaning to learn more about ldap, still using nis at home

the docs are pretty awful from what i remember, i think we were using 0.75 or some weird version

@derobert - I've been trying to frame concepts in my mind and figure out questions to answer based on these things and potentially answer them myself as a way to "educate" others on these types of things

that's partially our responsiblity now as we've gained rep on the site, to steer the learning of others

@slm the OpenLDAP docs assume you already know LDAP.

i would suggest a Q is the best way to teach everyone here, that's all we can do

Well, I'm not answering that one, I still have an NTP one to do :-P

4:35 PM

@derobert - yes which i only partially know, I've been meaning to learn more of ldap in general since it seems it would help as well with AD

yes

i see others are attempting to climb that Q's wall too

i've left it as it is though and not even upvoted them since i didn't want to encourage additional cruft on it

what would be a good place to start learning ldap?

Not sure. I only learned enough to get through setting up LDAP accounts.

And then promptly forgot most of it....

I bet O'Reilly has a book.

Google suggests zytrax.com/books/ldap

(I get to figure out LDAP again soon, as OpenLDAP is pissing me off enough that I'm about to switch to 389)

I've never used ldap for authentication, used it for name services though.

Would t ypically opt for kerberos over ldap.

For authentication.

If it was only Unix logins, yeah. But we have other software we wanted to share the same accounts, and a lot of them did LDAP, but not Kerberos.

Setting up Kerberos would be nice sometime, though, to get the single sign on.

(Also, Windows machines as well. Going back to Windows XP. Though I suspect they support Kerberos, if you try hard enough.)

If you want to run software as a user cant you just, you know run it in the equivalent UID?

I mean software that asks for passwords itself... e.g., databases, web apps, etc.

4:47 PM

They should use pam :)

LOL, yeah

But yeah, web apps can be problematic, normally I wil setup kerberos auth in the web server (i.e apache) and then alter the web app if possible to honour REMOTE_USER

We also have web apps which have accounts for people who don't get Unix accounts.

LDAP just seemed easier to deal with (integrating with everything) at the time.

… by the third edit, I make sense, I promise!

Heh, well kerberos can provide non-unix authentication too.

You can tell pam to deny access to a particular range of UIDs and then assign from those.

kerberos isnt for everyone though. Lots of tickets to manage/save and dns needs to be spot on.

5:09 PM

Yeah. And I'm not sure how well it'd work with the variety of ancient Windows machines...

But it would be nice to do someday.