That is a great question. First, let me say I don't have an answer. The
reason I'm responding is that Postgres scares me. The reason it scares
me is that I have had a number of times when upgrading postgres, the DB
files were not compatible with the older version and it wasn't till
after the upgrade that I found out. Make sure that if you do use
postgres, that you plan to export the DB's to load files so that if you
do hit the upgrade issue you have a way to reload the DB.
I have tried using ldap a number of times for what you are asking and
have not been successful. I tried Fedora Directory Server and it still
is a complex setup. I still think ldap would be the way to go, but the
management tools for ldap leave a bit to be desired. Also the initial
setup has a steep learning curve.
My other issue with a central auth mechanism is that I want the user
id's and passwords to be secure going to the backend. I didn't want
wireshark to be able to pick up the credentials. Also, what happens when
the DB goes down? No one will be able to auth.
Another problem I ran up against was having the DB admin ID/password
located on each client. At least the shadow file protected the passwords
from normal user access. I do think ldap solves this issue, but
configuring the ACL's is not a trivial task.
Again, a great question and I look forward to hear what others have done.
kitepilot@kitepilot.com wrote:
> OK, I've reached that (long postponed) point of my life where I *HAVE* to
> ditch /etc/passwd and /etc/group in favor of storing my users in a database.
> Any database...
>
> Unless there is a *COMPELLING* reason not to, I will store my users in
> Postgres, but I don't see why generic concepts should not be applied to
> *ANY* database.
>
> All I find in the howto's is how to install (laundry list here), but what I
> need is a fairly general cookbook about how-to-configure-what to allow my
> machine to validate users contained in my database.
> Most of this howto's are useless to my because I run LFS and it right there
> voids any reference to apt-get/yum/rpm/etc.
>
> Furthermore, I want to login with my trusted /etc/passwd - /etc/group
> combination when I SSH into (or console) into my machine and I want the
> "other" users (people hosting WEB sites and/or receiving e-mail) be
> authenticated against the Postgres table.
>
> So the final question is:
> What do I need?
> specifically, do I need PAM? (Probably...)
> What do I configure?
>
> I don't need too many details, I just need something along the lines of:
> You need this list of packages and you need to edit this configuration files
> to accomplish (fill in the blanks)
> Lisa? :)
> HAPPY NEW YEAR!!!
> Enrique
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
(text/plain)